:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: D
:::::::::::::::::::: :::: ::: ::: ::::: :::: E
::::::: ---- ::::::::::: :::::::: :::::::: :: :::: :::::::: C
:::::: / :::::::::::::: ::::: :::::::: : :::: :::::: O
::::: / mprovised:::::: ::::: ::::::: : : ::: :::::::::: D
:::: ---- :::::::::::: ::::::: ::::::: :: :: :: :::::::::: I
::::::::::::::::::: :::::::::: ::::: :::::::: :: :::::::::: N
:::16-Nov-93:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: G
by
o l e B u z z a r d
INTRODUCTION
DTMF stands for Dual Tone/Mutli-Frequency and it is the process by which
TouchTone(c) phones operate. When a button is it on a TouchTone(c) phone a
dual tone is created each of which generates a unique frequency. Combined
these tones equal 2600Hz.
Now, it is important to note that this file as very little to do with the
workings of DTMF and nothing to do with frequency manipulation. I ask you to
keep this in mind if you see an error in statements made regarding DTMF.
DTMF in and of itself is not relevant to this file.
DTMF DECODING
Most people outside the phreaking world never think about decoding a DTMF
number if for no other reason than that they usually know what number they
dial. But within the phreaking world the ability to decode a DTMF tone can
be a phreaker's greatest tool. Often in my travels I have heard DTMF tones
blurp out at 38ms or less interval spacing (very fast dialing) and just knew
it was the number to the God of GODs. Just ask yourelf how many times either
while just doing phun stuph or even just watching television (like CNN's
Future Watch) you heard a number dialed. Wouldn't it have been kk0ol to have
known what that number was. (<- Note the period because that was a
rhetorical question.) Well thats what DTMF Decoding is all about.
Now DTMF Decoding is nothing new. In fact HAM Radio users do it all the time
because DTMF are often broadcast over the radio-waves. I mention this
because where theres a demand theres a supply. Heres a couple consumer DTMF
decoders available mail order.
[ Taken from Monitoring Times Vol.12 No.10 Oct-93 ]
----------------------------------------------------------------------------
OPTOELECTRONICS | MOTRON ELECTRONICS
5821 NE 14th Avenue | 310 Garfield Street Suite 4
Ft. Laud., FL 33334 | Eugene, OR 97402
|
DYNAMIC DUO--FM Intercept, Detect, | Tone-Master TM-16 and TM-16 Plus
Decode Tones...CTCSS, [ DTMF ], and DCS |
| The TONE-MASTER Line of Hande Held
The R10 is a unique FM Communications | Tone Dedcoder Display Products.
Test Receiver with security and | Decode Touch-Tones from a phone,
surveillance applications. The R10's | scanner, tape recorder, or nearly
full spectrum audio output interfaces | any audio source.
directly with the DC440 to monitor |
CTCSS, and [ DTMF ], FM Deviations |
and Relative Signal Strength |
|
Optoelectronics Advantages | Tone-Master Line
1. Decode & Display CTCSS, DTMF or DCS | 1. 16 Digit LCD Display with 80
& DTMF simultaneously. | character scrollable memory.
2. 127 Character DTMF Buffer with | 2. Portable 9-volt battery or ext.
scrollable 10 Character Display. | power operation.
No Lost Data | 3. Completely stand-alone. No
3. LCD Display, visible in bright light | computer necessary.
4. Serial Computer Interface | 4. Metal enclosure w/built-in
5. Activity Indicator--lets operator | monitor speaker. Only 2.75"
see when unit is activley decoding. | x 6.1" x 1.2"
6. High Quality NiCad Battery pack | 5. TM-16+ includes RS-232 output
option. | and software for automatic
7. Actual DTMF Characters Displayed! | date/time/number logging w/Comp
|
Package Price: $549 | Price: TM-16 $169 TM-16+ $239
----------------------------------------------------------------------------
Notice anything? Yes thats it....go ahead and say it... 'They both cost
money.' Actually, the Tone-Master TM-16 is not a bad deal at all. It would
be great for field phreaking. But lets assume you're not going to be 'tin
canning' on a regular basis and you would just like to be able to decode a
tone every now and then when you're phreakin around. Well the TM-16 would
still be a good deal, but in case you don't have the extra $170 bucks, I
will show you how you can do it for free.
IMPROVISED DTMF DECODING
Through the wonder of Automatic Number Identification (ANI) anyone can
decode DTMF tones easily and (more importantly) without cost. How it works
is this: Nowadays the phone line are run over-roughshod with Voice Mail
Boxes (VMBs). These VMBs, while worthwhile, and very fun to hack, can serve
another purpose. They can decode DTMF tones for us! Now VMBs are not all a
like. There are many VMB systems such as Audix, Aspen, and ROLM to name a
few. For the purpose of this file we will be focusing on Merridian VMBs.
The Merridian proves very useful for the purpose of improvised DTMF Decoding
because Merridians utilize ANI technology to provide verbal feedback to VMB
selections. What happens is this: when you call a Merridian it will ask you
which mailbox you wish to leave a message at. You then enter a box number.
The Merridian will indentify the box number you entered and tell you whether
or not the box is valid. By doing so the system has decoded the DTMF. Used
as just described constitutes intended use. For use as Improvised DTMF
Decoder follow the following (what?)
1. Record desired DTMF tones. These are the tones you recorded
while out 'tin canning'.
2. Call a Merridian VMB [1-800-946-8888]
* NOTE * This is the number to a real-live investment firm
(IDS - Investment Diversified Services). What does this mean?
Well it means that if you call them during business hours you
will talk to a real-live person. Call after 6:00pm CST to get
the VMB. (Lighten up...no one phreaks during the day any how.)
3. Bypass the outgoing message by hitting 0 + 3 and then 1
* NOTE * Now I don't know if hitting those keys works for all
Merridians or not, but I do know its not that hard to stop an
outgoing message. For more info on Merridians contact Video
Vindicator at <
[email protected]>
4. You will hear a message that says:
'Express Messaging...to mailbox?'
At this point play the recorded DTMF tones *LOUDLY* into the
handset.
* NOTE * A real preak would have some sort of 'Box' to play the
tones directly into the phone line.
5. After tones have been played press the Pound (#) Key. You will
hear a message which says either:
'There is no box number at xxx, please try again.'
Or,
'Mailbox xxx, please leave a message after the tone.'
In either case the DTMF is decoded (yeah.)
* NOTE * This method of improvised DTMF decoding can be
achieved on other systsems which utilize ANI such as AT&T
VoiceMessaging(c). I have chosen Merridian VMBs as ideal
because they allow tone string of up to 255 NUMBERS!!!
^^^
DTMF'IN
To aid in your DTMF Decoding theres a couple of things you should probably
have.
1. A Tape Recorder, preferably a small one, but any tape recorder with an
in-shape recording head will do.
2. A Microphone. I recommend Radio Shack Model 44533 Telephone Pick-Up Mic..
$4.19
3. Tones to decode. Heres a little list of DTMF ToucTone sources
a. 'Tin-Canning' You know the big, green things that say USWest.
b. CNN's Future Watch (5:00pm Sundays EST)
c. Movies (there were all kinds of DTMF tones in WarGames).
d. Surveillance. (see 'Tin-Canning'
DTMF NUMERIC CORRESPONDENT
Heres a little DTMF/Number conversion list I'm throwing in to make my file
look more legitimate. It as no real value to this file other than to make
me look good..(better). Have Phun!! oB
697Hz + 1209Hz -> 1 770Hz + 1209Hz -> 4
697Hz + 1336Hz -> 2 770Hz + 1336Hz -> 5
697Hz + 1477Hz -> 3 770Hz + 1477Hz -> 6
852Hz + 1209Hz -> 7 941Hz + 1209Hz -> *
852Hz + 1336Hz -> 8 941Hz + 1336Hz -> 0
852Hz + 1477Hz -> 9 941Hz + 1447Hz -> #
Shout outs to: Nobody (at oB's), Disorder (at Flatline), and all my users at...
--------------------------------------------------------------------------------
oleBuzzard's kn0wledge phreak % sUmthyn lykE 4000+ text fylez % C.R.a.P.N.
AC 3o3.447.89o6--NUP = NO NUP % hAck/phrEAk/AnArky/vIrII/cArd % Call Right
24oo-14.4ooKiloBaud-Open 24/7 % n0 phUckyn lAmEr wArEz do0dz! % Phuckn Now
--------------------------------------------------------------------------------
