/===================================v==============v==========================\ | White and Silver Boxes | SILVERBX.TXT | from Tharrys Ridenow | | Lunatic Laboratories Unltd. | | Official Document | \===================================^==============^==========================/ WHITE BOX PLANS This article will tell you how to take a perfectly normal touch tone keypad and convert it into a portable unit, allowing remote phreaking. First of all, the tones made by a touchtone telephone are not single tones, they are a combination of two different tones, making "DTMF" (Dual Tone Multi- Frequency). The normal tone telephone dials 12 different signals, but is capa- ble of dialling 16 different signals (see silver boxes.) The power required by a keypad is about 25 volts, but they will work with as little as 15, thereby allowing the use of two 9-volt radio batteries. As you may have guessed, they are designed to operate with a telephone type speaker (and phone line), and not the standard 8-ohm speaker which needs to be used for adequate volume. To accomplish this, we use a matching transformer, one of those miniature ones available from Radio Shack. Enough of the theory, now for the circuit. You will need: A touchtone keypad A miniature 1000 to 8 ohm transformer (Radio Shack #273-1380) A standard 8-ohm speaker Two 9-volt batteries Two 9-volt battery clips A case to put it all in (optional) A few construction notes- I suggest that you solder and tape all connections. It is also important to read this entire file before attempting to construct this. First, connect the red wire of the transformer to either terminal on the speak- er. Now connect the white wire from the transformer to the other terminal on the speaker. Next, connect the red (positive) wire of one battery clip to the black wire of the other battery clip. Now connect the remaining red wire on the second battery clip to the green wire from the touchtone pad. Connect the blue wire from the touchtone pad to the orange-and-black striped wire from the touchtone pad. To these two wires, now connect the remaining black lead from the first battery clip. You now have finished the power connection to the keypad. Connect the black wire from the keypad to the blue wire on the transformer. Next connect the red-and-green striped wire from the keypad to the green wire on the transformer. The black wire on the transformer should be unconnected, along with quite a few other wires from the keypad. The connection of the keypad is now complete. All you have to do is connect two nine volt batteries to the battery clips, and you'll be ready to go. I suggest that you stick the mess in a case for easy portability. Note that the silver box modification can be made to this unit, allowing com- plete remote phreaking (this unit is called a grey box). When none of the buttons are pressed, this unit uses no power, eliminating the need of a power switch, and extending the life of the batteries. Dual-Tone Multi-Frequency (Touch-Tone) Frequencies Key Freq. #1 Freq. #2 [] Key Freq. #1 Freq. #2 --- -------- -------- [] --- -------- -------- 1 697 1209 [] 4 770 1209 2 697 1336 [] 5 770 1336 3 697 1477 [] 6 770 1477 A 697 1633 [] B 770 1633 7 852 1209 [] * 941 1209 8 852 1336 [] 0 941 1336 9 852 1477 [] # 941 1477 C 852 1633 [] D 941 1633 Note: A, B, C, and D are the special frequencies generated by silver boxes. HOW TO TURN YOUR TOUCH-TONE FONE INTO A SILVER BOX Tools and Materials: Soldering iron, some solder, some 22 Ga. wire, an SPDT switch, and a screwdriver. 1> Unscrew your phone (it must be a touch tone, desk type). 2> Remove the mounted pad and take the clear plastic cover from the bottom. 3> Hold the pad with the numbers *, 0, and # facing you, and turn it upside down so you can see the yellow PC board. You should see 2 round black doughnuts. 4> Position the board so the solder points for the left doughnut face you. 5> Count over 4 points from the left and attach a (GREEN) wire to that point. 6> Between you and the doughnuts, there should be 2 long yellow capacitors. To the right of these, and on the edge of the board there should be 3 gold con- tacts. We will use the one on the left. 7> The contact originally is spot welded, so snip it open. 8> To the one nearest you, attach a (RED) wire, to the other one, a (YEL- LOW) wire. 9> Run the wires out of the phone, and solder the switch. 10> The orientation should be (RED) to center. The switch will now alter- nate between normal and 1633Hz fourth column tones. From BIOC Agent 003's Course in Basic Telecommunications: Part V Dual Tone Multi Frequency (DTMF) is a modern day improvement on pulse dial- ing in several ways. First of all, it is more convenient for the user since it is faster and can be used for signalling after the call is completed (ie SCC's, computers, etc.). Also, it is more up to par with modern day switching equip- ment (such as ESS) since pulse dialing was designed actually to move relays by the number of digits dialed (in SXS offices). Each key on a DTMF keypad produces 2 frequencies simultaneously (one from the high group and another from the low group). ------------------------------------------------- LOW GROUP | Q | ABC | DEF | | 697 Hz -| 1 | 2 | 3 | A | |-----------|-----------|-----------|-----------| | GHI | JKL | MNO | | 770 Hz -| 4 | 5 | 6 | B | |-----------|-----------|-----------|-----------| | PRS | TUV | WXY | | { 852 Hz -| 7 | 8 | 9 | C | |-----------|-----------|-----------|-----------| | | OPERATOR | | | 941 Hz -| * | 0 | # | D | |-----------|-----------|-----------|-----------| HIGH GROUP 1209 Hz 1336 Hz 1477 Hz 1633 Hz A portable NORMAL DTMF keypad is known as a white box; a touch-tone fone converted for use of 1633 Hz is known as a silver box; a portable FULL touch- tone keypad is known as a grey box. The fourth column (1633 Hz) is not normally found on regular fones but it does have several special uses. For one, it is used to designate the priority of calls on Autovon, the military fone network. These keys are called: Flash, Immediate, Priority, and Routine (with variations) instead of ABCD. Secondly, these keys are used for testing purposes by the Telco. In some areas you can find loops as well as other neat tests (see Part II) on the 555-1212 Directory Assistance exchange. For this, you would call up a DA in certain areas [that have an Automatic Call Distributor (ACD)] and hold down the "D" key which should blow the operator off. You will then hear a pulsing dial tone which in- dicates that you are in the ACD internal testing mode. You can get on one side of a loop by dialing a 6. The other side is 7. Some phreaks claim that if the person on side 6 hangs up, the equipment will screw up and start directing directory assistance calls to the other side of the loop. Another alleged test is called REMOB which allows you to tap into lines by entering a special code followed by the 7 digit number you want to monitor. Then there is the possi- bility of mass conferencing. ACD's are becoming rare, though. You will probably have to make several NPA-555-1212 calls before you find one. You can modify regular fones quite readily so that they have a switch to change between the 3rd and 4th columns. This is called a silver box (aka grey box) and plans can be found in TAP as well as on many BBS's. Word processed and nroff'ed by Tharrys Alaric Ridenow Uploaded by Downloaded from Just Say Yes. 2 lines, More than 500 files online! Full access on first call. 415-922-2008 CASFA Another file downloaded from: ! -$- & the Temple of the Screaming Electron ! * Walnut Creek, CA + /^ | ! | |//^ _^_ 2400/1200/300 baud (415) 935-5845 /^ / @ | /_-_ Jeff Hunter, Sysop |@ _| @ @|- - -| | | | /^ | _ | - - - - - - - - - * |___/____|_|_|_(_)_| Aaaaaeeeeeeeeeeeeeeeeee! / Specializing in conversations, E-Mail, obscure information, entertainment, the arts, politics, futurism, thoughtful discussion, insane speculation, and wild rumours. An ALL-TEXT BBS. "Raw data for raw minds."