💾 Archived View for gemini.spam.works › mirrors › textfiles › phreak › CELLULAR › wlphone.phk captured on 2022-06-12 at 17:30:26.
-=-=-=-=-=-=-
Wireless Phones, Part 1
by Mr. Icom
Updated: 4/17/87
Introduction:
=============
While there have been many files dealing with mobile phones, all that I've seen
have had inaccurate or incomplete information. This file will inform the
phreak about the various telephone systems currently in use: "Cordless"
Phones, IMTS, Marine, Cellular, and Satellite trunks; hopefully giving the
reader an insight on how they work, and perhaps how to control them. In Part
I, I will discuss "cordless" phones.
Cordless Phones
===============
Cordless phones need no explanation, as most phreaks have one or two. However,
there seems to be an unexplainable lack of accuracy as to the frequencies used
on them. Cordless phones use two frequencies simultanisly for full-duplex
communications. Currently, there are 3 frequency pair ranges used by cordless
phones. The first is a 1.7 Mhz./49 Mhz. split. These are used by the first
cordless phones. Where the base transponder transmits in the 1.7 Mhz. range,
and the handset transmits in the 49 Mhz. range. The 1.7 Mhz. carrier uses
the AC power lines in the house as an antenna(This is known as "Carrier
Current" transmission). Because of this fact, the range was limited, and the
connections generally sucked because of interference from the 60 Hz. power
line frequency. While no more of these units are being made. They still can
be had at tag sales/flea markets, and rip-off department stores like Caldors,
Ames, and Jamesway. The frequencies (in Mhz.)are outlined below:
Base Handset
===== =======
1.705 49.830
1.735 49.845
1.765 49.860
1.795 49.875
1.825 49.890
It is also interesting to note that the above 1.7 Mhz. frequencies are also
used by those "Wireless Intercoms" sold by Radio Shack.
The second pair of frequencies is 46 Mhz./49 Mhz. All cordless phones today
use these frequencies. The elimination of the bothersome 1.7 Mhz. side clears
up interference, and also allows for a longer range. Another thing which the
FCC did when allocation the 46/49 splits was include more channels to lessen
interference from other phones. The frequencies are:
Base Handset
====== =======
46.610 49.670
46.630 49.845
46.670 49.860
46.710 49.770
46.730 49.875
46.770 49.830
46.830 49.890
46.870 49.930
46.930 49.990
46.970 49.970
It is interesting to note that the the 46 and 49 Mhz. range is also allocated
for U.S. Government use, specificaly the military. This discrepency stems
from two reasons. First, the FCC doesn't handle governmental allocations, an
organization called IRAC(Intergovernmental Radio Advisory Commitie) does them.
Second, the FCC feels that the range of cordless phones is so limited that it
won't cause interference.
The third pair of frequencies used is 49 Mhz./70 Mhz. These were used by
cordless phones designed for export to foregin countries. While they are
illegal, that doen't stop people from using them.
"Crusing for dial tones"
========================
Back in the early days of cordless phones, the lack of security features on
them made it easy for someone to take his handset, and drive/walk around the
neighborhood, finding out how many dial-tones he could bring up. Nowadays, the
addition of various things in order to prevent this make it very difficult.
There are three major security features used in cordless phones. The first one
disconnects the base transponder from the airwaves if the phone is put in its
charger slot. While there is no way to circumvent this, keeping the phone in
its charger slot appears to many people as a limitation of its mobility. Thus,
many prople keep them lying around OUT of the charger slot, right by their
side, so they don't have to run for the phone when it rings. Thus, their
desire for convienence destroys the security. The second feature is a digital
code which the handset sends to the transponder when it is brought off hook.
The transponder checks the code, and if it matches, a dial tone is presented.
This code is either preset at the factory, or user set by manipulating a couple
of DIP switches. While the changing of the code on preset units would reqiure
you to go inside the machine, and clip/add a few diodes. With the user set
ones, all one would have to do is try every code till you get a dial-tone.
Most sets have 4-8 switches for the security code. This comes out from 8 to
255 different combinations. The security code is transmitted via a digital
tone, similiar to that used by IMTS signaling.(More on that in a future
volume.) To hear what I'm talking about, get your handset and a scanner. Tune
your scanner to your handset frequency, and bring your handset off hook. As
you bring it off hook, you should hear a bleeping tone. That is the security
code being transmitted. Now, if you had a slightly modified 6 meter ham
transmitter, and lived fairly close to your neighbor with a cordless phone.
You could possibly record his security code, and play it back through your
transmitter, thus sucessfully impersonating his handset. While I don't know of
any compatibilities between cordless phone security codes at this point, if I
hear of any, they will be posted in a revision of this article.
The third security feature was designed, and marketed just recently, this
security feature is complete digitizing of the phones audio using Pulse Code
Modulation, very similiar to what's used on digital trunks.
Increasing Your Range
=====================
Once cordless phones came out, someone got the bright idea of extending its
range. Most people think that some kind of amplifer can be built which would
give you more power, and extended range. It isn't that simple. Since a
cordless phone is a full-duplex radio link, an isolator is needed to keep the
two transmitters seperate. Unless you had a degree in Radio Enginerring, your
attempts at making this would most likely ruin the unit, and any sucessful
attempts would make your cordless phone about 10 times its current size.
However, there is another way to extend your range, and that is by assing an
external antenna on your roof. This will only work with 46/49 Mhz. units, as
this antenna will only bost the 49 Mhz. side on 1.7/49 Mhz. units. On those
phones, the 49 Mhz. side is usually ok, and you'll still have to put up with
the interference on 1.7 Mhz. In any event, you'll need 5 lengths of stiff
wire(coathangers) 47 inches long, an SO-239 coaxial cable connector, and enough
good quality(RG-8) coaxial cable to get from your phone to your roof. The
cable should have a PL-259 connector on one end, and alligator clips on the
other. Take the wire, and attach it to the SO-239 as shown:
|
Wire attached->|
to center hole |
|
^
Wire attached/===\
to outer / * \
holes----> / $ \
(ground) / | \
|
|
Coaxial |
Cable --> |
|
Down to
Base
Unit
^
=== SO-239 Connector
*
$ PL-259 Connector
At the base Unit, attach the center conducter to the whip antenna, and attach
the other connector to the chassis(ground). For those lacking in antenna
building skills, there are also commercially availible units availible for
about $50.
IMTS
====
IMTS, or Improved Mobile Telephone Service is an automated telephone system which used to be the standard of mobile phones until cellular came along. IMTS uses the following frequencies (in Mhz.):
Channel Base Freq. Mobile Freq.
------- ---------- ------------
ZO 35.26 43.26
ZF 35.30 43.30
ZH 35.34 43.34
ZM 35.38 43.38
ZA 35.42 43.32
ZY 35.46 43.46
ZR 35.50 43.50
ZB 35.54 43.54
ZW 35.62 43.62
ZL 35.66 43.66
1 152.03 158.49
3 152.06 158.52
5 152.09 158.55
7 152.12 158.58
9 152.15 158.61
11 152.18 158.64
13 152.21 158.67
JL 152.51 157.77
YL 152.54 157.80
JP 152.57 157.83
YP 152.60 157.86
YJ 152.63 157.89
YK 152.66 157.92
JS 152.69 157.95
YS 152.72 157.98
YR 152.75 158.01
JK 152.78 158.04
JR 152.81 158.07
There are also frequencies allocated in the UHF Range. The base
frequencies are posted below. The mobiles operate 5 Mhz. above the base
frequency. Thus, the mobile frequency for channel 21 is 458.025.
21 454.025
22 454.05
23 454.075
24 454.10
25 454.125
26 454.15
27 454.175
28 454.20
29 454.225
30 454.25
31 454.275
32 454.30
33 454.325
34 454.35
QC 454.375
QJ 454.40
QD 454.425
QA 454.45
QE 454.475
QP 454.50
QK 454.525
QB 454.55
QO 454.575
QR 454.60
QY 454.625
QF 454.675
Of all these frequencies, the VHF-high band ones are the most popular. If
you live within 25-50 miles of anything resembling a a moderatly sized town,
you will have at least 1 VHF-high band channel availible. VHF-low band
channels are used primarilly in rural areas, and those with mountainous
terrain. UHF channels are being used in cities where the VHF channels are
getting crowded. If you live in a major city, expect to have most, if not all
these channels availible to you.
IMTS Signaling:
IMTS signaling is accomplised by in-band signaling tones from 1,300 hz. to
2,200 hz. Two Single frequency tones are alternated, much like ASCII modem
tones, to produce the digits for the ID number, and destination number. The
tones are as follows.
Base tones:
Idle - 2,000 hz. - used to indicate an availible channel.
Sieze - 1,800 hz. - sent as an acknowledgement by the base that a channel has
been taken.
Mobile Tones:
Guard - 2,150 hz. - used when the mobile goes off-hook to sieze a channel, as
the "space" tone when sending the ID and destination number, and to acknowledge
an incomming call.
Connect - 1,633 hz. - used to "pick-up" and incomming call, and as the "mark"
tone in sending the ID and destination number.
Disconnect - 1,336 hz. - used to disconnect.
To originate a call, the mobile sends 350 ms(milliseconds) of guard tone
followed by 50 ms of connect tone. The base then sends stops sending the idle
tone, stays quiet for 250ms, and sends 250ms of sieze tone. The mobile sends
190ms of guard tone, and sends the ID number at 20 pulses per second. The ID
number consists of the subscribers A/C and phone number. The pulses consist of
25 ms of connect tone, follwed by either 25ms of silence or guard tone,
depending if the digit is odd or even. The interdigit interval is either 190ms
of silence or guard tone, depending on weither or not the last digit was odd or
even. Once the ID is sent, dialing is accomplished by sending alternating
connect and guard tones at 10 pulses per second. A pulse is 60ms of connect
tone, followed by 40ms of guard tone. To disconnect, send 750ms of disconnect
tone.
Getting an IMTS phone:
There are many ways to get an IMTS phone. They can be bought from electronic
surplus dealers, however these may need some work, and you'll have to figure
out how to reprogram the thing. I've also seen the ID circutry torn out of
them when sold as surplus in order to keep people from doing what you're about
to do. Your best bet is to go to a hamfest/electronic fleamarket, and pick up
a business band mobile radio. These are surplus units capabile of transmitting
in the 150-174 Mhz. range. While these units are often modified by hams for
the 2 meter(144-148 Mhz.), or 3/4 meter (440-450 Mhz.) band. They can be
modified back for the business band. All that most of these units require to
be brought into the IMTS band is the proper crystal, and the retuning of a
capaciter or two. This, along with a cheap VHF-high band reciever makes a full
duplex radio setup. (Be sure to use headphones with the reciever to avoid
feedback!) Now you need to duplicate the tones. There are two ways to do this.
The easiest, and most versatle is to use a computer, and generate the tones,
but since few computers with tone generating capabilities are portable, an
alternate method must be found. By wiring up an ordinary phone dial to a dual
tone audio oscillator, one can duplicate a mobile phone dialer. Plans for this
unit can be found in 2600 magazine.(See end of file.) With your "IMTS Box.",
you can either tape an ID number off the air, or generate one with your
computer. To use your homebrew IMTS phone, find a channel that has an idle
tone on it, send your connect and ID tone sequence, dial your number, and
you're connected.
Marine Band
===========
The marine telephone band is for ships at sea to communicate with landbased
telephones. A marine band telephone call is put through by finding an unused
frequency, calling the marine operator, and giving her your callsign and phone
number to call. The frequencies are as follows (in Mhz.).
Channel Ship Freq. Shore Freq.
------- ---------- -----------
24 157.20 161.8
84 157.225 161.825
25 157.25 161.85
85 157.275 161.875
26 157.30 161.90
86 157.325 161.925
27 157.35 161.95
87 157.375 161.975
28 157.40 162.00
Marine Band Radiotelephones:
While you could take your business band radio, and put in marine band crystals,
Marine Radiotelephones are easily availible, and somewhat inexpensive
($100-$300 for a decent radio with VFO, memories and 25 watts). Some places
may ask you for a marine license, which is no problem. Just write to the FCC,
and they will send you an application, there are no requirements. Before using
your radio, listen on the telephone channels for a contact by another ship, and
copy down the callsign used. Wait a while, and then feel free to use the
callsign to place a call. DO NOT USE YOUR OWN CALLSIGN IF YOU GOT ONE! If you
do, expect to pay for a buck a minute minimmum call. Marine telephone is one
of the easiest ways for "wireless" communications, however, it still presents
the same dangers as IMTS phreaking.
Ham Radio Autopatch and the Simpatch
====================================
Autopatch is a function put on many ham repeaters allowing the use of a
phone-line over the air. While one could phreak using an Autopatch, I advise
you not to, as there is usually a control operator monitoring the machine.
(Some do it 24 hours a day.), and any attempts at hacking an access code will
probally be noted. Being a Ham, I'm not going into the subject of Autopatch
any further than this, as there are better ways to phreak, and Ham's are
helpful people(Some are even phreaks!) whom you can get assistance on technical
matters. In short, don't fuck with Autopatches! However, along the lines of
an autopatch is something called a Simpatch, which is a simpler version of an
autopatch designed for use with a ham transciver. This device makes a
wonderful extended-range cordless phone when hooked up into a can. It's major
drawback is that it's expensive, but anyone with a little electronics backround
can probally build one. A simpatch can also be used with CB's, or just about
any other radio. A good idea for an extended range cordless phone would be a
simpatch, and two CB walkie talkies. One CB would be connected to the Simpatch
connected to the can and accessed via the second walkie talkie. The entire
setup could be hidden in a tree and using a wire antenna (dipole of 1/4 wave
vertical) for a range of 5-20 miles.
Conclusion
==========
Acknowledgements:
1) Mobile Phones-Theory and Construction. by The Reasearcher. 2600, April 1986
Availible from: 2600 Magazine
P.O. Box 752
Middle Island, NY 11953
Write for latest rates on subscriptions and back issues.
2) Understanding Telephone Electronics. Availible at Radio Shack
3) American Radio Relay League
225 Main St.
Newington, CT 06111
(has free information on ham radio)
Thanks go to The Datamaster, Peter Pulse, Bellcon, and The Surge for their
assistance.
-Mr. Icom
March 29, 1987, Updated April 17, 1987
End of File.