*** Solid State Silver Boxes ***

Ma Bell is not the only one with standards! Just about every
manufacturer of IC's that generate touch tones has also gone by the 16
key (8 tone) standard for Touch Tone pads. And it is even easier to
convert a tone pad that uses an integrated circuit to generate the tones
than converting a Ma Bell pad!

It will help immensely if you have the schematic for the pad in
question, or at least the pin-out diagram of the chip being used.
Pin-outs can usually be obtained from the manufacturer or from an ECG,
SK, GE or similiar semiconducter handbook (provided that manufacturer
makes an equivalent for the chip in your pad). I'll use the Radio Shack
CEX-4000 tone pad module for an example, even though it is probably
almost the lousiest one you can buy, it is fairly typical and easily
available.

Take a look at the diagram or the pin-out of the chip. You should see
two groups of pins, the rows tone pins and the column tone pins. These
will be marked as R1,R2,R3,R4 and C1,C2,C3 (Radio Shack) or or X1,X2,X3
and Y1,Y2,Y3 etc. on others. At any rate, you should be able to
distinguish which three pins control the columns and which four control
the rows. If you're lucky, each group of rows and columns will be
contiguous. Now look at the column pins, and you'll probably see an
empty pin right next to them. This is the column pin for the 1633 hz
tones. These chips usually achieve their switching by connecting a row
pin with a column pin (that way they can use a very simple keyboard pad,
unlike Ma Bell's complicated one). So all you have to do is take a SPDT
switch and a few pieces of wire, cut the trace going the column 3 pin of
the chip, attach a wire from the chip side of that cut to one end of the
SPDT switch, a wire from the other side of the cut to the center of the
SPDT switch, and finally, from the remaining contact on the SPDT switch,
hook a wire to the previously identified pin C4 (Column 4). Now you have
a "bank switching arrangement exactly like the one described in the
previous bulletin for modifying a Ma Bell pad. If you can't get the
schematics or the pin outs for your chip, don't despair. There is still
hope for you!  You just have to track the connections going from the
pad's keys to the chip. Chances are you'll find that each row has a
common trace, and so does each column (for those non-technical folks, a
trace is a connection etched out on a circuit board). Just follow these
to the chip, and make your own schematic up. Now take a look for that
extra pin-- there should be one floating around right next to the column
pins. It will be not be hooked up to anything else, that is, "hanging
free". Drill a hole in the side of tonepad's case, and mount your
switch. Radio Shack sells a nice microminiature switch that works
excellently! (almost the only good thing I can say about Radio Shack in
this article)

    Happy Phreaking.....
      Phincerely yours, Number Six.

This bulletin describes how to take a standard touch tone keypad and
convert it to a portable unit. In addition, I give the touch tone
frequencies.

First of all, the tones generated by a standard touch tone keypad (like
one on a standard telephone) are not single tones, but a combination of
two tones for each key pressed. Standard keypads normally generate 12
tone combinations [NOTE: actually, they are capable of generating 16
combinations, but normally do not have the extra 4 keys required. For
more info on this, see the bulletin on silver boxes].

The power required by a keypad is about 25 volts, but they will work
with as little as 15, thereby allowing the use of two 9-volt radio
batteries. As you may have guessed, they are also designed to operate
with a telephone type speaker (and phone line), and not the standard
8-ohm speaker which needs to be used for adequate volume. To accompolish
this, we use a matching transformer, this is one of those miniature ones
available at Radio Shack. Enough of the theory, now for the circuit.

You will need:

A touch tone keypad, A miniature 1000 to 8 ohm transformer (Radio Shack
# 273-1380), A standard 8-ohm speaker, Two 9-volt radio batteries, Two
9-volt battery clips, A case to put it all in (optional)

A few construction notes, I suggest that you solder and tape all
connections. It is also important to read this entire bulletin before
attempting to construct this.

First, connect the RED wire of the transformer to either terminal on the
speaker. Now connect the WHITE wire from the transformer to the other
terminal on the speaker. Next, connect the RED (positive) wire of one
battery clip to the black wire of the other battery clip. Now connect
the the remaining RED wire on the second battery clip to the GREEN wire
from the touch tone pad. Connect the BLUE wire from the touch tone pad
to the ORANGE-and-BLACK striped wire from the touch tone pad. To these
two wires, now connect the remaining black lead from first battery clip.
You have now finished the power connection to the keypad. Connect the
BLACK wire from the keypad to the BLUE wire on the transformer. Next
connect the RED-and-GREEN striped wire from the keypad to the GREEN wire
on the transformer. The BLACK wire on the transformer should not be
connected to anything, along with quite a few wires from the keypad. The
connection of the keypad is now complete. All you have to do is connect
two nine volt batteries to the battery clips, and you'll be ready to go.
You may want to mount it in a case of or easy portability. Note that the
silver box modification CAN be made to this unit, allowing complete
remote phreaking. When none of the buttons are pressed, this unit uses
NO power, thereby eliminating the need for a power switch, and extending
the life of the batteries.

The following are the frequency combinations generated by each button on
the keypad.

KEY     FREQ. #1        FREQ. #2
---     --------        --------
#       941             1477
*       941             1209
0       941             1336
1       697             1209
2       697             1336
3       697             1477
4       770             1209
5       770             1336
6       770             1477
7       852             1209
8       852             1336
9       852             1477
A       697             1633
B       770             1633
C       852             1633
D       941             1633

All frequencies are measured in Hertz Note that A,B,C and D are not
normally present (except for silver boxes)

That's all for now, leave all questions, comments, etc. in a message to me.

                                  DATA PHONE
                                  **********