TUCoPS :: Phreaking Public Phones :: craserv.txt

The CRASERV file



                        -= The craserv file =-

                           <<------------>>

                         Written by Slip-n0t




Table of Contents
  Disclaimer  <-  Important, read this
  Intro, Millennium Phones
  What is 'craserv'?
  How do I use it?
  Prompts, displays and menus
    Main display
    "Enter PIN" prompt
    "Enter op code" prompt
    "Open terminal" prompt
    Other prompts and displays
  PINs
  Op codes
  Conclusion



DISCLAIMER
  <legal_bullshit>  This file is meant for information purposes only, 
tooling around with your local payphones probably won't have the owners of 
such phones and local law enforcement looking at you in a very good way.  I 
don't suggest that you try the things in this file, and if you do and you 
get caught it is not my fault. </legal_bullshit>

INTRO
  If you are living in North America and are interested in telephony then 
the chances are that you have seen, or at least heard of the new Millennium 
phones from Nortel.  These are the nice shiny Polished aluminum payphones, 
with scrolling LCD displays, and a bright yellow/orange card reader.  They 
come in a few different flavors, card-reader only (these have no coin slots 
and do not accept cash), and the standard Universal phones which will accept 
both cash and card payment.  This file will not delve too deeply into all 
aspects of the Millennium phones features and security as there are a few 
great files out there (easily found at www.hackcanada.com) which have 
already covered this topic much better than I could.  I would highly suggest 
these files as a prerequisite reading to this file.

WHAT IS 'CRASERV'?
  'Craserv' is a command that allows a telco technician (or some punk kid 
with too much information) to access a menu from where op codes can be 
entered.  Craserv is 2727378, there are rumored to be more command codes 
like it (read the recommended files) but some say that they are no longer 
working.  In the earlier files 2727378 was said to have been a rumored, and 
untested code.  Well I have tested it in the 604 area code and it does work.

HOW DO I USE IT?
  To use craserv you must approach a Millennium phone and type 2727378 on 
the keypad while the phone is _hung_up_.  If you have done this correctly 
you should see the "enter PIN" screen.


PROMPTS, DISPLAYS AND MENUS

MAIN DISPLAY
  The displays on the phones are two rows of LCD screens, each with spaces 
for 20 characters across, using a 5-wide by 7-high font.  The normal display 
will be something like:
" Please enter $0.25 "   Followed by a scrolling line of text which will 
probably contain the time, date, and a gay little message from the telco 
that owns the phone.

"Enter PIN" PROMPT
  If you have just typed in 2727378 then you should be prompted with a 
screen that says:
"Enter PIN: [][][][][]"
"FIX=<>,SAVE=*,STOP=#"
  Now you can type in a 5 digit PIN code.  (More info on this later)

"Enter op code" PROMPT
  If you have just visited the PIN screen and entered a valid PIN then you 
should be greeted with a screen that looks very similar to this:
"Enter op code: [][][]"
"FIX=<>,SAVE=*,STOP=#"
  Now you can type in a 3 digit op code.  (More info on this later)

"Open terminal" PROMPT
  If you entered a valid PIN that didn't prompt you for an op code then the 
chances are that you will be prompted with a screen saying something like 
this:
"Please use key to open terminal"
  I am not exactly sure of what this does, other files have claimed that 
when you enter this code there is a motor noise, leading them to believe 
that some internal lock has been de-activated with this code.  I however 
have not heard any noises any of the many times that I have entered one of 
these codes.  I believe that when it says "open terminal" it means for you 
to open the top part of the phone that gives you access to the ports inside. 
  And if you have read the other files you will know that all the phones are 
equipped with alarms to deter tampering.  My educated guess is that this 
code does not do anything physical, but it temporarily deactivates the 
internal alarm so that a service technician can open the phone without 
having an alarm blare in his ear.  (More info on "open codes" later)

OTHER PROMPTS AND DISPLAYS
  If you enter an invalid PIN from the "Enter PIN" menu you will see:
"Invalid PIN access denied"
and you will be promptly booted out of the craserv menus back to the "main 
display"
  If you enter an invalid op code from the "enter op code" menu it will say:
"not a valid op code, please try again"
then there will be a short pause, after which you will return to the "enter 
op code" menu.
  If you have already entered 8 valid op codes and you try to enter a 9th 
you will see:
"Maximum of 8 codes, last code not saved"
after a few seconds you will be dropped back to the "main display"

PINs
  Now, for all I know both PINs and op codes may be regionally different, so 
unless you live in the 604 area code this may be of little use to you.  
Sorry, but you will just have to wait until someone from your area gets off 
their ass to write a file.
  After you have entered 'craserv' you will see the "Enter PIN" prompt.  PIN 
codes are 5 digits long and from what I have discovered they follow a easy 
pattern.

Range of codes         Function of codes.
00000-39999            'Enter op code'
40000-79999            'Open terminal'
80000-99999            'Invalid PIN, access denied'

  There are likely a few codes hidden within there that do not fit this nice 
little pattern, but hopefully they will do something special, so you will be 
glad to find it, not upset.  I obviously don't have the time to test all
100,000 possible PINs to see what they do, but the pattern seems to be
pretty solid, I don't think that I have found an oddball that doesn't fit in
it yet.

OP CODES
  As was stated earlier I am not sure if op codes are hard-wired into the 
phones circuitry, in which case they would be universal, or if they are 
programmable regionally.  In previous files there have been rumored op 
codes.  I have tried them on phones in my area but to little avail.  This 
leads me to believe that the op codes are programmable regionally.
  I have tried random codes with little success, but have discovered that 
all op codes that start with 9 give the "Not a valid op code, please try 
again" display.

  These are the codes that have been displayed in earlier files.  (Thanks to 
Syko416 and twiggy)

267 # Answer detect
274 # Display brightness control (down?)
277 # Display brightness control (up?)
349 # Unknown - Someone know this one?
636 # Memory Access
688 # Unknown - Possibly the "Out of Service" message
66666 # Motor sound, prompts to open phone - Probably coin removal
996 # "Error has occurred"

  As far as I know none of these codes work in my area.  66666 is a PIN and 
it fits in with my theory because it gives the open terminal command.  996 
and any other op code that starts with 9 will say "not valid". I think that 
there may be a code that will give you a test line, so that technicians can 
test the phone even if they don't have any coins.
  When you punch in a 3 digit op code and press * it will save the op code.  
You can enter in up to 8 codes, if you try to enter a 9th code it will tell 
you "Maximum of 8 codes, last code not saved".  After this it will put you 
back on the main screen.  If you use craserv again and enter a PIN you will 
(as expected) be asked for an op code, however if you try to enter an op 
code you will get the "max 8 codes" message again.  After a few tries you 
will be able to enter op codes once again.  On one certain occasion while 
waiting for a bus I entered in a few op codes, and when I tried to enter 
more I kept getting the max * codes message.  I kept trying to enter codes 
for a good 10-15 tries but it still would not let me.

CONCLUSION
  There are quite a few things that should be possible to do using craserv, 
but it will take a lot of time to try them all out using brute force.  If 
anyone manages to "acquire" an official manual on these phones please do us 
all a favor and post it somewhere easily accessible.  I hope that this file 
was informative to you all, if you come up with any new developments make a 
file of your own.


Special thanks to SPLurge, D0t, the #2600ca crew, Hack Canada and all the 
others who have done previous research on the Nortel Millennium Phones


10/18/1999

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH