/===================================v==============v==========================\
| White and Silver Boxes | SILVERBX.TXT | from Elric of Imrryr |
| Lunatic Laboratories Unltd. | | Official Document |
\===================================^==============^==========================/
WHITE BOX PLANS
This article will tell you how to take a perfectly normal touch tone keypad
and convert it into a portable unit, allowing remote phreaking.
First of all, the tones made by a touchtone telephone are not single tones,
they are a combination of two different tones, making "DTMF" (Dual Tone Multi-
Frequency). The normal tone telephone dials 12 different signals, but is capa-
ble of dialling 16 different signals (see silver boxes.)
The power required by a keypad is about 25 volts, but they will work with as
little as 15, thereby allowing the use of two 9-volt radio batteries. As you
may have guessed, they are designed to operate with a telephone type speaker
(and phone line), and not the standard 8-ohm speaker which needs to be used for
adequate volume. To accomplish this, we use a matching transformer, one of
those miniature ones available from Radio Shack. Enough of the theory, now for
the circuit.
You will need:
A touchtone keypad
A miniature 1000 to 8 ohm transformer (Radio Shack #273-1380)
A standard 8-ohm speaker
Two 9-volt batteries
Two 9-volt battery clips
A case to put it all in (optional)
A few construction notes- I suggest that you solder and tape all connections.
It is also important to read this entire file before attempting to construct
this.
First, connect the red wire of the transformer to either terminal on the speak-
er. Now connect the white wire from the transformer to the other terminal on
the speaker. Next, connect the red (positive) wire of one battery clip to the
black wire of the other battery clip. Now connect the remaining red wire on
the second battery clip to the green wire from the touchtone pad. Connect the
blue wire from the touchtone pad to the orange-and-black striped wire from the
touchtone pad. To these two wires, now connect the remaining black lead from
the first battery clip. You now have finished the power connection to the
keypad.
Connect the black wire from the keypad to the blue wire on the transformer.
Next connect the red-and-green striped wire from the keypad to the green wire
on the transformer. The black wire on the transformer should be unconnected,
along with quite a few other wires from the keypad. The connection of the
keypad is now complete.
All you have to do is connect two nine volt batteries to the battery clips,
and you'll be ready to go. I suggest that you stick the mess in a case for
easy portability.
Note that the silver box modification can be made to this unit, allowing com-
plete remote phreaking (this unit is called a grey box). When none of the
buttons are pressed, this unit uses no power, eliminating the need of a power
switch, and extending the life of the batteries.
Dual-Tone Multi-Frequency (Touch-Tone) Frequencies
Key Freq. #1 Freq. #2 [] Key Freq. #1 Freq. #2
--- -------- -------- [] --- -------- --------
1 697 1209 [] 4 770 1209
2 697 1336 [] 5 770 1336
3 697 1477 [] 6 770 1477
A 697 1633 [] B 770 1633
7 852 1209 [] * 941 1209
8 852 1336 [] 0 941 1336
9 852 1477 [] # 941 1477
C 852 1633 [] D 941 1633
Note: A, B, C, and D are the special frequencies generated by silver boxes.
HOW TO TURN YOUR TOUCH-TONE FONE INTO A SILVER BOX
Tools and Materials: Soldering iron, some solder, some 22 Ga. wire, an SPDT
switch, and a screwdriver.
1> Unscrew your phone (it must be a touch tone, desk type).
2> Remove the mounted pad and take the clear plastic cover from the bottom.
3> Hold the pad with the numbers *, 0, and # facing you, and turn it upside
down so you can see the yellow PC board. You should see 2 round black
doughnuts.
4> Position the board so the solder points for the left doughnut face you.
5> Count over 4 points from the left and attach a (GREEN) wire to that
point.
6> Between you and the doughnuts, there should be 2 long yellow capacitors.
To the right of these, and on the edge of the board there should be 3 gold con-
tacts. We will use the one on the left.
7> The contact originally is spot welded, so snip it open.
8> To the one nearest you, attach a (RED) wire, to the other one, a (YEL-
LOW) wire.
9> Run the wires out of the phone, and solder the switch.
10> The orientation should be (RED) to center. The switch will now alter-
nate between normal and 1633Hz fourth column tones.
From BIOC Agent 003's Course in Basic Telecommunications: Part V
Dual Tone Multi Frequency (DTMF) is a modern day improvement on pulse dial-
ing in several ways. First of all, it is more convenient for the user since it
is faster and can be used for signalling after the call is completed (ie SCC's,
computers, etc.). Also, it is more up to par with modern day switching equip-
ment (such as ESS) since pulse dialing was designed actually to move relays by
the number of digits dialed (in SXS offices).
Each key on a DTMF keypad produces 2 frequencies simultaneously (one from
the high group and another from the low group).
-------------------------------------------------
LOW GROUP | Q | ABC | DEF | |
697 Hz -| 1 | 2 | 3 | A |
|-----------|-----------|-----------|-----------|
| GHI | JKL | MNO | |
770 Hz -| 4 | 5 | 6 | B |
|-----------|-----------|-----------|-----------|
| PRS | TUV | WXY | |
{ 852 Hz -| 7 | 8 | 9 | C |
|-----------|-----------|-----------|-----------|
| | OPERATOR | | |
941 Hz -| * | 0 | # | D |
|-----------|-----------|-----------|-----------|
HIGH GROUP 1209 Hz 1336 Hz 1477 Hz 1633 Hz
A portable NORMAL DTMF keypad is known as a white box; a touch-tone fone
converted for use of 1633 Hz is known as a silver box; a portable FULL touch-
tone keypad is known as a grey box.
The fourth column (1633 Hz) is not normally found on regular fones but it
does have several special uses. For one, it is used to designate the priority
of calls on Autovon, the military fone network. These keys are called: Flash,
Immediate, Priority, and Routine (with variations) instead of ABCD. Secondly,
these keys are used for testing purposes by the Telco. In some areas you can
find loops as well as other neat tests (see Part II) on the 555-1212 Directory
Assistance exchange. For this, you would call up a DA in certain areas [that
have an Automatic Call Distributor (ACD)] and hold down the "D" key which
should blow the operator off. You will then hear a pulsing dial tone which in-
dicates that you are in the ACD internal testing mode. You can get on one side
of a loop by dialing a 6. The other side is 7. Some phreaks claim that if the
person on side 6 hangs up, the equipment will screw up and start directing
directory assistance calls to the other side of the loop. Another alleged test
is called REMOB which allows you to tap into lines by entering a special code
followed by the 7 digit number you want to monitor. Then there is the possi-
bility of mass conferencing.
ACD's are becoming rare, though. You will probably have to make several
NPA-555-1212 calls before you find one.
You can modify regular fones quite readily so that they have a switch to
change between the 3rd and 4th columns. This is called a silver box (aka grey
box) and plans can be found in TAP as well as on many BBS's.
Word processed and nroff'ed by Tharrys Alaric Ridenow
From Lunatic Labs UnLtd. 415-278-7421
Press a key...
PIRATES HOLLOW 415-236-2371
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
