185 lines
9.6 KiB
Plaintext
185 lines
9.6 KiB
Plaintext
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: D
|
|
:::::::::::::::::::: :::: ::: ::: ::::: :::: E
|
|
::::::: ---- ::::::::::: :::::::: :::::::: :: :::: :::::::: C
|
|
:::::: / :::::::::::::: ::::: :::::::: : :::: :::::: O
|
|
::::: / mprovised:::::: ::::: ::::::: : : ::: :::::::::: D
|
|
:::: ---- :::::::::::: ::::::: ::::::: :: :: :: :::::::::: I
|
|
::::::::::::::::::: :::::::::: ::::: :::::::: :: :::::::::: N
|
|
:::16-Nov-93:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: G
|
|
|
|
by
|
|
|
|
o l e B u z z a r d
|
|
|
|
|
|
INTRODUCTION
|
|
|
|
DTMF stands for Dual Tone/Mutli-Frequency and it is the process by which
|
|
TouchTone(c) phones operate. When a button is it on a TouchTone(c) phone a
|
|
dual tone is created each of which generates a unique frequency. Combined
|
|
these tones equal 2600Hz.
|
|
|
|
Now, it is important to note that this file as very little to do with the
|
|
workings of DTMF and nothing to do with frequency manipulation. I ask you to
|
|
keep this in mind if you see an error in statements made regarding DTMF.
|
|
DTMF in and of itself is not relevant to this file.
|
|
|
|
DTMF DECODING
|
|
|
|
Most people outside the phreaking world never think about decoding a DTMF
|
|
number if for no other reason than that they usually know what number they
|
|
dial. But within the phreaking world the ability to decode a DTMF tone can
|
|
be a phreaker's greatest tool. Often in my travels I have heard DTMF tones
|
|
blurp out at 38ms or less interval spacing (very fast dialing) and just knew
|
|
it was the number to the God of GODs. Just ask yourelf how many times either
|
|
while just doing phun stuph or even just watching television (like CNN's
|
|
Future Watch) you heard a number dialed. Wouldn't it have been kk0ol to have
|
|
known what that number was. (<- Note the period because that was a
|
|
rhetorical question.) Well thats what DTMF Decoding is all about.
|
|
|
|
Now DTMF Decoding is nothing new. In fact HAM Radio users do it all the time
|
|
because DTMF are often broadcast over the radio-waves. I mention this
|
|
because where theres a demand theres a supply. Heres a couple consumer DTMF
|
|
decoders available mail order.
|
|
|
|
[ Taken from Monitoring Times Vol.12 No.10 Oct-93 ]
|
|
----------------------------------------------------------------------------
|
|
OPTOELECTRONICS | MOTRON ELECTRONICS
|
|
5821 NE 14th Avenue | 310 Garfield Street Suite 4
|
|
Ft. Laud., FL 33334 | Eugene, OR 97402
|
|
|
|
|
DYNAMIC DUO--FM Intercept, Detect, | Tone-Master TM-16 and TM-16 Plus
|
|
Decode Tones...CTCSS, [ DTMF ], and DCS |
|
|
| The TONE-MASTER Line of Hande Held
|
|
The R10 is a unique FM Communications | Tone Dedcoder Display Products.
|
|
Test Receiver with security and | Decode Touch-Tones from a phone,
|
|
surveillance applications. The R10's | scanner, tape recorder, or nearly
|
|
full spectrum audio output interfaces | any audio source.
|
|
directly with the DC440 to monitor |
|
|
CTCSS, and [ DTMF ], FM Deviations |
|
|
and Relative Signal Strength |
|
|
|
|
|
Optoelectronics Advantages | Tone-Master Line
|
|
1. Decode & Display CTCSS, DTMF or DCS | 1. 16 Digit LCD Display with 80
|
|
& DTMF simultaneously. | character scrollable memory.
|
|
2. 127 Character DTMF Buffer with | 2. Portable 9-volt battery or ext.
|
|
scrollable 10 Character Display. | power operation.
|
|
No Lost Data | 3. Completely stand-alone. No
|
|
3. LCD Display, visible in bright light | computer necessary.
|
|
4. Serial Computer Interface | 4. Metal enclosure w/built-in
|
|
5. Activity Indicator--lets operator | monitor speaker. Only 2.75"
|
|
see when unit is activley decoding. | x 6.1" x 1.2"
|
|
6. High Quality NiCad Battery pack | 5. TM-16+ includes RS-232 output
|
|
option. | and software for automatic
|
|
7. Actual DTMF Characters Displayed! | date/time/number logging w/Comp
|
|
|
|
|
Package Price: $549 | Price: TM-16 $169 TM-16+ $239
|
|
----------------------------------------------------------------------------
|
|
|
|
Notice anything? Yes thats it....go ahead and say it... 'They both cost
|
|
money.' Actually, the Tone-Master TM-16 is not a bad deal at all. It would
|
|
be great for field phreaking. But lets assume you're not going to be 'tin
|
|
canning' on a regular basis and you would just like to be able to decode a
|
|
tone every now and then when you're phreakin around. Well the TM-16 would
|
|
still be a good deal, but in case you don't have the extra $170 bucks, I
|
|
will show you how you can do it for free.
|
|
|
|
IMPROVISED DTMF DECODING
|
|
|
|
Through the wonder of Automatic Number Identification (ANI) anyone can
|
|
decode DTMF tones easily and (more importantly) without cost. How it works
|
|
is this: Nowadays the phone line are run over-roughshod with Voice Mail
|
|
Boxes (VMBs). These VMBs, while worthwhile, and very fun to hack, can serve
|
|
another purpose. They can decode DTMF tones for us! Now VMBs are not all a
|
|
like. There are many VMB systems such as Audix, Aspen, and ROLM to name a
|
|
few. For the purpose of this file we will be focusing on Merridian VMBs.
|
|
The Merridian proves very useful for the purpose of improvised DTMF Decoding
|
|
because Merridians utilize ANI technology to provide verbal feedback to VMB
|
|
selections. What happens is this: when you call a Merridian it will ask you
|
|
which mailbox you wish to leave a message at. You then enter a box number.
|
|
The Merridian will indentify the box number you entered and tell you whether
|
|
or not the box is valid. By doing so the system has decoded the DTMF. Used
|
|
as just described constitutes intended use. For use as Improvised DTMF
|
|
Decoder follow the following (what?)
|
|
|
|
1. Record desired DTMF tones. These are the tones you recorded
|
|
while out 'tin canning'.
|
|
|
|
2. Call a Merridian VMB [1-800-946-8888]
|
|
|
|
* NOTE * This is the number to a real-live investment firm
|
|
(IDS - Investment Diversified Services). What does this mean?
|
|
Well it means that if you call them during business hours you
|
|
will talk to a real-live person. Call after 6:00pm CST to get
|
|
the VMB. (Lighten up...no one phreaks during the day any how.)
|
|
|
|
3. Bypass the outgoing message by hitting 0 + 3 and then 1
|
|
|
|
* NOTE * Now I don't know if hitting those keys works for all
|
|
Merridians or not, but I do know its not that hard to stop an
|
|
outgoing message. For more info on Merridians contact Video
|
|
Vindicator at <videov@zero.cypher.com>
|
|
|
|
4. You will hear a message that says:
|
|
|
|
'Express Messaging...to mailbox?'
|
|
|
|
At this point play the recorded DTMF tones *LOUDLY* into the
|
|
handset.
|
|
|
|
* NOTE * A real preak would have some sort of 'Box' to play the
|
|
tones directly into the phone line.
|
|
|
|
5. After tones have been played press the Pound (#) Key. You will
|
|
hear a message which says either:
|
|
|
|
'There is no box number at xxx, please try again.'
|
|
Or,
|
|
'Mailbox xxx, please leave a message after the tone.'
|
|
|
|
In either case the DTMF is decoded (yeah.)
|
|
|
|
* NOTE * This method of improvised DTMF decoding can be
|
|
achieved on other systsems which utilize ANI such as AT&T
|
|
VoiceMessaging(c). I have chosen Merridian VMBs as ideal
|
|
because they allow tone string of up to 255 NUMBERS!!!
|
|
^^^
|
|
DTMF'IN
|
|
|
|
To aid in your DTMF Decoding theres a couple of things you should probably
|
|
have.
|
|
|
|
1. A Tape Recorder, preferably a small one, but any tape recorder with an
|
|
in-shape recording head will do.
|
|
|
|
2. A Microphone. I recommend Radio Shack Model 44533 Telephone Pick-Up Mic..
|
|
$4.19
|
|
|
|
3. Tones to decode. Heres a little list of DTMF ToucTone sources
|
|
|
|
a. 'Tin-Canning' You know the big, green things that say USWest.
|
|
b. CNN's Future Watch (5:00pm Sundays EST)
|
|
c. Movies (there were all kinds of DTMF tones in WarGames).
|
|
d. Surveillance. (see 'Tin-Canning'
|
|
|
|
DTMF NUMERIC CORRESPONDENT
|
|
|
|
Heres a little DTMF/Number conversion list I'm throwing in to make my file
|
|
look more legitimate. It as no real value to this file other than to make
|
|
me look good..(better). Have Phun!! oB
|
|
|
|
697Hz + 1209Hz -> 1 770Hz + 1209Hz -> 4
|
|
697Hz + 1336Hz -> 2 770Hz + 1336Hz -> 5
|
|
697Hz + 1477Hz -> 3 770Hz + 1477Hz -> 6
|
|
|
|
852Hz + 1209Hz -> 7 941Hz + 1209Hz -> *
|
|
852Hz + 1336Hz -> 8 941Hz + 1336Hz -> 0
|
|
852Hz + 1477Hz -> 9 941Hz + 1447Hz -> #
|
|
|
|
Shout outs to: Nobody (at oB's), Disorder (at Flatline), and all my users at...
|
|
--------------------------------------------------------------------------------
|
|
oleBuzzard's kn0wledge phreak % sUmthyn lykE 4000+ text fylez % C.R.a.P.N.
|
|
AC 3o3.447.89o6--NUP = NO NUP % hAck/phrEAk/AnArky/vIrII/cArd % Call Right
|
|
24oo-14.4ooKiloBaud-Open 24/7 % n0 phUckyn lAmEr wArEz do0dz! % Phuckn Now
|
|
--------------------------------------------------------------------------------
|