\-=-=-=-=-=-=-=-=-=/
\ /
\ THE ART AND /
\ PRACTICE OF /
\ BLUE BOXING /
\ /
\=-=-=-=-=-=-=-=-=/
THIS IS THE TONE MATRIX FOR A BOX WHICH GENERATES TONES THAT OPERATORS USE
TO DIAL..ROTARY WORKS AS WELL, ON OPERATOR LINES, BUT THIS IS TECHNOLOGICAL!
NOW I AGREE WITH THE OPINION OF A WELL KNOWN PHREAK THAT 'BOXING' IS/WILL BE
FOR THE MOST PART DEAD, BUT THIS IS TRADITION... FIRST,YOU DIAL DIR.ASST, OR
AN OPER. ETC, THEN YOU BLAST THE LINE WITH A 2600HZ TONE. THIS GIVES YOU
THE LINE, THIS IS ALSO HOW MA BELL TRACKS DOWN BLUE BOXERS...THERE ARE 2600HZ
DETECTORS SYSTEMS, AND EVEN ON OLD #4 CROSSBARS... ONCE ON A OPER.TRUNK LINE,
YOU USE YOUR BLUE BOX/ROTARY TO DIAL...SO, IF YOU USE 2600HZ, WHICH IS
NECESSARY, UNLESS YOU ARE *VERY* CAREFUL, YOU WILL BE SNAGGED. FINALLY, THIS
IS WHAT YOU READ SO LONG AND HARD FOR:
USE KP TO START A CALL, AND ST TO STOP, WITH THE BELOVED 2600HZ TONE TO
DISCONNECT. I ALSO HEAR THAT 2600HZ RESETS SPRINT NODES AND GIVES YOU THEIR
INITIAL TONE ..NOW, IF YOU'RE WONDERING ABOUT WHAT TO CALL FROM AN OPERATOR
TRUNK, HERE ARE SOME GOODIES TO HELP YOU OUT:
XXX+101 - TOLL SWITCHING
XXX+121 - LOCAL OPERATOR
XXX+131 - INFORMATION
XXX+141 - RATE & ROUTE
XXX+181 - COIN REFUND OPERATOR
XXX+11501 - MOBILE OPERATOR
XXX+11521 - MOBILE OPERATOR
XXX+11511 - CONFERENCE OPERATOR
THESE WORK WITH ROTARY OR OPERATORS TONES, BUT ONLY ON OPER.TRUNK
LINES...THANKS FOR LISTENING!
BLUE BOXES, PART II
WHILE READING THE FINE ARTICLE ON THE BLUE BOX I SAW THAT HERE A LOT OF DATA
LEFT OUT OF THE DOCUMENT. I HOPE THIS ADDS, IN SOME SMALL WAY, TO THE
INFORMATION.
FIRST THE TONES. WHILE ALL THE INFORMATION IS CORRECT, THE TIMING SPECS WERE
NOT INCLUDED. THE TONE PAIRS ARE TO REMAIN ON FOR 1/10 SEC. WITH 1/10 SEC. OF
SLIENCE BETWEEN DIGITS. THE 'KP' TONES SHOULD BE SENT FOR 2/10 SEC. A WAY TO
DEFEAT THE 2600HZ TRAPS IS TO SEND ALONG WITH THE 2600HZ SOME PINK NOISE (MOST
OF THE ENERGY IN THIS SIGNAL SHOULD BE ABOVE 3000HZ, THIS SIGNAL WON'T MAKE IT
OVER THE TOLL NETWORK, BUT SHOULD CARRY AS FAR AS YOUR LOCAL TOLL CENTER) SO
THAT THE TRAPS WON'T FIND 'PURE' 2600HZ ON THE TRUNK. THIS IS NOT A PERFECTLY
SAFE WAY TO BOX, BUT IT SHOULD SLOW DOWN THE DISCOVERY. AS TO USE, THE FIRST
THING YOU NEED TO UNDERSTAND IS THAT THERE ARE TWO(2) TYPES OF TOLL COMPLETING
TRUNK, INWARD AND OUTWARD. THE NAMES ARE REFERENCE TO THE OFFICE THAT IS
SWITCHING THE CALL (THE TOLL CENTER THAT SERVES THE WATS LINE YOU CALLED) AND
EACH TYPE OF TRUNK HAS A DIFFERENT CLASS OF SERVICE. FROM AN INWARD TOLL
COMPLETING TRUNK, YOU CAN REACH THE DIFFERENT SERVICE OPERATORS, THE TOLL TEST
BOARD, AND THE INWARD OPERATOR. SOME OFFICES ALSO ALLOW REMOTE TESTING AND IT
IS IN THESE OFFICES THAT YOU CAN ACCESS THE OUTWARD TOLL COMPLETING TRUNKS. THE
OUTWARD TRUNKS ALLOW YOU TO MAKE VERIFICATION (EMERGENCY) CALLS, DO SERVICE
MONITORING (TAPPING), STACK TRUNKS (BUSY OUT ALL TRUNKS BETWEEN LA AND NYC),
ENABLE AND DISABLE TSPS POSITIONS, AND IN SOME CASES (ON SOME 4A'S) ISSUE
TEMPORARY REROUTING INSTRUCTIONS (SEND ALL CALLS FROM LA TO NYC VIA MIAMI,
BOSTON, OR ANY OTHERCLASS 5 OFFICE OR OFFICES). BOTH TYPE OF TRUNK ALLOW YOU TO
PLACE A 'STANDARD' CALL WITH A BOX.
IN SOME OFFICES, MOSTLY THE SMALL ONES WITH A TOLL TEST BOARD THAT IS
UNATTENDED AT NIGHT AND ON WEEKENDS, YOU CAN GET AN OUTWARD TOLL COMPLETING
TRUNK AS WELL AS PERFORMING OTHER TEST AND ROUTING FUNCTIONS. YOU DO THIS BY
USING THREE DIGIT CDES THAT ARE INVALID EXCHANGES (NOT OF THE PATTERN NNX [SEE
NOTE 1]). DURING THE SIXITES THE CODES USED WERE FAIRLY STANDARD AND
CONSISTENT, HOWEVER WHEN THE BOXES BECAME POPULAR AND THE PHREAKS STARTED DOING
THINGS LIKE ROUTING ALL CALLS FROM DALLAS TO FT. WORTH VIA WASHINGTON D.C.
MOTHER STARTED CHANGING THE TEST CODES ON A RANDOM (AS FAR AS I KNOW) BASIS.
WHAT I WOULD SUGGEST IS THAT EVERYBODY INTERESTED IN DOING THIS SORT OF THING
PICK OUT A NICE QUIET LITTLE OFFICE SOMEWHERE AND WORK ON DISCOVERING THE CODES
ACCEPTABLE TO THAT OFFICE. EACH NUMBERING PLAN AREA (NPA, ALSO KNOWN AS AREA
CODE) HAS AN OFFICE DESIIGNATED AS ITS MASTER OFFICE. THIS OFFICE CONTROLS ALL
OF THE OTHER TOLL OFFICES IN THE AREA AS WELL AS SERVING AS A CONCENTRATION
POINT FOR MOST OUT OF AREA CALLS. TO ACCESS THE SERVICES OF A NON-MASTER OFFICE
YOU NEED IT'S 'CITY CODE', THIS IS A THREE(3) DIGIT CODE THAT IS OF THE FORM
0XX, AND IS SENT AFTER THE AREA CODE [SEE NOTE 2]. AS AN EXAMPLE, THE 'CITY
CODE' FOR CANTON, OHIO IS 042; THUS TO REACH THE INWARD OPERATOR IN CANTON, YOU
WOULD SEND 'KP-216-042-121-ST' WHERE AS IF YOU WANTED THE INWARD OPERATOR IN
CLEVELAND, YOU WOULD SEND 'KP-216-121-ST'. THE REASON THIS IS NECESSARY IS THAT
THE OPERATOR IN CLEVELAND CAN'T VERIFY A NUMBER IN CANTON, SO IF YOU WANT TO
VERIFY SOMEONE IN CANTON YOU NEED THE CITY CODE. ALSO, MOST AREA MASTER OFFICES
HAVE DEDICATED DATA TRUNKS TO THE NETWORK CONTROL CENTER AND THUS DON'T ACCEPT
TEST AND REROUTING COMMANDS OVER THE SWITCHED NET-WORK. IN CONCLUSION, THE
SWITCHING NETWORK WILL DO A LOT MORE FOR YOU THEN CONNECT YOU TO PEOPLE AND THE
SMALL OFFICES THAT REQUIRE A 'CITY CODE' ARE THE TYPE OF OFFICE TO TRY TO BREAK.
NOTE 1: THE NORMAL FORMAT FOR TELEPHONE NUMBERS IS AS FOLLOWS: NYN/NNX-XXXX.
WHERE N=ANY DIGIT EXCEPT 1 AND 0; Y=0 OR 1, AND X=ANY DIGIT. YES I KNOW THAT IN
SOME AREA CODES THE NNX FORMAT HAS CHANGED TO NXX. THIS IS A NEW OCCURRENCE AND
ONLY OCCUR WHERE THERE HAS BE AN OUTRAGEOUS POPULATION INCREASE IN THE LAST FEW
YEARS AND ALL OF THE FUNNY EXCHANGES ARE CONNECTED DIRECTLY TO MASTER OFFICES
AND THUS DON'T CONFLICT WITH THE 'CITY CODE' FORMAT.
NOTE 2: YOU CAN OBTAIN THE 'CITY CODE' FOR A NUMBER BY CALLING RATE AND ROUTE
AND ASKING FOR THE 'NUMBERS ROUTE' TO NYN/NNX (I.E. 914/725). OR IF YOU LEAVE
ME A MESSAGE WITH THE AREA CODE AND FIRST THREE OF A NUMBER, I WILL GET YOU THE
'CITY CODE'.
THIS BULLETIN WILL DEAL ONLY WITH THE BASIC CONTRUCTION, TROUBLESHOOTING AND
ADJUSTMENT OF THE BLUE BOX. IF YOU WOULD LIKE TO KNOW THE SPECIFIC JOB OF ANY
PART IN THE CIRCUIT JUST WRITE ME A MSG AND I WILL BE GLAD TO ANSWER IT.
WE ALL KNOW THAT THE TOUCH TONES FREQUENCIES ARE COMPOSED OF TWO TONES (TWO
DIFFERENT FREQS.) SO THAT IS THE REASON WHY WE HAVE 2 VCO'S ( VOLTAGE CONTROLLED
OSCILATORS). WE WILL CALL THESE VCO#1 AND VCO#2. IF YOU HAVE NOTICED VCO#1 ANS
VCO#2 ARE EXACTLY THE SAME TYPE OF CIRCUITS. THAT IS WHY ONLY ONE WAS DRAWN.
BUT REMEMBER THAT WHATEVER GOES FOR VCO#1 ALSO GOES FOR VCO#2. BOTH VCO'S ARE
COMPOSED OF A HANDFULL OF PARTS. ONE CHIP TWO CAPACITORS 2 RESISTORS AND FIVE
POTENTIOMETERS. ALL OF THIS WILL GIVE YOU (WHEN PROPERLY CALIBRATED) ONE OF THE
FREQS. NECESSARY (THE OTHER ONE WILL COME FROM VCO#2) FOR THE OPERATION OF THE
BB. BOTH OF THESE FREQS. WILL BE MIXED IN THE SPEAKER THUS FORMING THE
REQUIRED TONE.
THIS IS ONE OF THE MOST SOPHISTICATED DESIGNS I HAVE EVER MADE. WHY? BECAUSE
OTHER DESIGNS WILL DRAIN THE BATTERY AFTER 10 CALLS! THIS DESIGN WILL MAKE THEM
LAST 10 MONTHS!!!!!!. BUT NEVER THE LESS DON'T FORGET TO PUT IN A SWITCH FOR ON
AND OFF. OK LET'S BUILD THE TWO VCO'S AND CALIBRATE THE UNIT BEFORE WE GET TO
THE KEYBOARD CONTRUCTION.
VCO CONTRUCTION
=== ===========
TOOLS REQUIRED
1 OCILLISCOPE (RECOMENDED BUT NOT REQUIRED)
1 FREQ. COUNTER (REQUIRED)
1 VOLT METER " " "
ELECTRONICS TOOLS (PLIERS,DRILL, SCREWDRIVERS, ETC)
PARTS
R1 1.5K RESISTOR 5%
R2 1K RESISTOR 5%
C1 .1UF ELECTROLYTIC CAPACITOR 16VDC
C2 .01UF ELECTROLYTIC CAPACITOR (MYLAR) 16VDC
IC1 2207 VCO CHIP BY EXAR ELECTRINICS
REMEMBER THE ABOVE IT IS ONLY FOR VCO#1 BUT THE SAME GOES FOR VCO#2.
R3-R4 150 OHM RESISTORS 5%
C3-C4 .1 UF ELECTROLITIC CAPACITOR 10VDC
P1-P10 200K TRIMMER POT - 20 TURNS
DIODES USED IN THE KEYBOARD ARE 1N914 TYPE (40 OF THEM)
AND 13 SWITCHES FOR THE KEYBOARD SPST. MOMENTARY.
SPKR= YOU CAN USE A TELEPHONE SPEAKER FOR THIS(IT WORKS BEST)
BUT REMEMBER TO TAKE OUT THE DIODE THAT IS CONNECTED ACCROSS IT.
1. DO NOT USE ANYTHING ELSE THAN A MYLAR CAPACITOR FOR C2
2. PINS 10,9,8 SHOULD BE TIED TOGETHER AND BE LEFT FLOATING.
3. ALL RESISTOR SHOULD BE 5%! NOTHING ELSE
4. A TELEPHONE SPEAKER GIVES THE BEST RESULTS
BY NOW YOU SHOULD HAVE CONSTRUCTED THE TWO VCO'S ON A BREAD BOARD OR ANYTHING
THAT PLEASES YOU.
CHECK FOR COLD SOLDER JOINTS, BROKEN WIRES, POLARITY OF THE BATTERY, ETC......
..
BEFORE WE APPLY POWER TO THE VCO'S WE HAVE TO ADJUST THE POTS FOR THEIR HALF W
AY TRAVEL POINT. THIS IS DONE BY TURNING THEM 21 TURNS TO THE RIGHT AND THEN 10
TURNS TO THE LEFT. DO THE SAME FOR ALL TEN OF THEM.
NOW APPLY POWER TO THE UNIT CHECK TO SEE THAT YOU HAVE POWER IN THE CHIPS BY P
UTTING THE POSITIVE LEAD OF YOUR VOLT METER ON PIN 7 AND THE NEGATIVE LEAD ON PI
N 12. IF YOU DON'T HAVE ANYTHING THERE TURN OFF THE UNIT ANT RECHECK THE WIRING.
WHEN YOU GET TE RIGHT VOLTAGES ON THE CHIPS, CONNECT A DIODE TO A PIECE OF WIR
E (LOOK AT FIG. 2 FOR THE ORIENTATION OF THE DIODE) FROM GROUND TO ANY POT AT PO
INT T (LOOK CAREFULLY AT THE SCHEMATIC FOR POINT T IT IS LABELED T1-T10 FOR ALL
POTS) YOU SHOLD BE ABLE TO HEAR A TONE, IF NOT DISSCONNECT THE LEAD AND PLACE TH
E SPEAKER CLOSE TO YOUR EAR AND IF YOU HEAR A CHIRP LIKE SOUND, THIS MEANS THAT
THE TWO VCO'S ARE WORKING IF YOU DON'T, IT MEANS THAT EITHER ONE OR BOTH OF THE
VCO'S IS DEAD. SO IN THIS CASE IT IS ALLWAYS GOOD TO HAVE AN OCILLOSCOPE ON HAN
D.
DISCONNECT THE SPEAKER FROM THE CIRCUIT AND HOOKUP THE OCILLISCOPE TO ONE OF T
HE LEADS OF THE SPEAKER AND THE GROUND FROM THE SCOPE TO THE GROUND OF THE BATTE
RY. CONNECT AGAIN THE GROUND LEAD WITH THE DIODE CONNECTED TO IT FROM GROUND TO
ANY POT ON THE VCO THAT YOU ARE CHECKING AND YOU SHOULD SEE A TRIANGLE WAVE IF
NOT TURN THE POT IN WICH YOU ARE APPLYING THE GROUND TO UNTIL YOU SEE IT. WHEN Y
OU DO SEE IT DO THE THE SAME FOR THE OTHER VCO TO MAKE SURE IT IS WORKING. (AMPL
ITUDE IS ABOUT 2VAC)
WHEN YOU GET THE TWO VCO'S WORKING YOU ARE SET FOR THE ADJUSTMENT OF THE INDIV
IDUALS POTS...
ADJUSTMENT
DISCONNECT THE SPEAKER FROM THE CIRCUIT AND CONNECT A FREQ. COUNTER (THE POSI
TIVE LEAD OF THE COUNTER TO ONE OF THE SPEAKERS LEADS THAT BELONGS TO VCO#1 OR C
ONNECT IT TO PIN 14).
CONNECT THE NEGATIVE LEAD TO THE BATTERY NEGATIVE AND CONNECT THE JUMPER LEAD
WITH THE DIODE FROM GROUND TO POT NUMBER 1 T1 .( THE FIRST POT NUMBER 1 POINT T1
) IF YOU GOT IT WORKING YOU SHOULD HEAR A TONE AND GET A READING ON THECOUNTER.
ADJUST THE POT FOR A FREQ. OF 1700HZ AND CONTINUE DOING THE SAME FOR POTS 2-5 E
XCEPT THAT THEY GET DIFFERENTS FREQS.
NOW DISCONNECT THE FREQ. COUNTER FROM THE SPEAKER LEAD OF VCO#1 OR FROM PIN 14
(WHICH EVER YOU HAD IT ATTACHED TO AT THE BEGINNING) AND CONNECT IT TO THE SPAK
ER LEAD OF VCO#2 OR TO PIN 14 OF VCO#2 AND PERFORM THE SAME ADJUSTMENTS TO P6-10
WHEN YOU FINISH DOING ALL OF THE POT GO BACK AND RECHECK THEM AGAIN.
KEYBOARD
IF YOU LOOK AT FIG-2 YOU WILL SEE THAT THE KEYS ARE SIMPLE SWITCHES CONNECTED
TO GROUND AND TWO DIODES ON THE OTHER END. THESE DIODES ARE USED TO SIMPLIFY THE
CONSTRUCTION OF THE KEYBOARD BECAUSE OTHERWISE THE DISTRIBUTION OF THE GROUND S
IGNAL FOR BOTH VCO'S WOULD HAVE BEEN DONE MECHANICALLY. ONE DIODE WILL GO TO VC
O#1 AND THE OTHER WILL GO TO VCO#2. FIG-3 SHOWS THE ARRANGEMENT OF THE KEYS ON T
HE KEYBOARD.
BELOW IS A TABLE THAT WILL HELP YOU CONNECT THE KEYS TO REQUIRED VCO'S POTS.
TO TO FREQ OUT FREQ OUT
KEY POT ON VCO1 POT ON VCO 2 PIN 14 VCO1 PIN 14 VCO
AS A FINAL WORD YOU CAN BUILD THIS IN ANY TYPE OF ENCLOSURE AND SHOULD NEVER
BE USED TO MAKE FREE CALLS USING THE TELEPHONE LINES. I HOPE THIS BULLETIN WILL
CLEAR ANY QUESTION YOU MAYHAD ON THE BLUE BOXES. IF YOU HAVE ANY QUESTION PLEASE
LEAVE ME A MSG. AND I WILL BE VERY GLAD TO ANSWER IT.
