ThoughtPhreaker

Members
  • Content count

    1,645
  • Joined

  • Last visited

  • Days Won

    75

ThoughtPhreaker last won the day on May 16

ThoughtPhreaker had the most liked content!

Community Reputation

108 Expert

2 Followers

About ThoughtPhreaker

  • Rank
    Dangerous free thinker
  • Birthday 11/02/1991

Profile Information

  • Gender
    Male

Contact Methods

  • Website URL
    http://
  • ICQ
    0

Recent Profile Visitors

29,698 profile views
  1. Here's a short recording from the electromechanical switches at the Seattle Museum of Communications. In retrospect, I could've done a way better job at this; as you might pick up from what I chose to call, I was a little overwhelmed by all the variety, and couldn't really make up my mind about what to record. It ended up being a little scattered. That being said however, I was using a completely new patch circuit to make these recordings; it was the second time I'd ever used it, and certainly the first time I'd ever stuck my recorder on an electromechanical switch. This is the one thing I did account for; usually when I record stuff, loud clicks, like a battery drop are extremely loud - enough so that it'll cause clipping unless you set your levels really, really low. Normally this isn't a big issue since that's basically the only click you'll ever get locally from the modern network. That's something I really didn't want on this recording though, so I added a couple of DC filtering caps and current limiting diodes. Thanks to that, I got a far cleaner recording of a lot of things than I probably would've otherwise. So one thing you'll probably notice right away is I don't have any (interesting) recordings of the panel switch. The reason for that is simple: a lot of the phones in the museum are from the period the switch was made. For example, you have lots of candlestick-era phones on the Panel, 302 sets on the Crossbar 1 and so forth. This is a great aesthetic choice, but unfortunately, it also means not only are there no modular jacks, a lot of these phones don't have varistors in the earpieces either. This is the thing in the earpiece that makes really loud, sudden noises (like a battery drop or a cut-through click) stick to a reasonable volume. When they're not on a phone, I can't stress enough that you do *not* want your ear near it when something clicks. Needless to say, I felt bad - the panel switch is the pride and joy of some of the volunteers, but there wasn't anything I could use to call from it. Finally, I'm flashing everything by hand here. This is because the best place to record was from a 1A2 key phone with lines from all the different switches in the museum (except the panel), but for whatever reason, the voltage dipped too low by the time it hit the DTMF IC to power it. For that reason, well, I don't dial a lot of numbers with zeroes in them. This is probably just as well for the step switch; it has tone to pulse converters, but they cut back too late to let you hear the cut-in noises. That being said, if you ever go, it's really easy to underestimate the step switch in a big room filled with some seriously incredible switching equipment. But don't. If you familiarize yourself with all the noises they make when they cut in and such from the Evan Doorbell recordings, it becomes clear that everything is laid out nice and neatly on the switch like an open FTP directory or a PBX; not a whole lot of things can be hidden. Also, much like in the recordings, a short flash can reset a trunk instead of hang up on a call. Anyway, enough crap. Here's a list of calls on the recording: Call 1: Crossbar 5 - 844-1111 (time, on panel) Call 2: Step - 844-1111 (time, on panel) Call 3: Crossbar 1 - 232-0027 (line on Crossbar 5) Call 4: Crossbar 1 - 232-8811 (vacant number on Crossbar 5) Call 5: Crossbar 1 - Permanent signal trunk, resets back to dialtone Call 6: Crossbar 5 - 231-1111 (vacant code; crybaby tone) Call 7: Step - 232-9911 (3-slot payphone on crossbar 5. I answer and screw around for a bit. Notice after I hang up, the trunk never releases) Call 8: CX-100 - 9 (it ignores this) Call 9: CX-100 - 1,1 (it ignores this too) Call 10: CX-100 - 0 (the switch tries to pick up a line from the crossbar 1, but it was disconnected. This was fixed later, but I never recorded it) Call 11: Step - 7,845-2 (the seven level of the first selector is vacant. The step drops me back to dialtone, I dial 845-2 and get a reorder from it) Call 12: Step - 1-22 (the 1 is absorbed on the first selector. Notice the dialtone comes back under the pulses of the next digit. The next 2 gets a reorder) Call 13: Step - 1-231-11 (the first 1 is absorbed like before. I have some trouble with the button messing around with the sound. After 23, the step cuts into a trunk to presumably the crossbar 5, and it makes a strange sound. After the next few digits, I abandon the call; 231 is vacant and I misdialed. Call 14: Crossbar 5 - 311 (it waits for me to finish before deciding I belong on the crybaby. It wasn't working when I made this) Call 15: Crossbar 5 - 232-9314 (intraoffice call to a ringing number. This was right before everyone left; normally, intra-office sounds as great as all the rest. Chronomex turns off all the switches after the second ring) museumcalls.flac
  2. Hmm, what tandem do you home on? I tried 303-959-1020 from the Denver DMS, and I just got the not in service recording.
  3. So I've been doing a lot of traveling recently, and found something a bit interesting. From most US West 5ESSes, if you're in, say, the 206 area code and you dial 206-959-anything, your switch will give you a vacant number recording. Just 959-xxxx normally sends you to CBCAD. This didn't really raise my eyebrows too much (I haven't found anything yet. I'm looking though, and encourage everybody else to) until i tried the same thing from a DMS-100 in Denver. From there, it spits you out onto a recording from the tandem switch (DNVRCOMA03T - the trailer code even says 03T). My guess is the rest probably just fire back a cause code saying the number is vacant, but it still gives a good idea of what might be lurking in that prefix.
  4. Wow. Well, that was a surprise. Augusta and Lafayette Main are both gone. Odessa, however, lives on. I had my bets on Augusta being the last. Why this is I have no idea, but get it while it's hot. It was supposed to be cut over a few months ago.
  5. 206-723-0045 - Modem 0046,0047 - DATU 206-721-0008 - rec, "The number you have called is temporarily out of service and has been referred to US West Communications repair. Thank you for your patience. Please try your call later." 206-727-0066 - rec, "We're sorry, due to Pacific Northwest Bell network difficulties, all circuits are busy now. Please try your call again later."
  6. This might be the last time I get to hear a US West TOPS switch hassling me for money, so I thought I might record it. I didn't have a pickup coil with me at the time - still don't actually, I should probably find my way to one. But anyway, sorry about the automatic gain control. Next time I do this, I'm going to use something a little cleaner. All I had at the time was my Dialogic box, though. In case you were wondering, this switch is indeed the sort of thing you can redbox, but it typically doesn't ask you for money retroactively. It's doing this (it actually never cut me off if you're wondering; I sat there for like twenty minutes. The tops_2.wav stuff is the last thing it said) because Qwest doesn't use TOPS for operator services anymore. It's not programmed to automatically cut you off and there's no person it can call to intervene, so, well, it just lets the call go on forever. And probably raised an alarm on the console. I've never heard it myself, but the TOPS manual says it can actually get pretty aggressive; it'll call you back to try and get you to pay if you let it. I was really disappointed when it didn't. If you listen to the way it says "past", you can hear this subtle looping sound on the end of the T syllable. This is a characteristic thing the Nortel EDRAM card does - the closest we'll get to proof here that the tandem is a DMS. Funny enough, we actually do have the original files the switch is playing back; it's some form of 32k ADPCM. It's all in some sort of strange container format that nobody could ever figure out, though. If you'd like to try your luck with it though, this is the archive with all the stock EDRAM stuff. eacts0ae.bin44 has all the ACTS stuff in it: http://www71.zippyshare.com/v/1XzPMAeZ/file.html . I'll post a manual for the card at some point. The .bin44 extension implies that it's binary as per usual, but the 44 after indicates the logical record length of the file is, well, 44 bytes. tops_1.wav tops_2.wav
  7. That's a fair example of where this sort of thing might make sense. For whatever it's worth, I made a program for my Dialogic box to three-way stuff in when I was living in the hotel. It's been a huge help for places where toll calls cost actual money, but as sort of a compromise like the one you describe, I made a command that makes it increment the destination by 100 numbers, hang up on the existing call, and three-way the next number in. Like for example, 432-332-0000, 0100, 0200, etcetera. It'll be a few days before I'm home. Lemme know if you want to use it for investigating the 1AESS. Also, fuck Texas/Georgia and their confusing test numbers .
  8. Yup, the newer cards are ATA flash. The older ones (release 8/-), linear. If you don't want to bother with finding something to plug it into, the Definity can xmodem it to you. Boot it with no translations, log in as inads, plug it in, and type upload (I think. It's relative to the direction of the Definity) translations. Anyway, as for where to start, I'd get the switch to print a copy of the license data - list config license, I think. Then, with the system booted, if you have inads access under normal circumstances, get a ramdump of pam and compare it to a dump of the same process with no translations card installed. If that's not possible, just the latter is probably fine; the translations card will probably give most of what we need. The challenge with that, if we want to try and load/edit licenses through the memory card (obviously a great start. I'd really like to know where it's supposed to load this stuff in, though), is that it uses some weird format with a bunch of checksums. Ostensibly the best way to deal with that is to use the bulletin board feature; you could just write a 1 or something to it, upload the translations somewhere, then change it to a 2 or 0 or whatever, and see what changed.
  9. Out of curiosity, do you know much about the voice synth chip? Maybe it's something simple. 608-819-5000 - IVR on Glenayre VMS, Paetec Madison Switch site 609-585-9998 - Modem, Galaxy controller 609-585-9979 - 2400 baud modem 315-701-9120 - ETC Digicept remote phrase recording IVR 315-701-9171 - AT&T-LD non-payment recording from...602-9L!? (5ESS in Arizona)
  10. 415-380-0007 - ANAC? 415-380-0076,0099 - 911 non-emergency recording. This is probably what they give the sort of people who call 911 on the neighbor's dog or whatever. You'll see echo tests that're broken like that pretty consistently. I've started to wonder if it's intentional or something. As for the 978 number, ISDN codecs work by transporting g.722 or AAC or whatever over the B channel where the mu-law PCM on most normal phone calls would be. Usually if a call from a non-ISDN line comes in (I think they tell this by whether or not the bearer cap indicates it's a data call; it can be data, speech, or 3.1 khz audio), they'll either tell the switch to reject the call, which usually gets you indefinite ringback from it, or even send you a mu-law feed of whatever is going into it. Some codecs though - like this one, tend to be not so great at telling the difference between the two.
  11. Since it's going to be up for a while, lemme know if anybody wants me to add anything to this. The DSP hardware makes what it can respond to pretty flexible; one of the early tests I did of the card was to make it listen for the bridge join tone and play a recording of Ramsaso going "Hello, who are you?" when someone joins. Unfortunately, the join tone is also a ringback tone, so things got a little interesting when someone three-wayed stuff in. In retrospect, you could probably get around that by specifying cadence.
  12. There is a good deal of wardialing software out there - generally, it just looks for modems. Some have options for voip trunking if you choose to use it. In my experience though, there really is no serious substitute at this time for just doing everything by hand.
  13. I did? In any case, I got to try this from a few different DMSes yesterday. From the one serving my house, it just gave a reorder. So that got me thinking the recording might just be a local thing. Sure enough, from another, someone crudely stuck another voice saying "We're sorry" onto the beginning of this. Finally, from one more, instead of any of these, one more switch gave a completely different message saying I'd dialed an invalid PIN. So, well, I'm still a little confused, but that at least clears up where the recording is coming from. Maybe there is/was some form of authentication from the local switch for GETS? Maybe. It's clearly not putting you on the toll trunk 710 calls usually go on. I was surprised the switch even allowed it.
  14. Oh, shit! Did that (at least as far as you know) correspond to a speed dial button on the phone or something? Sorry, I hope there wasn't too much red tape around that. It probably would've caught me by surprise too. I suppose now would be as good a time as any to say that some hotels have courtesy phones lying around.
  15. Dialogic box is back up. Probably until the eighteenth, but that's not exactly set in stone. I'll update this if it's later. EDIT: Actually, it'll be up at a minimum until the 25th. Whether or not that's the last day is another question, though. Another EDIT: Probably May 11th, actually.