df99

Members
  • Content count

    210
  • Joined

  • Last visited

  • Days Won

    18

df99 last won the day on May 25

df99 had the most liked content!

Community Reputation

19 Neutral

1 Follower

About df99

  • Rank
    Mack Daddy 31337

Recent Profile Visitors

4,411 profile views
  1. I completed the build of the Demon Dialer, packaging it up in a case with built-in telephone earpiece "speaker", volume control, and jack for an external earpiece/speaker or line interface. Don
  2. Built up Demon Dialer board, ready for enclosure. I reworked and simplified the low-pass filter and audio amplifier circuit a bit, plus added a volume control. Audio is excellent! The reason for the oddball 4.194304 crystal value (easily available on Ebay) is that value in Hz is 2 ^ 22 (2 raised to the 22nd power). Being a power of two, the frequency can be digitally divided down to any frequency in perfect 1 Hz increments for perfect tones (within the crystal accuracy). Smart! Headers are for keypad, shift key, and optional RS232 control interface (omitted on this build). You need to to tie the Rx pin to +5 volts if omitting the interface or noise will appear as commands and make the circuit go crazy with weird tones and behavior. Don
  3. DAC/ filter/amplifier prototype.
  4. I uploaded a short video of the Demon Dialer prototype breadboard, FYI: Don
  5. Here are a few shots of the original Demon Dialer board and manual, as sold by Hack-Tic back around 1991. Don
  6. I built up the Demon Dialer prototype this afternoon. I'm pleased to say, it works perfectly with the newly-programmed chips: I've been waiting to reconstruct one of these babies for decades! Great fun. I thought I would just post the source code, cross-assembler output listing and Motorola S-Record (S19) programming file here. Also posting a manual and schematic, If assembled as-is the "secret" embedded password is "1234". demon131.src demon131.lst DEMON131.S19 demon_dialer.pdf I have resources for the cross-assembler and programmer software, if anyone is interested. Regards, Don
  7. I'll put the manual, schematic and source code, including the assembled programming "S19" S-record file up on projectmf.org. I'd be happy to program a chip for anyone that can locate one. Keep in mind that the code requires a 68HC705C8 variant of the 68HC705. The boards I saw on Ebay are for different chips and will not work. Also, parts without the UV erase window are OTP (one time programmable) parts and cannot be erased. If you buy a non-windowed chip from a China supplier or other source of salvaged chips, it almost certainly has been programmed and is useless for this application. If a windowed part has previously been programmed, it is easily erased by shining a short wave UV light through the window for 20-30 minutes. The chip can then be programmed with the Demon Dialer code. See the above pics for images of what the windowed part looks like, as well as the Motorola programmer board that allows programming. Building up a breadboarded unit this afternoon. Regards, Don
  8. I'm resurrecting this ancient thread, as I'm pleased to announce that I have obtained the Demon Dialer source code. I made contact with two former programmers with the old Dutch hackers group Hack-Tic, one who is the original programmer of the Demon Dialer "Rainbow Box". He sent me the source code. I ran the source code through the ancient Motorola MSDOS “asm5” cross-assembler. I needed to create a VM running Win95, as Win10 64-bit will no longer run 16-bit MSDOS programs. It promptly assembled without error, generating a listing and Moto S-record file. I UV-erased a couple of old microcontrollers, which programmed nicely with the old Motorola purpose-built programmer board. I now have a few Demon Dialer chips on the bench. I ordered up a bag of crystals with the unusual frequency needed. I may substitute a 4 MHz crystal temporarily for testing. Contact me for additional details. At one time there was quite a bit of interest in this. Anyone who has a good copy of the v1.4 Demon Dialer manual and schematic; a scan would be appreciated. I have an older schematic, adequate to build the circuit, but a better copy would ease the process. Regards, Don
  9. I finally got a copy of the audio files (EDRM0001.SLM Part 1 and EDRM0001.SLM Part 2 from a friend on the NPSTN board. I think they were probably from Thoughtphreaker. My friend was interested in recovering authentic ACTS audio from the TOPS system. There were a few documents with the zipped files that indicated that the files were for loading audio data to the non-volatile memory of an NT1X75 recording announcement board for a Nortel DMS 100 switch. After perusing the documents, I extracted a single file from the zipped archives, eacts0ae.bin44. This is a binary file designed to contain multiple sounds and information to load into the proper non-volatile address space on the NT1X75 board. The file contains multiple audio phrases. The file is organized into 44 byte records (or "lines", if the file was ASCII text). There is what appears to be a 6 byte header at the start of each line. The first two bytes are always hex 47 and hex 32. That is followed by the number of valid data bytes in the record (36 bytes for a full record). That is followed by a hex 00, followed by two additional hex bytes that probably specify the 16-bit board memory address into which to store the record. There is also a 2-byte trailer at the end of each record. I believe the second to last byte is a checksum and the last byte is always hex 16. The boundaries between each audio phrase can be discovered by looking for a record with a length less than 36 bytes. That is usually the end of the audio phrase. The next record starts a new phrase. Records with less than 36 bytes of data are padded with zeroes to make up 36 bytes in the data portion. To recover the audio, I simply chopped the first 6 bytes and last two bytes off of each record and saved the file as a binary, using a hex editor with a column selection editing mode. This leaves other extraneous data present that plays as noise, but that data now is before/after each phrase, not interleaved with the phrase data samples. I used a hex editor with a column select mode to do this, omitting the first 6 bytes and last 2 bytes of the selection, then copying and pasting to a new hex file and saving as a new binary file. I then ran the raw data through various telephony codecs using Audacity and a program called GoldWave, designed for converting and manipulating various telephony audio storage formats. I found a manual for the audio DMS100 card that states the files are ADPCM, 4 bit. I found some settings that decode correctly. The problem is clipping of the audio samples. Many Oki and Dialogic ADPCM decoders allude to the fact that the decoders produce clipped audio. I’ve tried four different decoders, including SOX, and the output is all clipped. Not sure of the fix for that. Running the audio output through a low-pass filter helps the legibility some. The problem is that peaks of the recovered audio are missing, causing severe distortion. Intelligible results were also obtained playing the audio back as straight uncompressed 8-bit A-law PCM at a sample rate of 8KHz. However, the audio also clips severely when importing into that raw format in Audacity. Still working on it. It could also be some custom ADPCM CODEC. Attached is an mp3 with the entire file played back as A-lew, 8-bit PCM at 8 KHz in Audacity. I'm also including the converted binary file with the extraneous record data removed, as well as the original .bin44 file. Import as raw a-law at 8 KHz in Audacity. Similar results on output audio were obtained decoding as ADPCM in Oki format at 8 KHz sampling using SOX and the VOX/DEVOX program, compiled from source code. I could probably separate out each phrase from the surrounding junk without much difficulty. Regards, Don F. eacts0ae.bin44test4.bin eacts0ae_4.mp3 eacts0ae.bin44 TOPS_DMS100_ACTS_ROM.pdf
  10. ThoughtPhreaker, is there any chance I could get those TOPS ACTS and other audio files? I'd like a shot at recovering the audio. The link here is liong dead. Thanks, Don
  11. Back in 2007, I designed a blue box for use with my ProjectMF server, a telephone PBX switch that allows phone phreaking in a manner similar to the old days of in-band signalling - MF and SF audio tones. That blue box was based upon the PIC 12F683 8-pin DIP microcontroller. Phil Lapsley ("Exploding the Phone") designed a PCB board for it and many aspiring phreaks have built the circuit over the years. One issue with the original code was that it was written in PicBASIC Pro. PicBASIC had a "tone" command that could produce two simultaneous tones if a 20MHz oscillator was used. However, the tone generation never sounded quite right. David Griffith, a vintage telephony and computer buff, decided to re-write my code in C. He followed the same general design principles as I used in my 2007 box, but added some very impressive features and - most importantly - the tones sound great! The code now runs on a modern 8-bin ATTINY85 microcontroller. Dave has also designed circuit boards for the chip and circuit. However, I found the circuit is straightforward enough to build on protoboard, which allowed me to produce this replica of the blue box featured on the first page of the famous October, 1971 Esquire magazine article which popularized phone phreaking. Dave's code may be found at: https://gitlab.com/DavidGriffith/blue... Manual, schematic and and precompiled .hex files at: https://661.org/proj/bluebox/ df99
  12. Back in 2007, I designed a blue box for use with my ProjectMF server, a telephone PBX switch that allows phone phreaking in a manner similar to the old days of in-band signalling - MF and SF audio tones. That blue box was based upon the PIC 12F683 8-pin DIP microcontroller. Phil Lapsley ("Exploding the Phone") designed a PCB board for it and many aspiring phreaks have built the circuit over the years. One issue with the original code was that it was written in PicBASIC Pro. PicBASIC had a "tone" command that could produce two simultaneous tones if a 20MHz oscillator was used. However, the tone generation never sounded quite right. David Griffith, a vintage telephony and computer buff, decided to re-write my code in C. He followed the same general design principles as I used in my 2007 box, but added some very impressive features and - most importantly - the tones sound great! The code now runs on a modern 8-bin ATTINY85 microcontroller. Dave has also designed circuit boards for the chip and circuit. However, I found the circuit is straightforward enough to build on protoboard, which allowed me to produce this replica of the blue box featured on the first page of the famous October, 1971 Esquire magazine article which popularized phone phreaking. Dave's code may be found at: https://gitlab.com/DavidGriffith/blue... Manual, schematic and and precompiled .hex files at: https://661.org/proj/bluebox/ df99
  13. FYI, I never offered a kit, just my Arduino software (runs on Leonardo-style Arduino's only - Micro and Pro Micro preferred) and the drop-dead simple plans. I built one in about 45 minutes yesterday for a demo on the system I'm doing next week. You should try building one - Works great, and you can leave off the LCD for an even easier build. Best, df99