468 lines
20 KiB
Plaintext
468 lines
20 KiB
Plaintext
BLUE BOXING
|
||
[===========]
|
||
|
||
|
||
This is the tone matrix for a box which generates tones that operators use to
|
||
dial..rotary works as well, on operator lines, but this is technological(!). no
|
||
w i agree with the opinion of a well known phreak that 'boxing' is/will be for t
|
||
he most part de
|
||
ad, but this is tradition... first,you dial dir.asst, or an oper. etc , then you
|
||
blast the line with a 2600 hz tone. this gives you the line, this is also how m
|
||
a bell tracks down blue boxers... there are 2600hz detectors systems, and even
|
||
on old #4 cross
|
||
bars... once on a oper.trunk line, you use your blue box/rotary tdo dial...
|
||
|
||
so, if you use 2600hz, which is necessary, unless you are *very* careful, you w
|
||
ill be snagged. finally, this is what you read! so long and hard for:
|
||
|
||
700 : 1 : 2 : 4 : 7 : 11 : 900 : + : 3
|
||
: 5 : 8 : 12 : 1100 : + : + : 6 : 9 : KP
|
||
: 1300 : + : + : + : 10 : KP2 : 1500 : +
|
||
: + : + : + : ST : : 900 : 1100 : 1300 : 1500 : 1700
|
||
|
||
|
||
|
||
use kp to start a call, and st to stop, with the beloved 2600hz tone to disconne
|
||
ct. i also hear that 2600hz resets sprint nodes and gives you their initial tone
|
||
..
|
||
|
||
now, if you're wondering about what to call from an operator trunk, here are som
|
||
e goodies to help you out:
|
||
|
||
XXX+101 - TOLL SWITCHING
|
||
XXX+121 - LOCAL OPERATOR
|
||
XXX+131 - INFORMATION
|
||
XXX+141 - RATE ROUTE
|
||
XXX+181 - COIN REFUND OPERATOR
|
||
XXX+11501 - MOBILE OPERATOR
|
||
XXX+11521 - MOBILE OPERATOR
|
||
XXX+11511 - CONFERENCE OPERATOR
|
||
|
||
|
||
---CONCERNING ABOVE
|
||
|
||
|
||
First the tones. while all the information is correct, the timing specs w
|
||
|
||
ere not included . the tone pairs are to remain on for 1/10 sec. with 1/10 sec.
|
||
of silence between digits. the 'kp' tones should be sent for 2/10 sec. a way
|
||
to defeat the
|
||
2600 hz traps is to send a long with the 2600hz some pink noise(most of the en
|
||
ergy in this signal should be above 3000hz, this signal won't make it over the
|
||
toll network, but should carry as far as your local toll center) so that the tr
|
||
aps won't find
|
||
'pure' 2600 hz on the trunk. this is not a perfectly safe way to box, but it sho
|
||
uld slow down the discovery.
|
||
|
||
as to use, the first thing you need to understand is that there are two(2)
|
||
types of toll completing trunk, inward and outward. the names are reference to t
|
||
he office that is switching the call(the toll center that serves the watsline yo
|
||
u called) and e
|
||
ach type of trunk has a different class of service. from an inward toll completi
|
||
ng trunk, you can reach the different service operators, the toll test board, an
|
||
d the inward operator. some offices also allow remote testing and it is in these
|
||
offices that y
|
||
ou can access the outward toll completing trunks. the out wardtrunks allow you
|
||
to make verification(emergency) calls, do service monitoring(tapping), stack tru
|
||
nks(busy out all trunks between la and nyc), enable and disable tsps positions,
|
||
and in some cas
|
||
|
||
es(on some 4a's) issue temporary rerouting instructions(send all calls from la t
|
||
o nyc via miami, boston, or any other class 5 office or offices). both type of t
|
||
runk allow you to place a 'standard' call with a box.
|
||
in some offices, mostly the small ones with a toll test board that is unatt
|
||
ended at night and on weekends, you cange to an outward toll completing trunk as
|
||
well as performing other test and routing functions. you do this by using three
|
||
digit codes th
|
||
at are invalid exchanges (not of the pattern nnx[see note 1]). during the sixite
|
||
s the codes used were fairly standard and consistent, however when the boxes bec
|
||
ame popular and the phreaks started doing things like routing all calls from dal
|
||
las to ft. wort
|
||
h via washington d.c. others started changing the test codes on a random (as far
|
||
as i know) basis. what i would suggest is that everybody interested in doing th
|
||
is sort of thing pick out a nice quiet little office somewhere and work on disco
|
||
vering the code
|
||
s acceptable to that office.
|
||
each numbering plan area (npa, also known as area code)has an office design
|
||
ated as its master office. this office controls all of the other toll offices in
|
||
the area as well asserving as a concentration point for most out of area calls.
|
||
to access the s
|
||
ervices of a non-masteroffice you need it's'city code', this is a three(3) digit
|
||
code that is of the form 0xx, and is sent after the area code [see note 2 ]. as
|
||
|
||
an example, the 'city code' for canton, ohio is 042; thus to reach the inward o
|
||
perator in cant
|
||
on, you would send 'kp-216-042-121-st' where as if you wanted the inward operato
|
||
r in cleveland, you would send 'kp-216-121- st'. the reason this is necessary is
|
||
that the operator in cleveland can't verify a number in canton, so if you want
|
||
to verify someo
|
||
ne in canton you need the city code. also, most area master offices have dedicat
|
||
ed data trunks to the network control center and thus don't accept test and rero
|
||
uting commands over the switched net-work.
|
||
|
||
in conclusion, the switching network will do a lot more for you then connec
|
||
t you to people and the small offices that require a 'city code' are the type of
|
||
office to try to break.
|
||
|
||
note 1: the normal format for telephone numbers is as follows: nyn/nnx-xxxx
|
||
. where n=any digit except 1 and 0;y=0 or 1, and x=any digit. yes i know that in
|
||
some area codes the nnx format has changed to nxx. this is a new occurrence and
|
||
only occur whe
|
||
re there has be an outrageous population increase in the last few years and all
|
||
of the funny exchanges are connected directly to master offices and thus don't c
|
||
onflict with the 'city code' format.
|
||
|
||
|
||
note 2: you can obtain the 'city code' for a number by calling rate and rou
|
||
te and asking for the 'numbers route' to nyn/nnx(i.e. 914/725). or if you leave
|
||
me a message with the area code and first three of a number, i will get you the'
|
||
city code'.
|
||
|
||
|
||
|
||
|
||
blue box plans
|
||
---- --- -----
|
||
|
||
$ BLUE BOX PLANS! $
|
||
$ This file will explain the $
|
||
$ construction, troubleshooting, and $
|
||
$ adjustment of a Blue Box. $
|
||
$ $
|
||
$ We all know that the touch tone $
|
||
$ frequencies are composed of 2 tones $
|
||
$ (2 different freqs.) so that is the $
|
||
$ reason why we have 2 VCO's (Voltage $
|
||
$ Controlled Oscilators). We'll call $
|
||
$ them VCO#1 and VCO#2. If you have $
|
||
|
||
$ noticed VCO#1 and VCO#2 are exactly $
|
||
$ the same type of circuits. That is $
|
||
$ why only 1 was drawn. But remember $
|
||
$ that whatever goes for VCO#1 also $
|
||
$ goes for VCO#2. Both VCO'S are $
|
||
$ composed of a handfull of part. One $
|
||
$ chip, two capacitors, 2 resistors $
|
||
$ and five potentiometers. All of $
|
||
$ this will give you (when properly $
|
||
$ calibrated) one of the freqencies $
|
||
$ necessary (the other one will come $
|
||
$ from VCO#2) for the operation of $
|
||
$ the Blue Box. Both of these freqs. $
|
||
$ will be mixed in the speaker to $
|
||
$ form the required tone. $
|
||
$ $
|
||
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
|
||
$ $
|
||
$ This is one of the most $
|
||
$ sophisticated designs I have ever $
|
||
$ made. Why?. Because other designs $
|
||
$ will drain the battery after 10 $
|
||
|
||
$ calls. This design will make them $
|
||
$ last 10 months!!!!!!. But never the $
|
||
$ less, don't forget to put in a $
|
||
$ switch for on and off. Ok let's $
|
||
$ build the two VCO'S and calibrate $
|
||
$ the unit before we get to the $
|
||
$ keyboard construction. $
|
||
$ $
|
||
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
|
||
! !
|
||
! VCO CONSTRUCTION !
|
||
! === ============ !
|
||
! !
|
||
! TOOLS REQUIRED !
|
||
! ----- -------- !
|
||
! !
|
||
! 1 ocilliscope(optional but not req) !
|
||
! 1 Freq. counter (REQUIRED) !
|
||
! 1 Volt meter " " " !
|
||
! Electronics tools (Pliers,drll, !
|
||
! screwdrivers, etc.) !
|
||
! !
|
||
|
||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
.......................................
|
||
. .
|
||
. ! $-PARTS-$ ! .
|
||
. ------------- .
|
||
. .
|
||
. R1 1.5K RESISTOR 5% .
|
||
. R2 1K RESISTOR 5% .
|
||
. C1 .1uf ELECTROLYTIC CAPACITOR 16VDC.
|
||
. C2 .01uf " " (MYLQR)16VDC.
|
||
.IC1 2207 VCO CHIP BY EXAR ELECTRONICS.
|
||
. Remember the above only says .
|
||
. VCO#1 but the same is for VCO#2 .
|
||
. R3-R4 150 OHM RESISTORS 5% .
|
||
. C3-C4 .1 uf ELECTROLITIC CAPACITOR .
|
||
. 10VDC .
|
||
. P1-P10 200K TRIMMER POT - 20 TURNS .
|
||
. DIODES USED IN THE KEYBOARD .
|
||
. ARE 1N914 TYPE (40 OF THEM) .
|
||
. 13 SWITCHES FOR THE KEYBOARD .
|
||
. SPST MOMENTARY. .
|
||
. SPKR=YOU CAN USE A TELEPHONE SPEAKER.
|
||
|
||
. FOR THIS (IT WORKS BEST) BUT .
|
||
. REMEMBER TO TAKE OUT THE DIODE .
|
||
. THAT IS CONNECTED ACCROSS IT. .
|
||
***************************************
|
||
* --------------------- *
|
||
* ! *IMPORTANT NOTES* ! *
|
||
* --------------------- *
|
||
* 1. DO NOT USE ANYTHING ELSE OTHER *
|
||
* THAN A MYLAR CAPACITOR FOR C2. *
|
||
* 2. PINS 10,9,8 SHOULD BE TIED *
|
||
* TOGETHER AND BE LEFT FLOATING. *
|
||
* 3. ALL RESISTORS SHOULD BE 5%! *
|
||
* NOTHING ELSE! *
|
||
* 4. A TELEPHONE SPEAKER GIVES THE *
|
||
* BEST RESULTS. *
|
||
***************************************
|
||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||
% -------------------- %
|
||
% ! TROUBLE SHOOTING ! %
|
||
% -------------------- %
|
||
% By now you should have constructed%
|
||
% the two VCO'S on a bread board or %
|
||
|
||
% anything that pleases you. %
|
||
% Check for cold solder joints, broken%
|
||
% wires, polarity of the battery, etc.%
|
||
% Before we apply power to the VCO'S %
|
||
% we have to adjust the pots for their%
|
||
% half way travel point. This is done %
|
||
% by turning them 21 turns to the %
|
||
% right and then 10 turns to the left.%
|
||
% Do the same for all ten of them. %
|
||
%-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-%
|
||
% Now apply power to the unit check %
|
||
% to see that you have power in the %
|
||
% chips by putting the positive lead %
|
||
% of your volt meter on pin 7 and the %
|
||
% negative lead on pin 12. If you do %
|
||
% not have anything there turn off %
|
||
% the unit and RECHECK THE WIRING. %
|
||
%-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-%
|
||
% When you get the right voltages %
|
||
% on the chips, connect a diode to a %
|
||
% piece of wire (look at fig. 2 for %
|
||
% the orientation of the diode) from %
|
||
|
||
% ground to any pot at point T (look %
|
||
% carefully at the schematic for %
|
||
% point T it is labeled T1-T10 for %
|
||
% all pots). You should be able to %
|
||
% hear a tone, if not disconnect the %
|
||
% lead and place the speaker close to %
|
||
% your ear and if you hear a %
|
||
% chirp-like sound, this means that %
|
||
% the two VCO'S are working if you %
|
||
% don't, it means that either one or %
|
||
% both of the VCO'S are dead. So in %
|
||
% this case it is always good to have %
|
||
% an ocilloscope on hand. %
|
||
% Disconnect the speaker from the %
|
||
% circuit and hook the ocilliscope to %
|
||
% 1 of the leads of the speaker the %
|
||
% ground from the scope to the ground %
|
||
% of the battery. Connect again the %
|
||
% ground lead with the diode connected%
|
||
% to it from ground to any pot on the %
|
||
% VCO that you are checking and you %
|
||
% should see a triangle wave if not %
|
||
|
||
% turn the pot in which you are %
|
||
% applying the ground to until you see%
|
||
% it. When you do see it do the the %
|
||
% same for the other VCO to make sure %
|
||
% it is working. (amplitude is about %
|
||
% 2VAC). When you get the two VCO's %
|
||
% working you are set for the %
|
||
% adjustment of the individuals pots. %
|
||
% %
|
||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||
: -------------- :
|
||
: ! ADJUSTMENT ! :
|
||
: -------------- :
|
||
: DISCONNECT THE SPEAKER FROM THE :
|
||
: CIRCUIT AND CONNECT A FREQ. COUNTER :
|
||
: (THE POSITIVE LEAD OF THE COUNTER TO:
|
||
: ONE OF THE SPEAKERS LEADS THAT :
|
||
: BELONGS TO VCO#1 OR CONNECT IT TO :
|
||
: PIN 14). :
|
||
:-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-:
|
||
: CONNECT THE NEGATIVE LEAD TO THE :
|
||
: BATTERY NEGATIVE AND CONNECT THE :
|
||
|
||
: JUMPER LEAD WITH THE DIODE FROM :
|
||
: GROUND TO POT NUMBER 1.T1. :
|
||
: ( THE FIRST POT NUMBER 1 POINT T1) :
|
||
: IF YOU GOT IT WORKING YOU SHOULD :
|
||
: HEAR A TONE AND GET A READING ON :
|
||
: THE COUNTER. ADJUST THE POT FOR A :
|
||
: FREQ. OF 1700hz AND CONTINUE DOING :
|
||
: THE SAME FOR POTS 2-5 EXCEPT THAT :
|
||
: THEY GET DIFFERENTS FREQS. WHICH ARE:
|
||
: $$$$$$$$$$$$$$ :
|
||
: $ P1= 1700hz $ :
|
||
: $ P2= 1300hz $ :
|
||
: $ P3= 1100hz $ :
|
||
: $ P4= 900hz $ :
|
||
: $ P5= 1500hz $ :
|
||
: $$$$$$$$$$$$$$ :
|
||
: NOW DISCONNECT THE FREQ. COUNTER :
|
||
: FROM THE SPEAKER LEAD OF VCO#1 OR :
|
||
: FROM PIN 14 (WHICH EVER YOU HAD IT :
|
||
: ATTACHED TO AT THE BEGINNING) AND :
|
||
: CONNECT IT TO THE SPEAKER LEAD OF :
|
||
: VCO#2 OR TO PIN 14 OF VCO#2 AND :
|
||
|
||
: MAKE THE SAME ADJUSTMENTS TO P6-10. :
|
||
: $$$$$$$$$$$$$$$ :
|
||
: $ P6= 1100hz $ :
|
||
: $ P7= 700hz $ :
|
||
: $ P8= 900hz $ :
|
||
: $ P9= 2600hz $ :
|
||
: $ P10= 1500hz $ :
|
||
: $$$$$$$$$$$$$$$ :
|
||
: WHEN YOU FINISH DOING ALL OF THE :
|
||
: POTS GO BACK AND RE-CHECK THEM. :
|
||
:::::::::::::::::::::::::::::::::::::::
|
||
< --------=--- >
|
||
< ! KEYBOARD ! >
|
||
< ------------ >
|
||
< IF YOU LOOK AT FIG-2 YOU WILL SEE >
|
||
< THAT THE KEYS ARE SIMPLE SWITCHES. >
|
||
< CONNECTED TO A GROUND AND TWO >
|
||
< DIODES ON THE OTHER END. THESE >
|
||
< DIODES ARE USED TO SIMPLIFY THE >
|
||
< CONSTRUCTION OF THE KEYBOARD >
|
||
< BECAUSE OTHERWISE THE DISTRIBUTION >
|
||
< OF THE GROUND SIGNAL FOR BOTH VCO'S >
|
||
|
||
< WOULD HAVE BEEN DONE MECHANICALLY. >
|
||
< THE DIODE WILL GO TO VCO#1 AND THE >
|
||
< OTHER WILL GO TO VCO#2. FIG-3 SHOWS >
|
||
< THE ARRANGEMENT OF THE KEYS ON THE >
|
||
< KEYBOARD. >
|
||
z5ujj-=-=->-=-=-=-=-=-=-=-?
|
||
< BELOW IS A TABLE THAT WILL HELP >
|
||
< YOU CONNECT THE KEYS TO THE >
|
||
< REQUIRED VCO'S POTS. >
|
||
<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->
|
||
< (-FIG 2-) >
|
||
<-----!-----!--------!--------!------->
|
||
< ! ! ! ! >
|
||
< TO ! TO ! FREQ ! FREQ ! KEY >
|
||
< POT ! POT ! OUT: ! OUT: ! >
|
||
< ON ! ON ! ! ! >
|
||
< VCO1! VCO2! ! ! >
|
||
<-----!-----!--------!--------!------->
|
||
< 1 ! 06 ! 1700hz ! 1100hz ! C >
|
||
< 2 ! 10 ! 1300hz ! 1500hz ! 0 >
|
||
< 1 ! 10 ! 1700hz ! 1100hz ! E >
|
||
< 4 ! 07 ! 0900hz ! 0700hz ! 1 >
|
||
|
||
< 3 ! 07 ! 1100hz ! 0700hz ! 2 >
|
||
< 3 ! 08 ! 1100hz ! 0900hz ! 3 >
|
||
< 2 ! 07 ! 1300hz ! 0700hz ! 4 >
|
||
< 2 ! 08 ! 1300hz ! 0900hz ! 5 >
|
||
< 2 ! 06 ! 1300hz ! 1100hz ! 6 >
|
||
< 5 ! 07 ! 1500hz ! 0700hz ! 7 >
|
||
< 5 ! 08 ! 1500hz ! 0900hz ! 8 >
|
||
< 5 ! 06 ! 1500hz ! 1100hz ! 9 >
|
||
< - ! 09 ! ------ ! 2600hz ! X >
|
||
<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->
|
||
< REMEMBER THAT IN FIG-2 IT'S THE >
|
||
< SAME FOR EACH KEY EXCEPT THE "X" >
|
||
< KEY, WHICH ONLY TAKES ONE DIODE. >
|
||
*******************************.*******
|
||
|
||
|
||
few KEYS to the diagram:
|
||
|
||
Cx is capacitor #x Denoted by: ---| |---
|
||
|
||
Px is Pot or Variable resistor #x Denoted by :/
|
||
\
|
||
|
||
/<--
|
||
\
|
||
Rx is resistor #x Denoted by /\/\/\/\
|
||
|
||
Schematics
|
||
==========
|
||
|
||
The XR-2207 chip is a Voltage-Controlled Oscillator and a 14 pin device
|
||
thus you must be very careful when soldering the parts to this device. It is
|
||
a little dificult to actually draw a schematic on an 80 character screen
|
||
using limited graphics, but I will give it a try.
|
||
|
||
TO GND_____________
|
||
|
|
||
___
|
||
C2 C3 ___
|
||
_||_ |
|
||
| | _____|__9v+
|
||
| | | |
|
||
` ` ` ` ` ` ` |
|
||
------------------------------- |
|
||
7 6 5 4 3 2 1 | |
|
||
|
||
| < |
|
||
|8 9 10 11 12 13 14| |
|
||
------------------------------- |
|
||
` ` ` ` ` ` ` |
|
||
| | |
|
||
--| |--------| | |
|
||
|C1 R2 | R1 |
|
||
GND ______|___/\/\/\/\______|_____/\/\/\/\______|
|
||
|
||
|
||
is is a diagram of how to locate the different pins on the chip.
|
||
Please notice that pin one (1) is the closest to the notch on top of the chip.
|
||
The first thing we'll do is to connect power to the chip (remember that you
|
||
need to build two (2) of these to get a complete system) this is accomplished
|
||
by connecting the positive wire of the battery lead to pin#1 one leg of R1
|
||
and R2 is soldered to pin#11. The other leg of R1 goes to pin 1 or to the
|
||
d. C1 goes
|
||
between pin 10 and ground. The timing capacitor or C2 goes between pins 2
|
||
and 3 of the chip. Pins 8 and 9 should be grounded to ground. Pin 14 is the
|
||
output and this is where one leg of C4 (C3 goes on the other VCO) in series
|
||
with R3 (the same goes for the other VCO) and to one lead of the speaker.
|
||
|
||
|
||
The trimmer pots P1 to P10 should be grouped in groups of 5 pots each.
|
||
The way you group it is by soldering one end of the pot to each other leaving
|
||
the wiper and the other end free.
|
||
|
||
| This end goes to pin 6 of the chip
|
||
|
|
||
_____________|_____________
|
||
/ / / / /
|
||
\ \ \ \ \
|
||
/<- /<- /<- /<- /<-
|
||
\ | \ | \ | \ | \ |
|
||
/ | / | / | / | / |
|
||
| | | | |
|
||
| | | | |
|
||
P1 P2 P3 P4 P5
|
||
|
||
|
||
And finally this is the way each key should be wired.
|
||
|
||
diode
|
||
he contact of the
|
||
|--------- \------ key
|
||
|
||
to Px ------>|-----| |
|
||
diode |
|
||
-----
|
||
--- Ground
|
||
|
||
|
||
|
||
|