�002����������������������������������������������������������������������002� � The Phone Losers Of America � � Presents � � A Zillion Different Ways To Make Your Very Own Red Box - RedBoxChiliPepper � ����������������������������������������������������������������������������͵ � Written In November Of 1992 Last Revision on December 27, 1994 � ����������������������������������������������������������������������������͵ � For Informational Purposes Only. We're Not Responsible For Your Stupidity. � �002����������������������������������������������������������������������002� In this file I've included every way that I know of to create a red box and instructions on how to use them. A lot of people out there will try to tell you that red boxing is old and doesn't work any more but believe me, it works just as good as it ever did on almost all the Bell & GTE phones. I've gone through a lot of states with various types of red boxes and they work fine. The most popular method is the Radio Shack tone dialer. Cactus? Converting A Tone Dialer Into A Red Box: --------------------------------------- I believe all the credit for this section of the phile should go to Noah Clayton who originally wrote this for 2600 magazine. You will need: o Radio Shack pocket tone dialer model #43-141 ($24.95 each) o Three AAA batteries o Soldering Iron o Small regular and phillips screwdriver o Wire clippers o A 6.5536 MHz crystal Be sure to get Radio Shack's NEWEST type of tone dialer. The old ones were gold and brown and looked pretty ugly. The new ones are black and the corners are rounded off a little more. They also seem to be more water-resistant and it seems to be easier to fit the new crystal into these models. You can either order the crystal through Radio Shack or buy it from an electronic's store. Buying it through Radio Shack is a real bitch because you have to wait two weeks for them to order it and most employees don't know what you're talking about when you ask for it. I've had them INSIST that they can't order that crystal for me because they don't carry it. If you live in the St. Louis area as I do, I suggest GateWay Electronics on Page Av in Missouri. They have a knowledgable staff and their crystals are only about three bucks a piece. (Compared to Radio Shack's $4.99 each!) Place the dialer on the table keypad side down and speaker side up. Remove the battery cover and all batteries. Use the phillips screwdriver to remove all four screws on the back of the dialer. Now slide the flathead screw- driver along the side to separate the two halves of the dialer. Slide the speaker half underneath the keypad so you don't break off the wires. On the left hand side down near the battery compartment, you'll see a silver cylinder looking component. This is the crystal you want to remove. Pull it up with your fingers and break away all the glue that's holding it down. Use your soldering iron and un-solder it from the circuit board. You can throw this crystal away as it has no real use in life. Now the hard part. The new crystal you're putting in is twice as big as the old one so it's kinda hard to get it in there. There's a few capacitors that you can bend over to make some more room. You'll also have to bend the leads to your new crystal inward a little. Solder the new crystal in place of the old one and you're all set. Snap the two casing halves back together being careful not to pinch any wires. Put the screws back in and insert your three AAA batteries. A good idea is to wrap the crystal with scotch tape or electrical tape. This will prevent contact with other components since the crystal is so big. You could also simply put a piece of paper under the crystal. One additional thing you can do it totally remove the LED light. The only thing this light is good for is running down your batteries really quick. If you use the unit without the light connected, you NEVER have to turn the unit's power off and the batteries will last for a few years before you need to replace them. Programming Your Red Box: ------------------------ First you'll have to program your box's memory to make the right tones. You'll be using the three priority buttons on the top of your unit. P1 will be your quarter, P2 your dime and P3 will be the nickel. So here's how to do it: (1) Switch the unit on. The red light in the corner should come on unless you've disconnected it. (2) Slide the DIAL/STORE switch to the STORE mode. (3) Press MEMORY, *, *, *, *, *, MEMORY, P1. That programs your quarter. (4) Press MEMORY, *, *, MEMORY, P2. That programs your dime. (5) Press MEMORY, *, MEMORY, P3. And that's the nickel. (6) Slide the DIAL/STORE switch back into the DIAL mode and you're ready to start phreakin'! Try pushing the priority buttons now. Each one will emit a different high- pitched chirping noise. This is what the phone hears when you deposit money into a pay phone. If you've ever red boxed with a taperecorder or heard the actual pay phone tones before, you'll notice that these tones are slightly slower than the real ones. Don't worry, the pay phone can't ever tell the difference and you rarely find an operator that can. Troubleshooting: --------------- One of the most common problems I've had with my red boxes over the years, is that the tones will stop working in the middle of trying to put in your money or they'll break up, giving you a live operator. This could be because you did a bad job soldering the new crystal in. More commonly, the contacts on the power (or the DIAL/STORE switch) have bent the wrong way, causing them not to touch the circuit board anymore. To fix that, open the unit and bend the contact in the switches out a little. Not too much or they'll break when you use the switch. If you've removed the light in your unit, there's really no reason to ever turn it off so you could glue the power switch into the "ON" position. Try Our New Combo Platter!: -------------------------- If you're the type of person who just HAS to have a tone dialer AND a red box (like me) then you can have both without having to carry around two seperate units. 1. Buy a small two-position switch like Radio Shack's model #275-407. 2. On one end solder the old crystal, on the other end solder your 6.5536 crystal and in the middle solder two small wires, each about 4" long. 3. Solder the other ends of the two wires to where the old crystal used to be. Pretty easy, aye? You can put the two wires through one of the vent holes in the back of the unit. On my red box, I took the plastic piece off the back of the battery cover (You know, where you're supposed to write the memory numbers?) and electrical taped the switch down. It actually doesn't stick out hardly at all and looks fairly professional. Now you can switch between red box and tone dialer. You can store your stolen calling card numbers in the other memory locations or use the touch tones to get free calls on those damn privately owned pay phones. You know, a disturbing bit of information I heard from Zak recently is that Radio Shack won't be selling these tone dialers anymore. I don't know if this is true or not but I plan on stocking up on tone dialers here in the near future. The reason, supposedly is that the only people that buy these things are phreaks. The Low-Income Red Box (A Walkman): ---------------------------------- If you can't afford a real red box or you don't have any soldering experience, you can use a tape recorder as a red box. There are several ways to record the tones. One way is to go to a pay phone and call your answering machine or voice mail. After the beep on your machine, deposit about three dollars in quarters and hang up. Your three bucks should come back. Go home and on your answering machine will be a tape with the red box tones. Another way is to find two pay phones that are next to each other. You'll need a portable tape recorder and a suction cup telephone pick-up. (The phone pick- ups can be purchased at Radio Shack for about $3.00.) Pick up the first pay phone (Phone A) and call the other one (Phone B). Put the suction recorder on Phone A and deposit about three dollars in Phone B. Hang up both phones and hopefully your money will come back. A third way is to record the tones directly from someone else who owns a red box. Pretty easy to figure out. To play the tones back into the phone when you need them, use either a portable tape recorder or a walkman with some headphones. Hold the speaker from the recorder (or the headphones) to the mouthpiece of the phone and press "play" when asked for money. Make sure not to have the volume up too loud or the distortion will make a real operator come on the line. You can also use a big bulky tape recorder or a boom box but you'll look a little silly when you try to play your tones into the pay phone. Hallmark Cards: -------------- Hallmark has these new cards that actually let you record a message for your loved ones so when grandma opens the card she hears your voice saying, "Merry Christmas, Grandma Edna!" Then Grandma Edna will drop the card in horror, thinking that she's gone completely nuts and probably die of a heart attack. After you've shoplifted a few of these cards and taken one apart, you'll see that that electronics inside are pretty small. You can record your red box tones on this chip and then conceal the whole mess anywhere you want and you'll have a tiny red box to use. Voice Memo Minders: ------------------ These voice reminders can record tones and are extremely small. You can either buy one that fits in your pocket or you can buy one that fits on your key chain. In case you're surrounded by telco security, the F.B.I., local police and AT&T's top officials while you're at a pay phone, you can easily press the "MEMO ERASE" button to get rid of the evidence, though the police might shoot you when they see you go for the erase button. A Digital Red Box Schematic --------------------------- This method of building a red box is for those who are more familiar with electronics. You'll need to hike over to your local Radio Shack and pick up quite a few parts. If you're really good, you can build this quite small. (At DefCon in 1994, there was a red box disguised as a pack of Big Red gum. This section was written by Kwiq, sysop of The Moonlight BBS. V+ V+ /\ /\ | +-------------+ | | | +----------+---+ +-------+---+ \R3 | 1 | | 16 | / SPKR1---+16 3+----------+12 | \ | | U1 | | U2 | | +-----+6 11+---+------+14 15+---------+ | | 7 8 | | | 13 8 | | ----- +-+----------+-+ | +-+-------+-+ | --- | | | | | | - | +-----+ | | +-------+ | +--| X1 |-+ | | | +-----+ | ----- | | --- | |R1 R2 - | V+ +-----------+/\/\/\+--------+ | /\ | | | | | | | +---+------+--+ | | | | | 3 6 | | | +--------------+-------+8 2+-----+ +------S1------+ | | | | | | | | | --+-- | ----- +-------+4 | --+--C1 | --- | U3 | | | - | 1+-----+------------+ | | +-------------+ Okay... And now for your parts... RESISTORS VALUES NOTE ----------------------------------------------------------------------------- R1 220 Kohm The values of R1 and R2 are not important, R2 220 Kohm as long as they add up to 440 Kohm. R3 1 Kohm CAPCITOR VALUE ----------------------------------------------------------------------------- C1 0.1 uF CRYSTAL VALUE NOTE ----------------------------------------------------------------------------- X1 6.5 MHz 6.5536 MHz is also within the tolerance. CHIPS NAMES NOTES ----------------------------------------------------------------------------- U1 TCM5089 DTMF Encoder U2 74HC4017 Decade Counter; Regular 4017 is okay. U3 CMOS 555 Timer IC; Regular 555 will work if a 1Kohm resistor is inserted between pins 3 and 8. SPEAKER IMPEDANCE NOTE ----------------------------------------------------------------------------- SPKR1 600 ohm U1 expects an equivalent load. SWITCH TYPE NOTE ----------------------------------------------------------------------------- S1 Momentary You may want to add a power switch. Okay... This thing works on 4.5 volts so you need 3 AAA batteries... A 9V will also work if... hmm... doing some math here... okay, R1 and R2 should add up to 470 Kohms. You need (obviously) some perf board and a chassis. Another Digital Red Box Schematic: --------------------------------- Here's another type of red box that you can build that looks alot easier to contruct than the last one. This section was written by JR "Bob" Dobbs. CIRCUIT OPERATION: Each time the pushbutton is pressed, it triggers half of IC1, configured as a monostable multivibrator to energize the rest of the circuit for a length of time determined by the setting of the coin selector switch. This in turn starts the other half of IC1, configured as an astable multivibrator, pulsing on and off at regular intervals at a rate determined by the 50k pot between pins 12 and 13. The output of the astable thus alternately powers of IC2, configured as a square wave oscillator, providing the required 1700hz and 2200hz to the op amp which acts as a buffer to drive the speaker. CONSTRUCTION: Assemble the circuit as you wish. Component placement is not critical. I found the easiest method was to use point-to-point wiring on a "universal" PC grid board with solder ringed holes. Use sockets if you aren't a whiz with a soldering iron. Be sure to leave easy access to the potentiometers for alignment. ALIGNMENT AND TESTING: For alignment, a frequency counter and tiggered sweep oscilloscope are extremely handy (but not absolutely necessary.) Install a temporary jumper from +9v supply to pin 14 of IC2 and temporarily disconnect the 0.01uF capacitors from pins 5 and 9 of IC2. Power up the circuit. Measuring the output from pin 5 of IC2 with the frequency counter, adjust the 20k pot between pins 1 and 6 for an output of 1700hz. Now adjust the 20k pot between pins 8 and 13 for an output of 2200hz from pin 9 of IC2. Remove the temporary jumper and re-attach the capacitors to pins 5 and 9. (Note: if no frequency counter is available, the outputs can be adjusted by ear one at a time by zero-beating the output tone with a computer generated tone of known precision.) Next, temporarily disconnect the wire between pins 5 and 10 of IC1. Set coin selector switch in the "N" (nickel) position. With the oscilloscope measuring the output from pin 9 of IC1, adjust the 50k pot between pins 12 and 13 of IC1 for output pulses of 60 millisecond duration. Reconnect the wire between pins 5 and 10. (Note: If no scope is available, adjust the pulse rate by ear using computer generated tones for comparison.) The remaining adjustments are made by ear. Leave the selector switch in the "N" position. Adjust the 50k pot labelled "Dime" for a quick double beep each time the pushbutton is pressed. Finally, set the selector to "Quarter". Adjust the 50k pot labelled "Quarter" until exactly 5 very quick beeps are heard for each button press. Don't worry if the quarter beeps sound shorter and faster than the nickel and dime ones. They should be. CONCLUSION: If all went well to this point, your red box should be completely aligned and functional. A final test should now be conducted from a payphone using the DATL (dial access test line) coin test. Dial 09591230 and follow the computer instructions using the red box at the proper prompts. The computer should correctly identify all coins "simulated" and flag any anomalies. With a little discretion, your red box should bring you many years of use. Remember, there's no such thing as spare change! Semiconductors: (2)556 dual timer (1)741 Op Amp (1)1N914 Switching Diode Resistors: (6)10k (1)4.7k (2)100k (4)50k PC Mount Potentiometer (2)20k Multi-Turn Potentiometer Capacitors: (10)0.01uF (1)1.0uF (2)10.0uF Electrolytic Miscellaneous: (2)14 Pin Dip Socket (1)8 Pin Dip Socket (1)3-position Rotary Switch (1)Momentary Push-Button Switch(normally open) (1)SPST Toggle Switch (1)Speaker or Telephone Earpiece Circuit Board (1) Box (1) 9v Battery Clip Mounting Hardware SCHEMATIC DRAWING / ���S1� ������������������������������������������������������������Ŀ +9v R1 R2 � � � � ����C1���Ĵ � R3 � � � � ���Ĵ �������C2�@q S3 @n � o ����������������Ŀ � R5 � @d � � oĴ � 6 4 14 � R4 � � � ��Ŀ � S2 o �Ĵ5 13����Ĵ g � ���Ŀ � � � � � � � � � � � R9<�� � g �Ĵ10 (IC1556) 8�Ŀ R6<Ŀ � R8<��� � � � � � � � � � � � ����Ĵ9 12��������� ��Ŀ � � � � � 3 11 7 2 1 � C3 � � � � � � ������������������ � R7<�� � � � � � � � ��Ĵ g � � � � � C4 C5 � ��������������������������������� � � � � � C6 � � � � � � � � g g g g � � � ����������������Ŀ � R11 � R12 ���Ŀ � ��Ŀ � � � � v � v � � �����Ŀ ��������R13�Ŀ � ����R10���Ĵ � � � � � � � ��������������������Ŀ � � � � 1 4 14 10 13 � � � � � 8�������Ĵ � ��������Ĵ6 � � C12 � � � � 12���� � � � �Ĵ2 IC2 556 � � � C7 � � g � � ��Ĵ3 11�����Ŀ � � � � 7 5 9 � � � g C8 ���������������������� C11 � � � C9 C10 � � � � � � g � g � ����� � g � � � ���������������������������������� � � � � R14 � � � �\ � � � � \ � ������������������������ij3 \� � � � 7 \ C13 R15 �IC3 \ � � �741 6/�����Ŀ � � � 4 / � � � � / � g g ��Ĵ2 / � � � �/ � � � g � ������������������Ĵ C14 � Speaker � g Schematic part variables list. ------------------------------ Resistors: R1 - 10k R2 - 10k R3 -4.7k R4 - 10k R5 - 10k R6 - 50k R7 - 50k R8 - 50k R9 - 50k R10- 20k R11- 10k R12- 10k R13- 20k R14-100k R15-100k Capacitors: C1 - 0.01uf C2 - 1N914 switching Diode C3 - 1.0uf C4 - 0.01uf C5 - 0.01uf C6 - 10uf C7 - 0.01uf C8 - 0.01uf C9 - 0.01uf C10 - 0.01uf C11 - 0.01uf C12 - 0.01uf C13 - 0.01uf C14 - 10uf Switches: S1 - SPST toggle S2 - Momentary push button N.O. labeled "Deposit" S3 - 3-position rotary switch Miscellaneous: g - Ground @q - Label "quarter" @d - Label "dime" @n - Label "nickle" Typed up by Sine Wave from an article which originally appeared in 2600 magazine. The original contained several mistakes in the schematic drawing which I've corrected. Hope this information enlightens you to new and exciting possibilities via your local phone booth. Finding A Phone That Will Work: ------------------------------ Usually any GTE or Bell phone will work, Bell including Southwestern Bell, U.S.West, Ameritech, Pacific Bell, etc. You'll know it's a Bell or GTE phone because their logo will be on the phone. I've noticed in some areas like Pacific Bell and Ameritech the phones are rigged so that no sound can enter the mouthpiece of the phone until the call is connected, rendering your redbox useless. A way around this is to dial "0" and have the operator dial the call for you. Privately Owned pay phones are those ugly phones with some kind of generic logo on them that means some old fat local guy owns it and convinces innocent store owners to install his phone instead of a Bell phone, promising him bigger profits. Not a hard promise to keep, considering a local call sometimes costs 75 cents, they sometimes won't let you dial toll free numbers and long distance rates are twice as high (or more) than AT&T which is pretty bad. The best thing to do when you find a Private pay phone is to squirt a lot of ketchup or mustard into the coin slot and find a Bell/GTE phone somewhere. Making A Long Distance Call: --------------------------- Okay, here's the fun part- Calling anywhere in the entire world and not paying a cent for it. Pick up the phone and dial the number you want to call in the fashion 1-AREA CODE-NUMBER. For example, if you want to call the White House in Washington D.C., dial 1-202-456-1414. You'll hear a click, then a computer voice will say, "Please deposit $2.85." (The exact amount differs with the location and time of day.) Mutter, "Fuck you, AT&T..." to yourself, switch on your red box, hold the speaker of the red box FLUSH with the mouthpiece of the pay phone and press P1 for your quarters. Pause for a split second in between each quarter because if you go too fast, you'll get a live operator wanting to know what the problem is. You are able to go 20 cents over the amount requested and that will be credited to your call. After you've put in enough "money", the computerized voice will say in a cheerful, unsuspecting voice, "Thank you for using AT&T!" and your call is put through. Every few minutes the voice will come back and ask for more money. International Calling: --------------------- Your red box can also be used to call your loved ones in other countries, although, it's annoying to do because you HAVE to use a live operator and your conversation will be inturrupted every THREE MINUTES by a voice asking for another two bucks. But if you really need to call overseas... Dial 011-COUNTRY CODE-CITY CODE-PHONE NUMBER. An operator will ask you how you want to bill your call. Tell her you'll be using the spare change you make as a waiter and MoogooGuawkcaMeemay's Chineese restaurant to pay for your call. For best results, don't do this: OPERATOR: "Okay, sir, please deposit your money now..." YOU: "Okay, ma'am, I'm going to use nickels...(beep)...That was one nickel. Did you get that alright? Okay, here's my second nickel...(beep)...okay, there's two nickels, that makes 10 cents. How much more to go? $9.10? Okay...(beep)...I'm up to 15 cents now, right? Okay, good...(beep)... alright, there's another one...Hey, here's a penny on the ground! Can I use a penny? No? Okay, here goes lucky nickel number five...(beep)...did you get that? Okay....etc, etc, etc." The call will be completed like this: The operator will tell you that the call will cost (for example) $7.35. She'll tell you to deposit $3.00, you red box three dollars to her and she connects the call. When the overseas person answers the phone she'll say, "This is the United States AT&T operator, I have an international call for you, could you please hold while billing is completed?" Then the operator will ask you for another $3.00 and then the remaining $1.35. After all that you'll be connected only to be inturrupted every three minutes by an operator asking for more money. If you don't want the person you are calling to know you're calling with coins, you can ask the operator if you can deposit all your money right now and THEN be connected overseas. They don't like to do this (because you could lose all your "money" if they're not home) but they will do it if you ask. Local Calls: ----------- To red box a local call it takes about a minute or two longer than if you really paid for it, but those quarters add up so it's definately worth it. Pick up the phone and dial zero. Tell the operator that you want to make a local call. If she tells you just to put in a quarter and dial the number, tell her, "Well, ma'am, there's shit all over the keypad here and all the buttons are stickin' together and I CAN'T dial it myself. The only key that works is the zero and THAT'S got this sticky blue shit all over it. Then there's a half-eatin' Twinkee shoved in the coin return and dirt all over the four and seven keys..." Keep going on and on until she asks you what number you want to dial. She'll ask you for a quarter and connect your call. Make sure after your call connects that you hear the operator click off. Some operators are nosey and will just SIT there listening to your conversation. Once I was explaining to a friend how I placed my call and suddenly the operator starts lecturing me and telling me she's going to call security on me. (And this was about three minutes into the conversation!) In some cities I've noticed you can trick pay phones into thinking that a local call is actually a long distance call by dialing 10288 before you dial the local number. So try dialing 10288 or 102881 before you make your local call and maybe you won't have to deal with that pesky operator. The only downside of doing this is that the call will "cost" more and you'll be inturrupted every five minutes to deposit more money. Red Box Frequencies: ------------------- For you tech-heads out there, here are the actual frequencies that the red box produces. Actually, this is what a pay phone produces. When you make a red box out of a Radio Shack tone dialer, the timing is slowed slighty on the quarter tone. The "tone" is 1700 hz and 2200 hz mixed together. A nickel is 66 ms on (1 beep). A dime is 66ms on, 66ms off, 66ms on (2 beeps). A quarter is 33ms on, 33ms off repeated 5 times. Miscellaneous Notes: ------------------- You can not call any of those 900 phone sex numbers with a red box, so perverts of the world...Sorry, Roy, you're just out of luck. You CAN call 976 information lines, though! If you're really desperate for money, you can sell phone calls to people. Hang around a phone and tell someone who's about to make a call that you'll give them a free call if they'll give you a quarter. This usually impresses the hell out of any ordinary person. If you live in a big city, you can go to the tourist section of town and sell long distance discount calls to out of state tourists. Consider yourselves warned, though, I've read a LOT of articles on people getting busted for doing this. One article even had a picture of a guy in an airport selling calls to people comming off the plane. If an operator confronts you and says, "Hey, you're not really putting in coins, that's a recording!" don't get all nervous and run from the pay phone. She'll lie and tell you that security is on the way to the pay phone to put you in jail but she's full of it. Instead, piss her off by explaining to her in detail exactly what you're doing and how you're doing it. If she gets an attitude with you, ask to speak with her supervisor or Service Asisstant. This pisses her off to no end. When connected with the supervisor, tell her exactly what you think of her and the company she works for. The worse thing they can really do is shut off the pay phone. Operator Quotes: --------------- Sometimes a malfunctioning red box or making a local call cause you to have to deal with a live operator who can get testy when they find out you're screwing the place that they work for. Here are some responses I've gotten from them. 1."Well, son, your TOY doesn't seem to be working today. Why don't you try PAYING for your call instead?" -Hollywood, CA 2."What'd you do, record those tones on the train tracks?" - my friend got this response when trying to use a very poor quality cassette of red box tones in Wood River, IL 3."(sigh) Well, I'll put your call through, but next time I want you to pay real money for your call, okay?" -Galveston, TX 4."That's it! I'm sick of you kids, I'm calling security RIGHT NOW!" -Cincinnati, OH 5."You know you'll go to hell for stealing..." -Portland, OR 6."I wish I could go over there right now and strangle that kid." -I overheard an operator in Seattle say this to her supervisor after they thought I had hung up the phone. If you have any questions about your wonderful, new hobby or you're having any kind of troubles, feel free to contact me, RedBoxChiliPepper, via voicemail: ����������������������������������������������������������������������������͸ � Contact The Phone Losers Of America Nearest You! The P.L.A. Voice Mailbox � � number is 512-370-4680. And PLEASE don't pay for your phone calls. -RBCP � ����������������������������������������������������������������������������;