💾 Archived View for gemini.spam.works › mirrors › textfiles › phreak › BLUEBOXING › blue3.box captured on 2022-06-12 at 17:10:18.
-=-=-=-=-=-=-
BLUE BOXING
[===========]
This is the tone matrix for a box which generates tones that operators use to
dial..rotary works as well, on operator lines, but this is technological(!). no
w i agree with the opinion of a well known phreak that 'boxing' is/will be for t
he most part de
ad, but this is tradition... first,you dial dir.asst, or an oper. etc , then you
blast the line with a 2600 hz tone. this gives you the line, this is also how m
a bell tracks down blue boxers... there are 2600hz detectors systems, and even
on old #4 cross
bars... once on a oper.trunk line, you use your blue box/rotary tdo dial...
so, if you use 2600hz, which is necessary, unless you are *very* careful, you w
ill be snagged. finally, this is what you read! so long and hard for:
700 : 1 : 2 : 4 : 7 : 11 : 900 : + : 3
: 5 : 8 : 12 : 1100 : + : + : 6 : 9 : KP
: 1300 : + : + : + : 10 : KP2 : 1500 : +
: + : + : + : ST : : 900 : 1100 : 1300 : 1500 : 1700
use kp to start a call, and st to stop, with the beloved 2600hz tone to disconne
ct. i also hear that 2600hz resets sprint nodes and gives you their initial tone
..
now, if you're wondering about what to call from an operator trunk, here are som
e goodies to help you out:
XXX+101 - TOLL SWITCHING
XXX+121 - LOCAL OPERATOR
XXX+131 - INFORMATION
XXX+141 - RATE ROUTE
XXX+181 - COIN REFUND OPERATOR
XXX+11501 - MOBILE OPERATOR
XXX+11521 - MOBILE OPERATOR
XXX+11511 - CONFERENCE OPERATOR
---CONCERNING ABOVE
First the tones. while all the information is correct, the timing specs w
ere not included . the tone pairs are to remain on for 1/10 sec. with 1/10 sec.
of silence between digits. the 'kp' tones should be sent for 2/10 sec. a way
to defeat the
2600 hz traps is to send a long with the 2600hz some pink noise(most of the en
ergy in this signal should be above 3000hz, this signal won't make it over the
toll network, but should carry as far as your local toll center) so that the tr
aps won't find
'pure' 2600 hz on the trunk. this is not a perfectly safe way to box, but it sho
uld slow down the discovery.
as to use, the first thing you need to understand is that there are two(2)
types of toll completing trunk, inward and outward. the names are reference to t
he office that is switching the call(the toll center that serves the watsline yo
u called) and e
ach type of trunk has a different class of service. from an inward toll completi
ng trunk, you can reach the different service operators, the toll test board, an
d the inward operator. some offices also allow remote testing and it is in these
offices that y
ou can access the outward toll completing trunks. the out wardtrunks allow you
to make verification(emergency) calls, do service monitoring(tapping), stack tru
nks(busy out all trunks between la and nyc), enable and disable tsps positions,
and in some cas
es(on some 4a's) issue temporary rerouting instructions(send all calls from la t
o nyc via miami, boston, or any other class 5 office or offices). both type of t
runk allow you to place a 'standard' call with a box.
in some offices, mostly the small ones with a toll test board that is unatt
ended at night and on weekends, you cange to an outward toll completing trunk as
well as performing other test and routing functions. you do this by using three
digit codes th
at are invalid exchanges (not of the pattern nnx[see note 1]). during the sixite
s the codes used were fairly standard and consistent, however when the boxes bec
ame popular and the phreaks started doing things like routing all calls from dal
las to ft. wort
h via washington d.c. others started changing the test codes on a random (as far
as i know) basis. what i would suggest is that everybody interested in doing th
is sort of thing pick out a nice quiet little office somewhere and work on disco
vering the code
s acceptable to that office.
each numbering plan area (npa, also known as area code)has an office design
ated as its master office. this office controls all of the other toll offices in
the area as well asserving as a concentration point for most out of area calls.
to access the s
ervices of a non-masteroffice you need it's'city code', this is a three(3) digit
code that is of the form 0xx, and is sent after the area code [see note 2 ]. as
an example, the 'city code' for canton, ohio is 042; thus to reach the inward o
perator in cant
on, you would send 'kp-216-042-121-st' where as if you wanted the inward operato
r in cleveland, you would send 'kp-216-121- st'. the reason this is necessary is
that the operator in cleveland can't verify a number in canton, so if you want
to verify someo
ne in canton you need the city code. also, most area master offices have dedicat
ed data trunks to the network control center and thus don't accept test and rero
uting commands over the switched net-work.
in conclusion, the switching network will do a lot more for you then connec
t you to people and the small offices that require a 'city code' are the type of
office to try to break.
note 1: the normal format for telephone numbers is as follows: nyn/nnx-xxxx
. where n=any digit except 1 and 0;y=0 or 1, and x=any digit. yes i know that in
some area codes the nnx format has changed to nxx. this is a new occurrence and
only occur whe
re there has be an outrageous population increase in the last few years and all
of the funny exchanges are connected directly to master offices and thus don't c
onflict with the 'city code' format.
note 2: you can obtain the 'city code' for a number by calling rate and rou
te and asking for the 'numbers route' to nyn/nnx(i.e. 914/725). or if you leave
me a message with the area code and first three of a number, i will get you the'
city code'.
blue box plans
---- --- -----
$ BLUE BOX PLANS! $
$ This file will explain the $
$ construction, troubleshooting, and $
$ adjustment of a Blue Box. $
$ $
$ We all know that the touch tone $
$ frequencies are composed of 2 tones $
$ (2 different freqs.) so that is the $
$ reason why we have 2 VCO's (Voltage $
$ Controlled Oscilators). We'll call $
$ them VCO#1 and VCO#2. If you have $
$ noticed VCO#1 and VCO#2 are exactly $
$ the same type of circuits. That is $
$ why only 1 was drawn. But remember $
$ that whatever goes for VCO#1 also $
$ goes for VCO#2. Both VCO'S are $
$ composed of a handfull of part. One $
$ chip, two capacitors, 2 resistors $
$ and five potentiometers. All of $
$ this will give you (when properly $
$ calibrated) one of the freqencies $
$ necessary (the other one will come $
$ from VCO#2) for the operation of $
$ the Blue Box. Both of these freqs. $
$ will be mixed in the speaker to $
$ form the required tone. $
$ $
$$$$$$$$$$$$$$$$$$$$
$ $
$ This is one of the most $
$ sophisticated designs I have ever $
$ made. Why?. Because other designs $
$ will drain the battery after 10 $
$ calls. This design will make them $
$ last 10 months!!!!!!. But never the $
$ less, don't forget to put in a $
$ switch for on and off. Ok let's $
$ build the two VCO'S and calibrate $
$ the unit before we get to the $
$ keyboard construction. $
$ $
$$$$$$$$$$$$$$$$$$$$
! !
! VCO CONSTRUCTION !
! === ============ !
! !
! TOOLS REQUIRED !
! ----- -------- !
! !
! 1 ocilliscope(optional but not req) !
! 1 Freq. counter (REQUIRED) !
! 1 Volt meter " " " !
! Electronics tools (Pliers,drll, !
! screwdrivers, etc.) !
! !
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
.......................................
. .
. ! $-PARTS-$ ! .
. ------------- .
. .
. R1 1.5K RESISTOR 5% .
. R2 1K RESISTOR 5% .
. C1 .1uf ELECTROLYTIC CAPACITOR 16VDC.
. C2 .01uf " " (MYLQR)16VDC.
.IC1 2207 VCO CHIP BY EXAR ELECTRONICS.
. Remember the above only says .
. VCO#1 but the same is for VCO#2 .
. R3-R4 150 OHM RESISTORS 5% .
. C3-C4 .1 uf ELECTROLITIC CAPACITOR .
. 10VDC .
. P1-P10 200K TRIMMER POT - 20 TURNS .
. DIODES USED IN THE KEYBOARD .
. ARE 1N914 TYPE (40 OF THEM) .
. 13 SWITCHES FOR THE KEYBOARD .
. SPST MOMENTARY. .
. SPKR=YOU CAN USE A TELEPHONE SPEAKER.
. FOR THIS (IT WORKS BEST) BUT .
. REMEMBER TO TAKE OUT THE DIODE .
. THAT IS CONNECTED ACCROSS IT. .