df99

Members
  • Content count

    194
  • Joined

  • Last visited

Community Reputation

12 Neutral

1 Follower

About df99

  • Rank
    SUP3R 31337

Recent Profile Visitors

2,081 profile views
  1. I have a few chapters of Evan Doorbell reading Exploding the Phone on ProjectMF as well. +1 630-485-2995, seize trunk with 2600Hz, then KP-200-ST. Subsequent chapters at 201 - 206. df99
  2. Heavens no! I'm an old dude!
  3. Authoritative answer......sort of....
  4. The AC9 UK trunk signalling system used 2280Hz for line supervision and tone dialing. The trunk was cleared by sending 2280Hz for 1 second. After the "clear forward" tone and a 1-second pause, the trunk was re-seized by sending an additional 95ms of 2280Hz. After an additional 1 second delay, the dial pulses were then sent just like US 2600Hz but with 2280Hz - 66ms of tone, followed by 34ms of silence for each pulse, with a 500ms silence between digits. The older AC1 UK trunk signalling system used a two-tone system: The line was cleared with 2 seconds of 750Hz, followed immediately by 800ms of 600Hz (no delay between the two tones, followed by 2 seconds of silence. Then, the line was re-seized with 100ms of 750Hz, followed by 3 seconds of silence. Then dial pulses were sent with 750Hz, on for 66ms, off for 34ms. Timing between digits was a full 1 second. CCITT #4 used two single tones (2400Hz and 2040Hz) for clearing the line, re-seizing, and sending 4-bit binary codes for the digits and other routing codes. Details are a bit too complicated to describe here. My Arduino blue box documentation has a table with the particulars: http://www.instructables.com/files/orig/FI5/VREN/I2AQTKSE/FI5VRENI2AQTKSE.zip D.
  5. Since you can't easily do MF, why not modify the code to pulse out 2600 when you push the digit keys, like the old pre-MF step tandems used? Timing should be 66 milliseconds of 2600 Hz, followed by 34 milliseconds of silence for each pulse, with about 500 milliseconds between each digit: Digit zero would be 10 sequences of 66ms/34ms 2600, with a 500ms pause before the next digit, for example. You still need to define a key to play 2600 for about 1.5 seconds for trunk seizure. You could also write the code to accept a number, then outpulse the entire number with the correct timings. There is a number on CNET that this can be used to dial with. This is essentially the method used by Cap'n Crunch and Joe Engressia to phreak step tandems or switches that accepted older SF trunks from step tandems. Routes that used this method of tone signalling were already pretty rare back in the late 60's and early 70s when they used this technique. You had to discover a number that routed through a step tandem from your dialing location, usually by trial and error. Vancouver, BC in Canada had one such switch. D.
  6. Too many features to mention on the Sage, but a few I use are the ability to decode DTMF and MF, measurement of make/break ratio and pulse rate on a dial telephone, programmed repeat dialing on a trunk or phone line, direct interface to individual channels on a T1 line... https://www.ntecusa.com/Test-Equipment-Sales/Test-Set/Sage-930A/CC1917EC75EC771B7810BE1E6BCC617E D.
  7. I seem to recall the TELCOM dialer worked only by doing dial pulsing (loop interrupt) on the phone line connected to the jack. No DTMF dialing at all!
  8. On my Ernest D3 COCOT, you can check the current and cumulative coin box totals by letting the phone auto-answer after the set number of rings and entering a DTMF code before the internal modem tone plays. I have the phone on CNET, accessible through one of the CNET gateways. 1-762-0001 After 1 ring, the phone auto-answers. To check coin box totals, press *123456 after beep but before modem tone. Press * again for cumulative total. May or may not work over VOIP due to poor Asterisk 1.2 DTMF handling. D.
  9. On my Ernest D3 COCOT, you can check the current and cumulative coin box totals by letting the phone auto-answer after the set number of rings and entering a DTMF code before the internal modem tone plays. I have the phone on CNET, accessible through one of the CNET gateways. 1-762-0001 After 1 ring, the phone auto-answers. To check coin box totals, press *123456 after beep but before modem tone. Press * again for cumulative total. May or may not work over VOIP due to poor Asterisk 1.2 DTMF handling. D.
  10. Great video! I had not seen that. I got mine for $20.00 from Ebay 5 years or so ago. They cost thousands back when I ordered a few for a test lab back in the 80s. Here's my second-favorite trunk tester - A Sage 930A. It is much more capable than the 314A, but it's not blue! I have two of these.....One with a T1 interface.
  11. PWM would need to be done in assembly code. One normally needs hardware timers to keep track of sampling rates and such. I'd bet the clock of the old Model 100 wouldn't be high enough to get acceptable sound quality. My old 12F683 PIC blue box needed a 20MHz CPU clock to get working tones, and the quality still was not the best. The Model 100 used an Intel 80C85 running at only 2.4MHz! Don
  12. Nice esquire replica!

  13. An Arduino-based "Blue Box". It produces the "traditional" Blue Box 2600Hz tone and MF (multi-frequency) tones, but does much more. It also produces 12 tone signalling systems used by phone phreaks to hack other more exotic system in the US and overseas, including early pre-cellular mobile telephone systems from the 50s, 60s, and 70s. http://www.instructables.com/id/Arduino-12-mode-Blue-Box-Introduction/ Berry 314A Trunk Test set - Official telco blue box.
  14. I had the original Kyocera version of the Model 100. Radio Shack bought the design from Kyocera. I had the same idea for a blue box app at the time, but found it wasn't possible. The built-in BASIC had no provisions for polyphonic output. Furthermore, one could not just specify a frequency in Hz, but entered an integer in a 16-bit range that mapped to a specific frequency, followed by a tone duration. Don
  15. An Instructables write-up for my 12-mode blue box is at: http://www.instructables.com/id/Arduino-12-mode-Blue-Box-Introduction/