-----------------------------------------------------------------------------
                ����������������������������������������������
                �                                            �
                ��������    ����������������������������������
                       �    �  �����   �����  �������������
                       �    �  �   �   �   �  �           �
                       �    �  �   �����   �  �   ���������
                       �    �  �           �  �   �
                       �    �  �           �  �   �
                       �    �  �   �����   �  �   ���������
                       �    �  �   �   �   �  �           �
                       ������  �����   �����  �������������
                ����������������������������������������������
                �             The Hacker's Choice            �
                ����������������������������������������������
--------------------------------------------------------------------------------


                              THC-SCAN v0.8�
                   (c) 1996 by van Hauser/THC of LORE BBS

                          * PUBLIC BETA RELEASE *







  Part  Title                              Line #         Last Updated in Ver.
 ------------------------------------------------------------------------------
     I. Introduction                         50             v0.7a
    II. Commandline Parameters              240             v0.8�
   III. Online Scanning Keys                550             v0.7a
    IV. How to configure Modem & TS-CFG     750             v0.7a
     V. Tips & Tricks                       855             v0.7a
Epilog: Update? How to contact?  etc.       975             v0.8�
 ------------------------------------------------------------------------------










 ==============================================================================

                              I. Introduction






  ->> Please read HISTORY.DOC to see what's new, or get a general insight <<-



 What does THC-SCAN
 ------------------
 THC-SCAN scans a defined range of phone numbers.
 It Reports : Carriers, Tones, VMBs, Fax etc. etc. depending on the mode
 setted & configured. (You can do many more things with this piece, but get
 a brain to find out ... ;-)      [300 kb source code by the way ...]

 
 Hey that looks like TONELOC !
 -----------------------------
 Yep. Toneloc is very good. But first it didn't work on my computer and 
 second it could be enhanced. So i wrote this one. And my personal
 opinion is, that this one is better. Much more flexible and more functions.
 (which programmer would say his one is not as good as? Why releasing it then?)
 Take a look. Try it, test it. It's worth it's time !


 Who's Who in this file package ?
 --------------------------------
 THC-SCAN.EXE   The Scanner EXEcutable
 TS-CFG.EXE     The ConfigMaker EXEcutable
 DAT-CONV.EXE   DAT File Converter Toneloc <-> Thc-Scan
 DAT-MANP.EXE   DAT File Manipulator for Thc-Scan, exchange ID values.
 DAT-STAT.EXE   DAT File Statistical Analyzer.
 EXTR-NO.EXE    Extracts (phone-)numbers from a text file.

 BETATEST.DOC   IMPORTANT INFORMATION FOR BETATESTERS /* Only in BETA Releases */
 DATFILE.DOC    The Structure of the Thc-Scan DAT Files
 ERRLEVEL.DOC   Overview of the Errorlevels returned by Thc-Scan
 HISTORY.DOC    History File. What's new, what changed, bugs etc. READ IT !
 THC-SCAN.DOC   Small Documentation for the average Scanner Guy
 TONELOC.DOC    Differences between Thc-Scan & Toneloc. How to (ex-)change.
 SIGS.ZIP       PGP Signatures of all EXEcutable files in this package.
                Please check to get a secure version of my public PGP key.
 FILE_ID.DIZ    File Description for BBS
 LORE.COM       Small demo of LORE BBS ;-)
 THC.NFO        Important. Our group infos ;-)




 The different Modes
 -------------------
 There are two basic modes, THC-SCAN can be set.
 CARRIER MODE - THC-SCAN searchs for carriers
 TONE MODE    - THC-SCAN searchs for tones/pbx. Those ones with a dialtone.
 When in CARRIER MODE, THC-SCAN can also identify VMBs, Voice, Fax and more.
 You may change the mode online by pressing "ALT-M"


 The AUTONOM/MANUAL Mode
 -----------------------
 This is a special mode, never ever seen on a scanner before.
 For this Mode ADD-ON you must sit in front of the computer while scanning.
    (you should do this every time, unless you are so lazy to scan
     for carriers only)
 When turned on, you may continue dialing! This is useful for Tones/PBX, or
 VMBs or Answering Machines, to test the code length etc.
 Press ENTER when autonom/manual mode is turned on to continue dialing.
 You may also enter "M" while online to redial and enter autonom/manual mode for
 this call only. Or you may hit "Alt-M" to toggle this mode on/off



 DIAL MODES
 ----------
 You can choose to dial RANDOM, Sequentiell up & down (with step rates too)
 or to Dial all numbers in a specified textfile. Read next Paragraph for
 details on this.



 DIALING NUMBER FROM A TEXT FILE
 -------------------------------
 This allows you to scan every number you put on a list.
 DRAWBACKS :
 NO Dat file is created (of course)
 BACKSPACE key (redial last 20 dialed numbers) won't work here
 If you want to continue such a scan type after aborting it, you must manually
 delete everything until the line THC-SCAN should continue.
 ADVANTAGES :
 You can put any number on the list you want to.
 The first scanner ever to offer this possiblity
 How to use this :
 Use EXTR-NO.EXE to extract the phonenumbers from any textfile (carrier
 listings ;-) ... check the created file after that for mistakes etc.
 Start THC-SCAN with : THC-SCAN.EXE @<textfilename> [any other options]
 Note that /M, /X, /D and /R are disabled when using this option.
 Guys, this one is REALLY cool! I collected EVERY textfile, message, Scanlist
 TL & TS DAT File and extracted every modem carrier into the file.
 Then I scanned ALL 700 numbers found, revealing me the list of 500 carriers
 on german toll free numbers, the most complete list ever to be created ...
 


 PRIMARY & SECONDARY Identifications
 -----------------------------------
 This is also a special thing first ever possible in a scanner.

 Primary Identification is the main thing about the number.
 Is it a carrier, tone, vmb, girl voice, fax etc.
 You press the ID key (F for Fax f.e.) and THC-SCAN will stop and move to the 
 next number.

 Secondary Identifications are other characteristica which are interesting.
 For example if the phone system of the target is using CCiTT #4 or #5
 which is interesting for blueboxers, or to determin if the number is in
 an other country (better if you want to play with those numbers, depending on
 the law of your country, you may only break the law in the country the phone
 number is located. Check your lawyer.) on f.e. Toll Free Numbers.
 When you press the ID key for a Secondary ID (5 for CCitt #5 for example)
 THC-SCAN will not stop. You may type some more 2ndary IDs.
 But when you press a Primary ID, THC-SCAN stops and moves to the next number.

 SECONDARY Identifications are marked in Section III - Keys while online
 as SECONDARY. 



 Carrier Hacking & Nudge
 -----------------------
 When mode enabled (TS-CFG : MODE HACKING), depending on mode set it will
     0) wait for nudge delay timeout
     1) send nudge string to system and wait for nudge delay timeout
     2) beeps a few times to inform you that YOU can now enter the system.
        NO nudge delay timeout. You can online hack the other system)
 Don't unset the string variable for your Carrier Hack Log, or no log file
 will be created.
 Pressing ALT-T while 0) or 1) is in progress automatically enters 2)
 See TS-CFG to see how to set up the NUDGE STRING.
 NUDGE DELAY counts the time after the connect had been made. When exceeding
 Nudge delay setting, THC-SCAN disconnects (only in 0) and 1) )



 The DAT File & the LOGs
 -----------------------
 In the DAT file are many things things saved - all primary IDs and the no#
 of rings detected on that number. Not the 2ndary IDs ! 
 In the LOG files everything is written. In the main log file everything is
 logged, in the specialized logs (VMB LOG f.e.) only those about this type are
 written too. If you Delete the name entry in TS-CFG, that type won't be logged
 in an own file anymore!


 van Hauser says :
 -----------------
 Thanks to all Betatesters, especially to : The Analyst, Wilkins & Plasmoid !
 Credits for the nice blinking Screen, and scrolling up/down go to Plasmoid ;-)
 Credits too for the nice EXE file crypter got to Marquis. ;-)
 Greetings to :  � Omega (hi chummer! Thanks for your help! And make a BACKUP!)
                 � Tom (thanks for your betatesting too!)
                 � The Search, JFF (good work spreading the THC releases)
                 � Scavenger (thanks for the help! (& the best dialer, ya know)
                 � Skysegel (spoof'em! ;-)
                 � The Q (for being no where and absent all the time)
                 � Marquis / UCF (let's let our groups work together ;-) 
                 � Muchos Maas, Minor Threat (for programming TONELOC, breaking
                   the limit at the art of scanning. Your program gave me GREAT
                   inspirations!) Hope ya get out of jail soon.
                 ... and to Dr. Fraud, Karl Marx, Chotaire ... all on #bluebox

                 And two guys who are out at the moment ... the two most 
                 dangerous things that may happen to a hacker :
                 � El Griton (Being busted by Police + Fbi ... good luck chummer!)
                 � Vaxxer (Being occupied by his girlfried ... Get up AGAIN!)

 With those guys, the sky is the limit ...









 ==============================================================================

                          II. Commandline Parameters






---------------------------------------------------------------------------
THC-SCAN.EXE [@]<DatFile>  [/M:<dialmask>] [/X:<excludemask>] [/R:<from>-<to>]
             [/D:<from>-<to>] [/#:<no>] [/H:<time>] [/S:<time>] [/E:<time>]
             [/C] [/T]  [/A] [/B]  [/Q] [/!:<ConfigFile>] [/*:<no>]  [/&] [/N]


Parameter :
-----------

   [@]<DatFile>       The name of the DAT file to create/use/update.
                      This MUST be the first parameter to give to THC-SCAN !
                      If you specify the "@" in front of the filename, 
                      that will be the specified DIALTEXTFILE ! (Read Sec. I)


Optional  :
-----------

   [/M:<dialmask>]    The Dialmask to use for scanning. If you use f.e.
                      /M:1234-x-6-xxx  the program will scan from
                      1234-0-6-000 to 1234-9-6-999. You may use any number
                      of X's between 1 and 4 - not more! If you don't
                      specify this option, the <DatFile> name will be
                      interprated as <dialmask>.
                      You may put the X's where ever you want like :
                      /M:x-1-x-2-x-4-x-5
                      The "-" character is NOT necessary.


   [/X:<excludemask>] The Excludemask to use for scanning. The numbers
                      excluded WON'T be scanned! the excludemask must have got
                      the same length as X's are used in the <dialmask>
                      If you use f.e.  /M:1234-xxxx and /X:00xx
                      then 1234-0000 to 1234-0099 WON'T be scanned, all others
                      will. You may specify up to 10 exclude masks.


   [/R:<from>-<to>]   A Special Range to scan. This is useful if you want f.e.
                      create a DATfile with a full range (XXXX) but want to
                      scan today/tonight only a special range from 0000 to
                      0250 ... /R:0-250 ... you may use up to 10 Ranges.


   [/D:<from>-<to>]   This is like /R but DROPS (doesn't scan) those numbers.
                      /D:500-999 f.e. won't scan 0500 to 0999
                      You may use up to 10 Drops



   [/#:<no>]          This is the maximum number of tries THC-SCAN will make
                      until it will exit.  f.e. /#:100  will make 100 dials
                      and then exit. If not specified there won't be a limit.


   [/H:<time>]        This specifies a timerange. When exceeded THC-SCAN will
                      exit. if you just use  /H:4  it will scan for 4 hours,
                      if you use  /H:0:30 it will scan for 30 minutes.



   [/S:<time>]        This specifies the Starting Time for scanning. THC-SCAN
                      will wait until a key is pressed OR the time mentioned
                      is reached and will then begin scanning. You may either
                      use am/pm time or military time :
                      /S:3:50p  will wait for 15:50 ...
                      /S:14:15  will wait for 2:15p ...


   [/E:<time>]        This specifies the Ending Time for scanning. When
                      reached, THC-SCAN will exit. Usage is like /S.
                      You must not use /S and /E together.


   [/C]               Starts THC-SCAN is carrier scan mode. Overrides what ever
                      was specified in the config file.


   [/T]               Starts THC-SCAN in tone scan mode. Overrides what ever
                      was specified in the config file.


   [/A]               Starts THC-SCAN with autonom/manual mode ON. Overrides
                      setting in the config file. This is an additional mode
                      to Carrier/Tone scanning. Read Section I. for more info.


   [/B]               Starts THC-SCAN with autonom/manual mode OFF. Overrides
                      setting in the config file. This is an additional mode
                      to Carrier/Tone scanning. Read Section I. for more info.


   [/Q]               Prevents any beeps made by THC-SCAN


   [/!:<ConfigFile>]  Specifies an other config file to use but THC-SCAN.CFG


   [/*:<no>]          Dial only numbers which were identified as a special
                      type. Consult the DATFILE.DOC to check the numbers to use
                      f.e. Timeout is 32 to 39 (depending on rings detected).
                      To scan Timeouts with NO rings again use  /*:32
                      to scan Timeouts with 5  rings again use  /*:35
                      to scan ALL Timeouts           again use  /*:32X
                      This X after the number tells THC-SCAN to scan all
                      members of a type, from 0 to 7 rings.
                      You may use this option up to 10 times.


   [/&]               Turns Debugging mode ON. All modem output will be saved
                      into MODEM.LOG


   [/N]               Turn Effects (Window Scoll up/down) off. In future this
                      will also turn assembler screen writes off to be
                      Desqview compactible.



Note : The "/" before the option is NOT necessary NOR the ":" after.
       you may also use "-" instead of "/".


All these Examples are valid :
       THC-SCAN scanit -M:1234xxxx /C h5
       THC-SCAN scan1234xxxx -T S23:00
       THC-SCAN 1234-xxxx -!alternat.cfg *72x /*:64X -Xx000 d7999-9999
       THC-SCAM 1234xx -Q

All these Examples are NOT ! valid :
       THC-SCAN scanit -m1234xxx a b    Autonom/manual mode turned on & off
       THC-SCAN scanit -m1234xxx c t    same as above but with carrier & tone
       THC-SCAN scanit c                no dialmask specified, the datfilename
                                        hasn't got a X in it!
       THC-SCAN xrated                  NOTE : This would be valid! it would
                                        simply dial the number 0, then 1 etc.

If the program doesn't behave like you want, some strange things happen like
numbers dialed again, some dialed not etc. Check your CFG File ! There are
numerous things to configure so check first if everythings correct.
(escpecially the options SAVE DATATYPES, REDIAL BUSY, AUTONOM/MANUAL MODE,
 SCANNING MODE - all in the MODE Menu of TS-CFG.EXE, plus Modem Config
 Options like WAIT BETWEEN CALLS, MODME HANGUP TYPE, CHARACTER DELAY)




-------------------------
TS-CFG.EXE [<ConfigFile>]

Optional  :
-----------

   <ConfigFile>       If not specified, THC-SCAN.CFG will be loaded/created.
                      TS-CFG will convert all configfile version from v0.6a
                      up automatically.





----------------------------------------------------
DAT-CONV.EXE <Datfile 1> <Datfile 2> [<ID_1> <ID_2>]

Parameters:
-----------

   <Datfile 1>        DAT File to load.
   <Datfile 2>        Dat Filename to write.
  

Optional  :
-----------

   <ID_1>             in TL->TS Mode : THC-SCAN DAT ID to write for NOTE 
                                       variable in TL Dat file.
                      in TS->TL Mode : THC-SCAN DAT ID to write as NOTE
                                       variable into TL Dat File

   <ID_2>             same as above but for NO DIALTONE variable.

if you define the optional variables you must either only set ID_1 or both,
you can't only set ID_2.




------------------------------------
DAT-MANP.EXE <Datfile> <ID_1> <ID_2>

Parameters:
-----------

   <Datfile>          DAT File to manipulate. .BAK file will be created.

   <ID_1>             ID Type to search for. Look up ID numbers in DATFILE.DOC
                      Appending an "X" after the ID will search for the whole
                      type (means with all ring counters).

   <ID_2>             ID Type to overwrite ID_1. Appending an "X" after the ID
                      will transfer the ring counters. Only Possible if also
                      on ID_1 an "X" is appended.




----------------------------------------------------
DAT-STAT.EXE <Datfile> [<Outputfile> <ID>]

Parameter :
-----------

   <Datfile>          DAT File to analyze.
  

Optional  :
-----------

   <OutputFile>       File to write the data to.

   <ID>               ID number of the phone numbers to write into <OutputFile>
                      As Usual you may search for all IDs of a type with "X"

This prints some statistics about the DAT File.
The Optional Parameters must be used together !
The Optional thing is very interesting : by specifing the outputfile and the
ID, it will search for the ID, and writes the WHOLE PHONENUMBER of the ID into
the outputfile! Practical to import this data into another program!
(for example Textfile Dial Option from THC-SCAN with @)




----------------------------------------------------
EXTR-NO.EXE <TextfileINPUT> <TextfileOUTPUT> [[<no-min-length>] [[REMOVE] [ONLY]]]

Parameter :
-----------

   <TextfileINPUT>          Textfile to examine for numbers

   <TextfileOUTPUT>         Textfile to write the found numbers to.
  

Optional  :
-----------

   <no-min-length>          Minimum Length the number should be. (Std:6)

   REMOVE                   This Keyword removes ALL seperator of found numbers.
                            F.e. 1-800-5555-444 would be 18005555444

   ONLY                     This Keywords specifies that the numbers may NOT
                            have a seperator. Normally a number may have one
                            seperator between each other, like 1-800- etc.
                            so NORMALLY this is valid : 
                               1-800-5555-444
                               1-8-0-0-5.5./5/5 4 4 4
                            but also 12/12/95 which is more likely a date.
                            With THIS keyword there are NO seperators allowed!





----------------------------------------------------
TXT-CONV.EXE <InputFile> <OutputFile> <ConvertType>

Parameter :
-----------

   <InputFile>        File to read the data from

   <OutputFile>       File to write the data to

   <ConvertType>      Convert with which option :
                         7E1 - file is assumed to be captured with 8N1
                               but is really 7E1 and makes it readable.
                               Noise characters will be removed.
                         7O1 - file is assumed to be captured with 8N1
                               but is really 7O1 and makes it readable.
                               Noise characters will be removed.
                         REMOVE - Removes any character above 122 value.
                               Useful when you got a connection without
                               error correction and you want to filter out
                               the noise characters.
                         LF    gimmick : converts to amiga/unix text format.
                               Any Carriage Return character will be removed.
                         CRLF  Converts to MsDos Text format from both 
                               amiga/unix and the rare OS type text format
                               automatically.
                         CR    gimmick : converts to some rare OS text format.
                               Any Linefeed character will be removed.









 ==============================================================================

                           III. Online Scanning Keys



     While Online you can hit the following keys with the following results :
     (print this section or press "?" while online)


SCAN MODE
=========

     KEY   DESCRIPTION
     ----- --------------------------------------------------------------------
     B     Identifies the current dialed number as BUSY
           Will be saved into BUSY LOG

     C     Identifies the current dialed number as CARRIER
           NOTE: when the CARRIER HACKING is ON (see TS-CFG.EXE) then THC-SCAN
                 will continue to try to connect. Press SPACE to abort connect
                 try and move to next number. It will still be saved as CARRIER
           Will be saved into CARRIER LOG
           When Hacking, the output will be saved into CARRIER HACK LOG

     F     Identifies the current dialed number as FAX
           Will be saved into FAX LOG

     G     Identifies the current dialed number as GIRL (Female Voice response)
           Will be saved into VOICE LOG

     I     Identifies the current dialed number as INTERESTING VOICE
           Will be saved into VOICE LOG

     M     Redial+Manual, redials the current number and let's you enter MANUAL
           DIAL MODE with ENTER for this call only. See Introduction for usage.

     N     Next Number WITHOUT setting an primary ID on that number.
           (For closely examine later OR if you define a CUSTOM ID as 2ndary,
            it would be overwritten whn pressing SPACE with the ID
            UNINTERESTING) - the same as [TAB]

     P     Pops up PAUSE Window. You are still online. Press H for hangup,
           R to Redial immedeantly, N for Hangup & Next Number or any
           any other key to continue this numer and reset online timeout.
           (Doing a continue after you hang up is not possible, you should
            use Redial for that (logical, isn't it?))

     Q     QUIT after completed the call

     R     Redial current number

     S     Save a comment. When the call is completed it will ask you for a 
           comment. Your last comment made will be displayed. Use Control-X
           to delete line. You can use also the Home, End, Insert, Delete,
           Backspace, CursorLeft and CursurRight keys. ESC to abort, Enter
           to save. SECONDARY ID
           Will be saved into COMMENT LOG

     T     Identifies the current dialed number as TONE
           NOTE: when the TONE HACKING is ON (see TS-CFG.EXE) then THC-SCAN
                 will enter TONE HACK MODE.
           Will be saved into TONE LOG

     U     Identifies the current number as UNUSED
           Will be saved into UNUSED LOG

     V     Identifies the current number as VMB
           Will be saved into VMB LOG

     X     Extend the timeout for 5 seconds for this call only to a max of 255
           plus the timeout value.

     Y     Identifies the current number as YELLING ASSHOLE (voice)
           Will be saved into VOICE LOG

     +     Extend the timeout for 5 seconds for this call only to a max of 255
           plus the timeout value. (This is like "X" - "X" is for compactibilty
           with Toneloc)

     -     Decrease the timeout for 5 seconds for this call only.

     ?     When Online, one of the six help windows will be displayed in the
           Statistic Window. Press "?" for the 6th time to see the stats again.

     1-3   Identify current number as CUSTOM 1-3 ... You may specify their name
           in TS-CFG. NOTE : Custom 1-3 may be assigned to be SECONDARY IDs.
           Will be saved into CUSTOM LOG

     4     Identify current line as CCiTT #4 (for blueboxers. SECONDARY ID
           Will be saved into CCITT LOG

     5     Identify current line as CCiTT #5 (for blueboxers. SECONDARY ID
           Will be saved into CCITT LOG

     6     Identify current number as foreign continent EUROPE. SECONDARY ID
           Will be saved into COUNTRY LOG

     7     Identify current number as foreign continent USA. SECONDARY ID
           Will be saved into COUNTRY LOG

     8     Identify current number as foreign continent ASIA. SECONDARY ID
           Will be saved into COUNTRY LOG

     9     Identify current number as foreign continent AFRICA. SECONDARY ID
           Will be saved into COUNTRY LOG

     0     Identify current number as an OTHER foreign continent. SECONDARY ID
           Will be saved into COUNTRY LOG

     SPACE Identify current number as UNINTERESTING. (NEXT)

     TAB   Next Number WITHOUT setting an primary ID on that number.
           (For closely examine later OR if you define a CUSTOM ID as 2ndary,
            it would be overwritten whn pressing SPACE with the ID
            UNINTERESTING) - the same as N

     ESC   This aborts scanning immedeatly and quits.

     ENTER When in AUTONOM/MANUAL mode, or activates Redial+Manual with M
           you may press ENTER to continue dialing online !
           Will be saved into MANUAL LOG

     BACKSPACE Enters the DIAL_AGAIN Menu. You can select from the last 20
           dialed numbers as many as you like to be dialed again.
           Very useful if you identified a number wrong, or you were on the
           toilett when this wonderful scanner detected a carrier and you want
           to see what it was now.
           NOTE : In Random Mode they won't be dialed again at once. 
                  (it's random ;-)

     F1-F8 Execute programs specified in TS-CFG

     ALT-A ALARM! The screen will immedeantly show another picture, called
           ALARM.BIN. The modem will abort at once and turn the modem speaker
           OFF. The scanner will then continue. Press ALT-A again to see
           the online scan screen. Note that that modem does not switch
           the speaker on again. Do that with ALT-S.

     ALT-B Activates BOSSKEY. Screen Blanks. Press Alt-B again to unblank.
           The screen will be up to date with the online data.
           Note: All other ALT Functions are disabled while Bosskey on,
                 Also Carrier Hacking in Mode 2 is disabled.

     ALT-C Turn COMMENT ALL Mode on/off. When on it asks after EVERY number
           for a comment.

     ALT-D DIAL Menu. Enter a number to dial. (f.e. the number of your
           girlfriend - and you don't want to stop the scanning process)

     ALT-J Jump to DOS. Options will be displayed to Hangup, Continue, Redial
           etc.

     ALT-M MODE Menu. Change mode CARRIER <-> TONE and turn AUTONOM/MANUAL mode
           on or off.

     ALT-O OPTION Menu. Immedeantly runs TS-CFG while online. Changed options
           will be loaded!

     ALT-S Speaker Toggle : Turn Modem Speaker ON or OFF

     ALT-T Enters TERMINAL MODE. When a log for carrier hacking is specified,
           everything will be logged there.
           Will be saved into CARRIER HACK LOG




TERMINAL MODE
=============

     F1    Shows in the Status Line the other commands

     ALT-B Send a Break

     ALT-C Clear Screen

     ALT-D Data Statistics

     ALT-H Hangup

     ALT-P Change Parameter -> Modem DATA Setting (8N1/7E1)

     ALT-S Save Comment (now you can also set this ON from here)

     ALT-T When in Carrier Hacking AUTO Mode, you can enter into manual mode
           by pressing ALT-T.

     ALT-X Exit (+ Hangup)











 ==============================================================================

                     IV. How to configure Modem & TS-CFG



   I YOUR MODEM
     First get all information about your modem.
     You need to know which IRQ, BASEADRESS and BAUD SPEED is used.
     For COM    IRQ   BASE   are common, but may differ.
          1      4     2E8
          2      3     2F8   
          3      4     3E8
          4      3     3F8

     also important is the baud speed. Suggestions : If you got a modem
     capable of 14400 Baud or more, try it with 14400 ... if you get the
     error message "Can't initialize Port" then set it to 9600.
     This is cause you use a 14.400+ Baud EXTERNAL Modem and your seriell port
     is not fast enough. But this is not important. Real Carrier Scanner Guys
     set their modem to 2400 Baud to get every carrier without problems.
  
  II TS-CFG
     Set Up TS-CFG. You must run TS-CFG before you can run THC-SCAN for the
     first time, 'cause the CFG File will be created there. Change the defaults
     to suit your modem. Everything you need to know about the options you may
     change in TS-CFG are explained there. So here you'll only see those
     options which need to be explained further and those with no help.

     MODEM CONFIG MENU
     -----------------
     Modem Init     : Configure your modem to wait for a carrier longer
                      then the timeout time defined (S7 Register to 60+)
                      The Carrier don't be lost easily (S10 Reg. to 50)
                      Check exact the time your modem needs to identify
                      the dialtone. Put this time into the S6 Register.
                      The modem should lower datarate when line quality
                      is bad, and it should try to connect on any 
                      possiblity. Set Speaker On or Off as you like.
                      Use the factory settings and only change those
                      things, not more, that's the most securest way.
                      Also important is, that you set the REPORT level
                      to the highest (most time X set to 7)
                      (except you are a modem configure artist ;-)
                      Note: You can also change the S11 Reg to 50-65
                      to dial faster.


     HANGUP TYPE      Can either be FAST or SECURE.
                      Choose FAST and try this with a) normal scanning, 
                      b) carrier hangup  c) choose manual/autonom mode 
                      and scan. If everything works fine use this mode, 
                      it's much faster. It works great with Zyxels, but USRs 
                      are much slower. Try it.

     AUTO DETECT DATA If you want to autodetect databits, parity etc. used
                      by a system you're scanning, you must set your modem
                      data to 8N1. It will detect after the first 100 
                      characters transmitted if it's really 8N1, or if it's
                      7E1 or 7O1. It will switch mode if 7x1 detected and
                      reprint them correctly and reset also the nudge string &
                      nudge timeout.

                      For all Modem configs : CONSULT YOUR MODEM HANDBOOK !



     MODEM RESPONSE MENU
     -------------------
                      Very important. If this isn't configured properly,
                      not everything will work correct.
                      For example, if no dialtone is detected, USR modems
                      responds with NO DIAL, Zyxel modems report NO DIALTONE,
                      and last but not least, Creatix reports NODIALTONE
                      All new modems report CONNECT when a carrier was found,
                      but old ones may report CARRIER ... and so on.
                      And not all modems can detect VOICE. Keep that in mind.
                      To make your life more easy you can do enhanced
                      identification. When you get a VOICE response, and your
                      modem didn't recognized a RINGING, then it's likely to be
                      a VMB ... so set for there FROM_RINGS to 0 and TO_RINGS
                      to 0 too for VMB detect (and set modem response to VOICE)
                      Make up your mind, you can do powerful things with that
                      but you need a brain to make that out! ;-) hehehehe


     SCANNING MODE MENU
     ------------------
     REDIAL BUSY      Numbers dialed in this scan round will only be redialed
                      when busy when SCANNING RANDOM. Set the DIALING Option
                      to 0 for this. When Dialing Sequentiell, only busy 
                      saved numbers from former tries will be done again.

     OVERWRITE WITH BUSY  If you scan for a special ID number (f.e. all carrier,
                      or tones with no ring) this defines if those Data will
                      be overwritten as BUSY when a BUSY is detected.
                      Of course you should turn them off, but you may set this
                      on to check which numbers you couldn't scan. Or do you
                      want to check all numbers in the log with your data file?






 ==============================================================================


                               V. Tips & Tricks



MODEM CONFIGS ?
     Here's a good Modem config for the Zyxel 1496B :
     AT &F *Q1 *P15 S11=60 S10=30 X5 N3 L6 
     if you want a quiet scanning, remove "N3 L6" and put "M0" there
     If for normal use (BBS call), remove *Q1 and exchange  S10=30 with S10=64

     Here's a good Modem config for the USR Dual Standard 14.400
     AT &F &A2 S11=60 S10=30 X7 Q0 E1
     if you want a quiet scanning, add "M0" 
     Note : Get Infos about the undocumented commands for your USR.
            There should be possibilities to even recognize CCiTT #5 clicks
            when using the hidden Y command settings. Use the -& Option of
            THC-SCAN to print all modem output into MODEM.LOG

     Heres's good Modem config for the Creatix/Fax 14.400
     AT &F S11=60 S10=30 X7 L3
     if you want a quiet scanning, remove "L3" and put "M0" there.

     Important with these configs is that you check that your modem dials
     not too fast for your phone system. experiment a bit with it, ya can
     save time with that ;-) (S11 Register)


HOW TO USE TOUCHTONE RECOGNITION WITH YOUR MODEM AND THC-SCAN
     1) First Possility :
        Put ",;%T" in your Dial Suffix string. (if you aren't using a USR for
        DTMF Recognition, exchange the "%T" with the correct command)
        Start THC-SCAN with the -& command to have all modem output printed
        into MODEM.LOG. Set to SECURE HANGUP in TS-CFG - MODEM SETUP.
     2) Second possiblity : 
        Set THC-SCAN to AUTONOM MODE or do a M (Redial+ Manual) while online. 
        Enter ALT-T for Terminal Mode immedeantly. When you see the "OK" Answer,
        enter the modem command for Touchtone Recognition (AT %T).
        To abort, press ESC. The output will be saved into your CARRIER HACK LOG

VOICE RECOGNITION RESPONSE WITHOUT EVEN FINISHED DIALING
     Put a "," into DIAL SUFFIX in the MODEM CONFIG Menu in TS-CFG

SAME AS ABOVE BUT WITH TONE SCANNING !
     also the same solve as above

THC-SCAN DIALS ONLY EVERY SECOND NUMBER
     Raise the number for WAIT BETWEEN CALL in MODEM CONFIG Menu in TS-CFG
     to 1000-1500

IDENTIFYING CARRIERS WHERE THERE AREN'T ANY
     Set your S7 Register of your modem to +15 then the Timeout specification.

MY MODEM DOESN'T DIAL ALL NUMBERS - IN FACT SOME WEREN'T SEND TO THE MODEM
     Raise the CHAR DELAY in the MODEM CONFIG Menu in TS-CFG to 5-25
     This is only necessary for old and slow modems.

WHAT SHOULD I USE - RANDOM OR SEQUENTIELL SCANNING ?
     It's up to you. If you do it random maybe your phone company won't notice
     your extensive scanning. But good phone systems will. If you dial 
     sequentiell you can get an overview about a company f.e. you get
     their Customer Service on -0000, a Special Bureau of the Company at 
     -0010 to -0050, a Fax at -0055 ... and you'll notice that fact. In random
     you won't.

WHEN SHOULD I SCAN - DAY OR NIGHT ?
     That's up to you too - at daytime your calls won't be noticed. (and in some
     countries it's a illegal to scan!.) But many numbers will be busy.
     Or Carriers will only be online in the night. Or a VMB etc.
     At nightime then again your calls may be noticed.
     But some guys don't have a choice, when to scan on their line.

WHAT DO YOU DO?
     I scan random at daytime, sitting in front of the computer.
     Sometimes a nightly carrier scanning while i'm sleeping. (random too)
     At night, there are more carriers online then at daytime.
     Some Tone-Types and the carriers can be checked automatically, but the
     interesting things you can only find, when you are sitting in front of the
     computer. 

I FOUND A TONE - AND NOW ?
     Get PBXHACK (from THC too ;-)  and "analyze" it - if it's not illegal ;-)

I FOUND A CARRIER - AND NOW ?
     Check it out - it might be interesting. If you get some annoying
     "PASSWORD:" prompt then get LOGIN HACKER (from THC too ;-) to get in.
     (but only if it's not illegal in your country ;-)

I'M IN THE USA - SO ?
     Scanning is illegal in some countries. Check a lawyer.
     But some phone companies make their own law, and close your line if
     you do extensive scanning. So check & try & test ... & good luck

I'M IN GERMANY - SO ??????
     Scanning is not illegal in Germany. But German Telekom has now installed
     SS7 Monitoring Equipment from HP, where such scanning habits can be
     analyzed (plus many more things ... this hardware is very flexible ...)
     And Telekom trained a special team in darmstadt to locate those evil 
     scanners - thought it's not illegal - but you know it too - telekom doesn't
     care about that! surveilling phone lines for their purpose!
     Telekom already installed tools on the phone lines of two friends which
     will let the line go busy after every second number dialed (no matter how
     long you wait between the calls, no matter what numbers exactly you dial)
     after you began scanning. Such tools are also already installed in some
     areas on the public payphones to prevent scanning.
     At the moment you are safe, but maybe from March to October '96 on 
     you should be careful.











 ==============================================================================

                      Epilog: Updates? How to contact? etc.


     If you are updating from an older version : 
     Run TS-CFG. It will recognize the old version of the config file and
     write the new one.

     Where to get new versions :
     Call one of the THC Dist Sites.

     How to become a Betatester of THC :
     At the moment we got two Betatest Directories on LORE BBS & ARRESTED
     DEVELOPMENT and soon on SHOCK NETWORK too ... LORE BBS is a closed
     system for experienced users only, so maybe it's better for you to
     call A.D. or S.N to become a beta tester. Look for the numbers in THC.NFO
     Once you've gto applied and access is granted write a comment to the sysop
     or directly to me (van Hauser) to get access to the Beta Directories.

     How to contact you (me ;-)
     If you need some features, found some bugs, got questions/information :

     1) Call LORE BBS -> ++49-(0)69-823282   Login:THC  Pw:THC
                                             leave a message for  van Hauser
     2) Call Arrested Development -> ++31-77-3547477    apply for an account
                                             leave a message for  van Hauser
     3) Leave a message on my VMB in Germany : 0130-817698  Box:6630  (Aspen)

     4) Write an email to -> vh@campus.de


I appreciate any comments! Flames, Bug Reports, Tips, Typing Errors, Wishes,
Excuses, Ideas for new Features - and of course your beautiful girlfriend ...


Thanks for taking all your precious time to read that shit ...
For all the typing errors - hey i'm german ... ;-)

Ciao...
                    van Hauser




==============================================================================

                                      END







































































-------------------------------------------------------------------------------

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.1

mQCNAzB6PNQAAAEEALx5p2jI/2rNF9tYandxctI6jP+ZJUcGPTs7QTFtF2c+zK9H
ElFfvsC0QkaaUJjyTq7TyII18Na1IuGj2duIHTtG1DTDOnbnZzIRsXndfjCIz5p+
Dt6UYhotbJhCQKkxuIT5F8EZpLTAL88WqaMZJ155uvSTb9uk58pv3AI7GIx9AAUT
tBp2YW4gSGF1c2VyL1RIQyBvZiBMT1JFIEJCUw==
=6UhL
-----END PGP PUBLIC KEY BLOCK-----

--------------------------------------------------------------------------------

                ����������������������������������������������
                �                                            �
                ��������    ����������������������������������
                       �    �  �����   �����  �������������
                       �    �  �   �   �   �  �           �
                       �    �  �   �����   �  �   ���������
                       �    �  �           �  �   �
                       �    �  �           �  �   �
                       �    �  �   �����   �  �   ���������
                       �    �  �   �   �   �  �           �
                       ������  �����   �����  �������������
                ����������������������������������������������
                �             The Hacker's Choice            �
                ����������������������������������������������


!! REMEMBER !!! REMEMBER !!! REMEMBER !!! REMEMBER !!! REMEMBER !!! REMEMBER !!
         This file is for informational purpose only!
 The Sysop-Team is NOT RESPONSIBLE for anything you do after reading this text!
!! REMEMBER !!! REMEMBER !!! REMEMBER !!! REMEMBER !!! REMEMBER !!! REMEMBER !!

         �����������������[Sysop : van Hauser]���������������Ŀ
         �                                                    �
         �                   �   �        �        �          �
         �         ��      ���������  �������  �������        �
         �         ���    ޲��   �۰� ���  ��� ���� ��        �
         �         ���    ۱�     ۱� �� ����  �������        �
         �        ް����  ް��   �۲�ް�� �۲ ް��  �         �
         �        ��� ���� ��������� ��� ���� ��� ����        �
         �              �    �   �       �         �          �
         �                                                    �
         �        3000 H/P/A/V/C/M Files                      �
         �        Biggest Hpavcm Board In Germany             �
         �        BIG Message Base !                          �
         �        Experts Only! Lamer Protection!             �
         �                                                    �
         �               ��[ ++49-69-823282 ]Ŀ               �
         ���������������Ĵ  NUP : <ask4it!>   �����������������
                         ��[ ++49-69-PRIVAT ]��

!!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!!
            Dieses File dient nur zur Information und Aufklaerung!
                Die Sysops erklaeren sich NICHT VERANTWORTLICH
        f�r Rechtsverstoesse, die durch diese Informationen entstehen.
!!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!! ACHTUNG !!!

                        H/P/A/V/M/C/I/D/P/!/L/F/O/!
--------------------------------------------------------------------------------