BLUE BOX PLANS

NOTE TO ALL:THIS IS AN ORIGINAL PHILE FROM THE OSUNY BBS(NOW DEFUNCT)...IT IS STILL A VERY COMMONPLACE FILE, AND MANY LAW ENFORCEMENT AGENCIES DO HAVE A PRINTUP OF THIS FILE...IF YOU WERE EVER CAUGHT WITH A COPY OF THIS PHILE, I HAVE ABSOLUTELY NO IDEA NOR GRASP OF WHAT THE CONSEQUENCES WOULD BE..ALSO NOTE THAT IT IS AN OLD HARDWARE TYPE FILE...UNLESS YOU ARE REALLY INTERESTED IN BUILDING ONE, AND CAN ACCEPT THE CONSEQUENCES OF BEING CAUGHT WITH A HARDWARE BLUE BOX(OUTLINED ON D1'S "PHREAKERS RIGHTS") THEN DO NOT TAKE THIS FILE AND TRY TO USE IT...IT CAN CERTAINLY MEAN NOTHING BUT TROUBLE FOR YOU....

THE ART AND PRACTICE OF BLUE BOXING

ORIGINALLY TYPED BY:NICKIE HALFLINGER & MR. AMERICA

THIS IS THE TONE MATRIX FOR A BOX WHICH GENERATES TONES THAT OPERATORS USE TO DIAL..ROTARY WORKS AS WELL, ON OPERATOR LINES, BUT THIS IS TECHNOLOGICAL(!). NOW I AGREE WITH THE OPINION OF A WELL KNOWN PHREAK THAT 'BOXING' IS/WILL BE FOR THE MOST PART DEAD, BUT THIS IS TRADITION... FIRST,YOU DIAL DIR.ASST, OR AN OPER. ETC, THEN YOU BLAST THE LINE WITH A 2600HZ TONE. THIS GIVES YOU THE LINE, THIS IS ALSO HOW MA BELL TRACKS DOWN BLUE BOXERS... EVEN ON OLD #4 CROSSBARS... ONCE ON A OPER.TRUNK LINE, YOU USE YOUR BLUE BOX/ROTARY TO DIAL... SO, IF YOU USE 2600HZ, WHICH IS NECESSARY, UNLESS YOU ARE *VERY* CAREFUL, YOU WILL BE SNAGGED. FINALLY, THIS IS WHAT YOU READ!SO LONG AND HARD FOR:

 
700   :   1   :   2   :   4   :   7   :  11   :
900   :   +   :   3   :   5   :   8   :  12   :
1100  :   +   :   +   :   6   :   9   :  KP   :
1300  :   +   :   +   :   +   :  10   :  KP2  :
1500  :   +   :   +   :   +   :   +   :  ST   :
      :  900  : 1100  : 1300  :  1500 : 1700  :

USE KP TO START A CALL, AND ST TO STOP, WITH THE BELOVED 2600HZ TONE TO DISCONNECT. I ALSO HEAR THAT 2600HZ RESETS SPRINT NODES AND GIVES YOU THEIR INITIAL TONE.. NOW, IF YOU'RE WONDERING ABOUT WHAT TO CALL FROM AN OPERATOR TRUNK, HERE ARE SOME GOODIES TO HELP YOU OUT:

XXX+101 - TOLL  SWITCHING
XXX+131 - INFORMATION
XXX+141 - RATE & ROUTE
XXX+181 - COIN REFUND OPERATOR
XXX+11501 - MOBILE OPERATOR
XXX+11521 - MOBILE OPERATOR
XXX+11511 - CONFERENCE OPERATOR

THESE WORK WITH ROTARY OR OPERATORS TONES, BUT ONLY ON OPER. TRUNK LINES... THANKS FOR LISTENING!

BLUE BOXES, PART II

WHILE READING THE FINE ARTICLE ON THE BLUE BOX I SAW THAT THERE A LOT OF DATA LEFT OUT OF THE DOCUMENT. I HOPE THIS ADDS, IN SOME SMALL WAY, TO THE INFORMATION.

TIMING SPECS WERE NOT INCLUDED. THE TONE PAIRS ARE TO REMAIN ON FOR 1/10 SEC. WITH 1/10 SEC. OF SLIENCE BETWEEN DIGITS. THE 'KP' TONES SHOULD BE SENT FOR 2/10 SEC. A WAY TO DEFEAT THE 2600HZ TRAPS IS TO SEND ALONG WITH THE 2600HZ SOME PINK NOISE(MOST OF THE ENERGY IN THIS SIGNAL SHOULD BE ABOVE 3000HZ, THIS SIGNAL WON'T MAKE IT OVER THE TOLL NETWORK, BUT SHOULD CARRY AS FAR AS YOUR LOCAL TOLL CENTER) SO THAT THE TRAPS WON'T FIND 'PURE' 2600HZ ON THE TRUNK. THIS IS NOT A PERFECTLY SAFE WAY TO BOX, BUT IT SHOULD SLOW DOWN THE DISCOVERY.

AS TO USE, THE FIRST THING YOU NEED TO UNDERSTAND IS THAT THERE ARE TWO(2) TYPES OF TOLL COMPLETING TRUNK, INWARD AND OUTWARD. THE NAMES ARE REFERENCE TO THE OFFICE THAT IS SWITCHING THE CALL(THE TOLL CENTER THAT SERVES THE WATS LINE YOU CALLED) AND EACH TYPE OF TRUNK HAS A DIFFERENT CLASS OF SERVICE. FROM AN INWARD TOLL COMPLETING TRUNK, YOU CAN REACH THE DIFFERENT SERVICE OPERATORS, THE TOLL TEST BOARD, AND THE INWARD OPERATOR. SOME OFFICES ALSO ALLOW REMOTE TESTING AND IT IS IN THESE OFFICES THAT YOU CAN ACCESS THE OUTWARD TOLL COMPLETING TRUNKS. THE OUTWARD TRUNKS ALLOW YOU TO MAKE VERIFICATION(EMERGENCY) CALLS, DO BETWEEN LA AND NYC), ENABLE AND DISABLE TSPS POSITIONS, AND IN SOME CASES(ON SOME 4A'S) ISSUE TEMPORARY REROUTING INSTRUCTIONS( SEND ALL CALLS FROM LA TO NYC VIA MIAMI, BOSTON, OR ANY OTHER CLASS 5 OFFICE OR OFFICES). BOTH TYPE OF TRUNK ALLOW YOU TO PLACE A 'STANDARD' CALL WITH A BOX.

IN SOME OFFICES, MOSTLY THE SMALL ONES WITH A TOLL TEST BOARD THAT IS UNATTENDED AT NIGHT AND ON WEEKENDS, YOU CAN GET AN OUTWARD TOLL COMPLETING TRUNK AS WELL AS PERFORMING OTHER TEST AND ROUTING FUNCTIONS. YOU DO THIS BY USING THREE DIGIT CODES THAT ARE INVALID EXCHANGES(NOT OF THE PATTERN NNX[SEE NOTE 1]). DURING THE SIXITES THE CODES USED WERE FAIRLY STANDARD AND CONSISTENT, HOWEVER WHEN THE BOXES BECAME POPULAR AND THE PHREAKS STARTED DOING THINGS LIKE ROUTING ALL CALLS FROM DALLAS TO FT. WORTH VIA WASHINGTON D.C. MOTHER STARTED CHANGING THE TEST CODES ON A RANDOM(AS FAR AS I KNOW) BASIS. WHAT I WOULD SUGGEST IS THAT EVERYBODY INTERESTED IN DOING THIS SORT OF THING PICK OUT A NICE QUIET LITTLE OFFICE SOMEWHERE AND WORK ON DISCOVERING THE CODES ACCEPTABLE TO THAT OFFICE.

EACH NUMBERING PLAN AREA(NPA, ALSO KNOWN AS AREA CODE) HAS ALL OF THE OTHER TOLL OFFICES IN THE AREA AS WELL AS SERVING AS A CONCENTRATION POINT FOR MOST OUT OF AREA CALLS. TO ACCESS THE SERVICES OF A NON-MASTER OFFICE YOU NEED IT'S 'CITY CODE', THIS IS A THREE(3) DIGIT CODE THAT IS OF THE FORM 0XX, AND IS SENT AFTER THE AREA CODE[SEE NOTE 2]. AS AN EXAMPLE, THE 'CITY CODE' FOR CANTON, OHIO IS 042; THUS TO REACH THE INWARD OPERATOR IN CANTON, YOU WOULD SEND 'KP-216-042-121-ST' WHERE AS IF YOU WANTED THE INWARD OPERATOR IN CLEVELAND, YOU WOULD SEND 'KP-216-121-ST'. THE REASON THIS IS NECESSARY IS THAT THE OPERATOR IN CLEVELAND CAN'T VERIFY A NUMBER IN CANTON, SO IF YOU WANT TO VERIFY SOMEONE IN CANTON YOU NEED THE CITY CODE. ALSO, MOST AREA MASTER OFFICES HAVE DEDICATED DATA TRUNKS TO THE NETWORK CONTROL CENTER AND THUS DON'T ACCEPT TEST AND REROUTING COMMANDS OVER THE SWITCHED NET- WORK.

IN CONCLUSION, THE SWITCHING NETWORK WILL DO A LOT MORE FOR YOU THEN CONNECT YOU TO PEOPLE AND THE SMALL OFFICES THAT REQUIRE A 'CITY CODE' ARE THE TYPE OF OFFICE TO TRY TO BREAK. NICKIE HAFLINGER, THE COVEN.

NOTE 1: THE NORMAL FORMAT FOR TELEPHONE NUMBERS IS AS FOLLOWS: NYN/NNX-XXXX. WHERE N=ANY DIGIT EXCEPT 1 AND 0; Y=0 OR 1, AND X=ANY DIGIT. YES I KNOW THAT IN SOME AREA CODES THE NNX FORMAT HAS CHANGED TO NXX. THIS IS A NEW OCCURRENCE AND ONLY OCCUR WHERE THERE HAS BE AN OUTRAGEOUS POPULATION INCREASE IN THE LAST FEW YEARS AND ALL OF THE FUNNY EXCHANGES ARE CONNECTED DIRECTLY TO MASTER OFFICES AND THUS DON'T CONFLICT WITH THE 'CITY CODE' FORMAT. NOTE 2: YOU CAN OBTAIN THE 'CITY CODE' FOR A NUMBER BY CALLING RATE AND ROUTE AND ASKING FOR THE 'NUMBERS ROUTE' TO NYN/NNX(I.E. 914/725). OR IF YOU LEAVE ME A MESSAGE WITH THE AREA CODE AND FIRST THREE OF A NUMBER, I WILL GET YOU THE 'CITY CODE'.

THIS BULLETIN WILL DEAL ONLY WITH THE BASIC CONTRUCTION, WOULD LIKE TO KNOW THE SPECIFIC JOB OF ANY PART IN THE CIRCUIT JUST WRITE ME A MSG AND I WILL BE GLAD TO ANS- WER IT.

WE ALL KNOW THAT THE TOUCH TONES FREQUENCIES ARE COMPOSED OF TWO TONES (TWO DIFFERENT FREQS.) SO THAT IS THE REASON WHY WE HAVE 2 VCO'S ( VOLTAGE CONTROLLED OSCILATORS). WE WILL CALL THESE VCO#1 AND VCO#2. IF YOU HAVE NOTICED VCO#1 ANS VCO#2 ARE EXACTLY THE SAME TYPE OF CIRCUITS. THAT IS WHY ONLY ONE WAS DRAWN. BUT REMEMBER THAT WHATEVER GOES FOR VCO#1 ALSO GOES FOR VCO#2. BOTH VCO'S ARE COMPOSED OF A HANDFULL OF PARTS. ONE CHIP TWO CAPACITORS 2 RESISTORS AND FIVE POTENTIOMETERS. ALL OF THIS WILL GIVE YOU (WHEN PROPERLY CALIBRATED) ONE OF THE FREQS. NECESSARY (THE OTHER ONE WILL COME FROM VCO#2) FOR THE OPERATION OF THE BB. BOTH OF THESE FREQS. WILL BE MIXED IN THE SPEAKER THUS FORMING THE REQUIRED TONE.

WHY?. BECAUSE OTHER DESIGNS WILL DRAIN THE BATTERY AFTER 10 - CALLS! THIS DESIGN WILL MAKE THEM LAST 10 MONTHS!!!!!!. BUT NEVER THE LESS DON'T FORGET TO PUT IN A SWITCH FOR ON AND OFF. OK LET'S BUILD THE TWO VCO'S AND CALIBRATE THE UNIT BEFORE WE GET TO THE KEYBOARD CONTRUCTION.

                       VCO CONTRUCTION
                       === ===========
  TOOLS REQUIRED
 
 1 OCILLISCOPE    (RECOMENDED BUT NOT REQUIRED)
 1 FREQ. COUNTER   (REQUIRED)
 1 VOLT METER       "  "  "
  ELECTRONICS TOOLS  (PLIERS,DRILL, SCREWDRIVERS, ETC)
 
 
      PARTS
 
 R2    1K   RESISTOR  5%
 C1    .1UF ELECTROLYTIC CAPACITOR   16VDC
 C2    .01UF ELECTROLYTIC CAPACITOR (MYLAR) 16VDC
 IC1   2207  VCO CHIP  BY EXAR ELECTRINICS
 REMEMBER THE ABOVE IT IS ONLY FOR VCO#1 BUT THE SAME GOES FOR
VCO#2.
 
  R3-R4  150 OHM RESISTORS  5%
  C3-C4   .1 UF  ELECTROLITIC CAPACITOR   10VDC
  P1-P10 200K TRIMMER POT - 20 TURNS
  DIODES USED IN THE KEYBOARD ARE 1N914 TYPE (40 OF THEM)
  AND 13 SWITCHES FOR THE KEYBOARD SPST. MOMENTARY.
 
  SPKR= YOU CAN USE A TELEPHONE SPEAKER FOR THIS(IT WORKS BEST)
        BUT REMEMBER TO TAKE OUT THE DIODE THAT IS CONNECTED 
        ACCROSS IT.

                 IMPORTANT NOTES
 
   2 PINS 10,9,8 SHOULD BE TIED TOGETHER AND BE LEFT  FLOATING.
   3 ALL RESISTOR SHOULD BE 5%! NOTHING ELSE
   4 A TELEPHONE SPEAKER GIVES THE BEST RESULTS

TROUBLE SHOOTING

BY NOW YOU SHOULD HAVE CONSTRUCTED THE TWO VCO'S ON A BREAD BOARD OR ANYTHING THAT PLEASES YOU.

CHECK FOR COLD SOLDER JOINTS, BROKEN WIRES, POLARITY OF THE BATTERY, ETC.........

BEFORE WE APPLY POWER TO THE VCO'S WE HAVE TO ADJUST THE POTS FOR THEIR HALF WAY TRAVEL POINT. THIS IS DONE BY TURNING THEM 21 TURNS TO THE RIGHT AND THEN 10 TURNS TO THE LEFT. DO THE SAME FOR ALL TEN OF THEM.

IN THE CHIPS BY PUTTING THE POSITIVE LEAD OF YOUR VOLT METER ON PIN 7 AND THE NEGATIVE LEAD ON PIN 12. IF YOU DON'T HAVE ANYTHING THERE TURN OFF THE UNIT ANT RECHECK THE WIRING.

WHEN YOU GET THE RIGHT VOLTAGES ON THE CHIPS, CONNECT A DIODE TO A PIECE OF WIRE (LOOK AT FIG. 2 FOR THE ORIENTATION OF THE DIODE) FROM GROUND TO ANY POT AT POINT T (LOOK CAREFULLY AT THE SCHEMATIC FOR POINT T IT IS LABELED T1-T10 FOR ALL POTS) YOU SHOLD BE ABLE TO HEAR A TONE, IF NOT DISSCONNECT THE LEAD AND PLACE THE SPEAKER CLOSE TO YOUR EAR AND IF YOU HEAR A CHIRP LIKE SOUND, THIS MEANS THAT THE TWO VCO'S ARE WORKING IF YOU DON'T, IT MEANS THAT EITHER ONE OR BOTH OF THE VCO'S IS DEAD. SO IN THIS CASE IT IS ALLWAYS GOOD TO HAVE AN OCILLOSCOPE ON HAND.

DISCONNECT THE SPEAKER FROM THE CIRCUIT AND HOOKUP THE OCILLISCOPE TO ONE OF THE LEADS OF THE SPEAKER AND THE GROUND FROM THE SCOPE TO THE GROUND OF THE BATTERY. CONNECT AGAIN THE GROUND LEAD WITH THE DIODE CONNECTED TO IT FROM GROUND TO ANY POT ON THE VCO THAT YOU ARE CHECKING AND YOU SHOULD SEE A TRIANGLE WAVE UNTIL YOU SEE IT. WHEN YOU DO SEE IT DO THE THE SAME FOR THE OTHER VCO TO MAKE SURE IT IS WORKING. (AMPLITUDE IS ABOUT 2VAC)

WHEN YOU GET THE TWO VCO'S WORKING YOU ARE SET FOR THE ADJUSTMENT OF THE INDIVIDUALS POTS...

ADJUSTMENT

DISCONNECT THE SPEAKER FROM THE CIRCUIT AND CONNECT A FREQ. COUNTER (THE POSITIVE LEAD OF THE COUNTER TO ONE OF THE SPEAKERS LEADS THAT BELONGS TO VCO#1 OR CONNECT IT TO PIN 14).

CONNECT THE NEGATIVE LEAD TO THE BATTERY NEGATIVE AND CONNECT THE JUMPER LEAD WITH THE DIODE FROM GROUND TO POT NUMBER 1 T1 .( THE FIRST POT NUMBER 1 POINT T1) IF YOU GOT IT WORKING YOU SHOULD HEAR A TONE AND GET A READING ON THE COUNTER. ADJUST THE POT FOR A FREQ. OF 1700HZ AND CONTINUE DOING THE SAME FOR POTS 2-5 EXCEPT THAT THEY GET DIFFERENTS FREQS.

NOW DISCONNECT THE FREQ. COUNTER FROM THE SPEAKER LEAD OF VCO#1 OR FROM PIN 14 (WHICH EVER YOU HAD IT ATTACHED TO AT THE BEGINNING) AND CONNECT IT TO THE SPEAKER LEAD OF VCO#2 OR TO PIN 14 OF VCO#2 AND PERFORM THE SAME ADJUSTMENTS TO P6-10.

                    P6= 1100HZ
                    P7=  700HZ
                    P8=  900HZ
                    P9=  2600HZ   MAGIC NUMBER!!!!!
                    P10= 1500HZ

WHEN YOU FINISH DOING ALL OF THE POT GO BACK AND RECHECK THEM

KEYBOARD

IF YOU LOOK AT FIG-2 YOU WILL SEE THAT THE KEYS ARE SIMPLE SWITCHES CONNECTED TO GROUND AND TWO DIODES ON THE OTHER END. THESE DIODES ARE USED TO SIMPLIFY THE CONSTRUCTION OF THE KEYBOARD BECAUSE OTHERWISE THE DISTRIBUTION OF THE GROUND SIGNAL FOR BOTH VCO'S WOULD HAVE BEEN DONE MECHANICALLY. ONE DIODE WILL GO TO VCO#1 AND THE OTHER WILL GO TO VCO#2. FIG-3 SHOWS THE ARRANGEMENT OF THE KEYS ON THE KEYBOARD.

BELOW IS A TABLE THAT WILL HELP YOU CONNECT THE KEYS TO REQUIRED VCO'S POTS.

                TO               TO             FREQ OUT            FREQ OUT
     KEY     POT ON VCO1     POT ON VCO2        PIN 14 VCO1       PIN 14 VCO
      C          1                6              1700              1100
      0          2                10             1300              1500
      E          1                10             1700              1500
      2          3                7              1100               700
      3          3                8              1100               900
      4          2                7              1300               700
      5          2                8              1300               900
      6          2                6              1300              1100
      7          5                7              1500               700
      8          5                8              1500               900
      9          5                6              1500              1100
      X          -                9              ----              2600

***********************************************************************
* REMEMBER THAT FIG-2 IT IS THE SAME FOR EACH KEY EXCEPT THE "X" WHICH*
* ONLY TAKES ONE DIODE.                                               *
***********************************************************************

AS A FINAL WORD YOU CAN BUILD THIS IN ANY TYPE OF ENCLOSURE AND SHOULD NEVER BE USED TO MAKE FREE CALLS USING THE TELEPHONE LINES. I HOPE THIS BULLETIN WILL CLEAR ANY QUESTION YOU MAY

IF YOU HAVE ANY QUESTION PLEASE LEAVE ME A MSG. AND I WILL BE VERY GLAD TO ANSWER IT.

TXS MR. AMERICA

PS. I WOULD LIKE TO THANK MY KEYBOARD, MY FINGERS, AND ME FOR HELPING ME WRITTE THIS BULLETTIN. WITHOUT THEIR HELP I WOULD HAVE NEVER FINISH THIS PROJECT.