\-=-=-=-=-=-=-=-=-=/

\ /

\ THE ART AND /

\ PRACTICE OF /

\ BLUE BOXING /

\ /

\=-=-=-=-=-=-=-=-=/



=)>ORIGINALLY TYPED BY:<(=

^-NICKIE HALFLINGER-^

^- & MR. AMERICA -^

 `

THIS IS THE TONE MATRIX FOR A BOX WHICH GENERATES TONES THAT OPERATORS USE TO

DIAL..ROTARY WORKS AS WELL, ON OPERATOR LINES, BUT THIS IS TECHNOLOGICAL(!).

NOW I AGREE WITH THE OPINION OF A WELL KNOWN PHREAK THAT 'BOXING' IS/WILL BE FOR

THE MOST PART DEAD, BUT THIS IS TRADITION... FIRST,YOU DIAL DIR.ASST, OR AN

OPER. ETC, THEN YOU BLAST THE LINE WITH A 2600HZ TONE. THIS GIVES YOU THE

LINE, THIS IS ALSO HOW MA BELL TRACKS DOWN BLUE BOXERS...THERE ARE 2600HZ

DETECTORS SYSTEMS, AND EVEN ON OLD #4 CROSSBARS... ONCE ON A OPER.TRUNK LINE,

YOU USE YOUR BLUE BOX/ROTARY TO DIAL...SO, IF YOU USE 2600HZ, WHICH IS

NECESSARY, UNLESS YOU ARE *VERY* CAREFUL, YOU WILL BE SNAGGED. FINALLY,

THIS IS

** PAUSE ** WHAT YOU READ SO LONG AND HARD FOR:



700 : 1 : 2 : 4 : 7 : 11 :

900 : + : 3 : 5 : 8 : 12 :

1100 : + : + : 6 : 9 : KP :

1300 : + : + : + : 10 : KP2 :

1500 : + : + : + : + : ST :

: 900 : 1100 : 1300 : 1500 : 1700 :



USE KP TO START A CALL, AND ST TO STOP, WITH THE BELOVED 2600HZ TONE TO

DISCONNECT.I ALSO HEAR THAT 2600HZ RESETS SPRINT NODES AND GIVES YOU THEIR

INITIAL TONE ..NOW, IF YOU'RE WONDERING ABOUT WHAT TO CALL FROM AN OPERATOR

TRUNK, HERE ARE SOME GOODIES TO HELP YOU OUT:



XXX+101 - TOLL SWITCHING

XXX+121 - LOCAL OPERATOR

XXX+131 - INFORMATION

XXX+141 - RATE & ROUTE

XXX+181 - COIN REFUND OPERATOR

XXX+11501 - MOBILE OPERATOR

XXX+11521 - MOBILE OPERATOR

XXX+11511 - CONFERENCE OPERATOR



THESE WORK WITH ROTARY OR OPERATORS TONES, BUT ONLY ON OPER.TRUNK

** PAUSE ** LINES...THANKS FOR LISTENING!







BLUE BOXES, PART II



WHILE READING THE FINE ARTICLE ON THE BLUE BOX I SAW THAT HERE A LOT OF DATA

LEFT OUT OF THE DOCUMENT. I HOPE THIS ADDS, IN SOME SMALL WAY, TO THE

INFORMATION.



FIRST THE TONES. WHILE ALL THE INFORMATION IS CORRECT, THE TIMING SPECS WERE

NOT INCLUDED. THE TONE PAIRS ARE TO REMAIN ON FOR 1/10 SEC. WITH 1/10 SEC. OF

SLIENCE BETWEEN DIGITS. THE 'KP' TONES SHOULD BE SENT FOR 2/10 SEC. A WAY TO

DEFEAT THE 2600HZ TRAPS IS TO SEND ALONG WITH THE 2600HZ SOME PINK NOISE (MOST

OF THE ENERGY IN THIS SIGNAL SHOULD BE ABOVE 3000HZ, THIS SIGNAL WON'T MAKE IT

OVER THE TOLL NETWORK, BUT SHOULD CARRY AS FAR AS YOUR LOCAL TOLL CENTER) SO

THAT THE TRAPS WON'T FIND 'PURE' 2600HZ ON THE TRUNK. THIS IS NOT A PERFECTLY

SAFE WAY TO BOX, BUT IT SHOULD SLOW DOWN THE DISCOVERY. AS TO USE, THE FIRST

THING YOU NEED TO UNDERSTAND IS THAT THERE ARE TWO(2) TYPES OF TOLL COMPLETING

TRUNK, INWARD AND OUTWARD. THE NAMES ARE REFERENCE TO THE OFFICE THAT IS

SWITCHING THE CALL (THE TOLL CENTER THAT SERVES THE WATS LINE YOU CALLED) AND

EACH TYPE OF TRUNK HAS A DIFFERENT CLASS OF SERVICE. FROM AN INWARD TOLL

COMPLETING TRUNK, YOU CAN REACH THE DIFFERENT SERVICE OPERATORS, THE TOLL TEST

BOARD, AND THE INWARD OPERATOR. SOME OFFICES ALSO ALLOW REMOTE TESTING AND IT

** PAUSE ** IS IN THESE OFFICES THAT YOU CAN ACCESS THE OUTWARD TOLL COMPLETING TRUNKS. THE

OUTWARD TRUNKS ALLOW YOU TO MAKE VERIFICATION (EMERGENCY) CALLS, DO SERVICE

MONITORING (TAPPING), STACK TRUNKS (BUSY OUT ALL TRUNKS BETWEEN LA AND NYC),

ENABLE AND DISABLE TSPS POSITIONS, AND IN SOME CASES (ON SOME 4A'S) ISSUE

TEMPORARY REROUTING INSTRUCTIONS (SEND ALL CALLS FROM LA TO NYC VIA MIAMI,

BOSTON, OR ANY OTHERCLASS 5 OFFICE OR OFFICES). BOTH TYPE OF TRUNK ALLOW YOU TO

PLACE A 'STANDARD' CALL WITH A BOX.



IN SOME OFFICES, MOSTLY THE SMALL ONES WITH A TOLL TEST BOARD THAT IS

UNATTENDED AT NIGHT AND ON WEEKENDS, YOU CAN GET AN OUTWARD TOLL COMPLETING

TRUNK AS WELL AS PERFORMING OTHER TEST AND ROUTING FUNCTIONS. YOU DO THIS BY

USING THREE DIGIT CDES THAT ARE INVALID EXCHANGES (NOT OF THE PATTERN NNX [SEE

NOTE 1]). DURING THE SIXITES THE CODES USED WERE FAIRLY STANDARD AND

CONSISTENT, HOWEVER WHEN THE BOXES BECAME POPULAR AND THE PHREAKS STARTED DOING

THINGS LIKE ROUTING ALL CALLS FROM DALLAS TO FT. WORTH VIA WASHINGTON D.C.

MOTHER STARTED CHANGING THE TEST CODES ON A RANDOM (AS FAR AS I KNOW) BASIS.

WHAT I WOULD SUGGEST IS THAT EVERYBODY INTERESTED IN DOING THIS SORT OF THING

PICK OUT A NICE QUIET LITTLE OFFICE SOMEWHERE AND WORK ON DISCOVERING THE CODES

ACCEPTABLE TO THAT OFFICE. EACH NUMBERING PLAN AREA (NPA, ALSO KNOWN AS AREA

CODE) HAS AN OFFICE DESIIGNATED AS ITS MASTER OFFICE. THIS OFFICE CONTROLS ALL

OF THE OTHER TOLL OFFICES IN THE AREA AS WELL AS SERVING AS A CONCENTRATION

POINT FOR MOST OUT OF AREA CALLS. TO ACCESS THE SERVICES OF A NON-MASTER OFFICE

YOU NEED IT'S 'CITY CODE', THIS IS A THREE(3) DIGIT CODE THAT IS OF THE FORM

0XX, AND IS SENT AFTER THE AREA CODE [SEE NOTE 2]. AS AN EXAMPLE, THE 'CITY

** PAUSE ** CODE' FOR CANTON, OHIO IS 042; THUS TO REACH THE INWARD OPERATOR IN CANTON, YOU

WOULD SEND 'KP-216-042-121-ST' WHERE AS IF YOU WANTED THE INWARD OPERATOR IN

CLEVELAND, YOU WOULD SEND 'KP-216-121-ST'. THE REASON THIS IS NECESSARY IS THAT

THE OPERATOR IN CLEVELAND CAN'T VERIFY A NUMBER IN CANTON, SO IF YOU WANT TO

VERIFY SOMEONE IN CANTON YOU NEED THE CITY CODE. ALSO, MOST AREA MASTER OFFICES

HAVE DEDICATED DATA TRUNKS TO THE NETWORK CONTROL CENTER AND THUS DON'T ACCEPT

TEST AND REROUTING COMMANDS OVER THE SWITCHED NET-WORK. IN CONCLUSION, THE

SWITCHING NETWORK WILL DO A LOT MORE FOR YOU THEN CONNECT YOU TO PEOPLE AND THE

SMALL OFFICES THAT REQUIRE A 'CITY CODE' ARE THE TYPE OF OFFICE TO TRY TO BREAK.





NICKIE HAFLINGER,



THE COVEN.



NOTE 1: THE NORMAL FORMAT FOR TELEPHONE NUMBERS IS AS FOLLOWS: NYN/NNX-XXXX.

WHERE N=ANY DIGIT EXCEPT 1 AND 0; Y=0 OR 1, AND X=ANY DIGIT. YES I KNOW THAT IN

SOME AREA CODES THE NNX FORMAT HAS CHANGED TO NXX. THIS IS A NEW OCCURRENCE AND

ONLY OCCUR WHERE THERE HAS BE AN OUTRAGEOUS POPULATION INCREASE IN THE LAST FEW

YEARS AND ALL OF THE FUNNY EXCHANGES ARE CONNECTED DIRECTLY TO MASTER OFFICES

AND THUS DON'T CONFLICT WITH THE 'CITY CODE' FORMAT.



NOTE 2: YOU CAN OBTAIN THE 'CITY CODE' FOR A NUMBER BY CALLING RATE AND ROUTE

AND ASKING FOR THE 'NUMBERS ROUTE' TO NYN/NNX (I.E. 914/725). OR IF YOU LEAVE

** PAUSE ** ME A MESSAGE WITH THE AREA CODE AND FIRST THREE OF A NUMBER, I WILL GET YOU THE

'CITY CODE'.





THIS BULLETIN WILL DEAL ONLY WITH THE BASIC CONTRUCTION, TROUBLESHOOTING AND

ADJUSTMENT OF THE BLUE BOX. IF YOU WOULD LIKE TO KNOW THE SPECIFIC JOB OF ANY

PART IN THE CIRCUIT JUST WRITE ME A MSG AND I WILL BE GLAD TO ANSWER IT.



WE ALL KNOW THAT THE TOUCH TONES FREQUENCIES ARE COMPOSED OF TWO TONES (TWO

DIFFERENT FREQS.) SO THAT IS THE REASON WHY WE HAVE 2 VCO'S ( VOLTAGE CONTROLLED

OSCILATORS). WE WILL CALL THESE VCO#1 AND VCO#2. IF YOU HAVE NOTICED VCO#1 ANS

VCO#2 ARE EXACTLY THE SAME TYPE OF CIRCUITS. THAT IS WHY ONLY ONE WAS DRAWN.

BUT REMEMBER THAT WHATEVER GOES FOR VCO#1 ALSO GOES FOR VCO#2. BOTH VCO'S

ARE

COMPOSED OF A HANDFULL OF PARTS. ONE CHIP TWO CAPACITORS 2 RESISTORS AND FIVE

POTENTIOMETERS. ALL OF THIS WILL GIVE YOU (WHEN PROPERLY CALIBRATED) ONE OF THE

FREQS. NECESSARY (THE OTHER ONE WILL COME FROM VCO#2) FOR THE OPERATION

OF THE

BB. BOTH OF THESE FREQS. WILL BE MIXED IN THE SPEAKER THUS FORMING THE

REQUIRED TONE.



THIS IS ONE OF THE MOST SOPHISTICATED DESIGNS I HAVE EVER MADE. WHY? BECAUSE

OTHER DESIGNS WILL DRAIN THE BATTERY AFTER 10 CALLS! THIS DESIGN WILL MAKE THEM

LAST 10 MONTHS!!!!!!. BUT NEVER THE LESS DON'T FORGET TO PUT IN A SWITCH FOR ON

** PAUSE ** AND OFF. OK LET'S BUILD THE TWO VCO'S AND CALIBRATE THE UNIT BEFORE WE GET TO

THE KEYBOARD CONTRUCTION.





VCO CONTRUCTION

=== ===========

TOOLS REQUIRED



1 OCILLISCOPE (RECOMENDED BUT NOT REQUIRED)

1 FREQ. COUNTER (REQUIRED)

1 VOLT METER " " "

ELECTRONICS TOOLS (PLIERS,DRILL, SCREWDRIVERS, ETC)





PARTS



R1 1.5K RESISTOR 5%

R2 1K RESISTOR 5%

C1 .1UF ELECTROLYTIC CAPACITOR 16VDC

C2 .01UF ELECTROLYTIC CAPACITOR (MYLAR) 16VDC

IC1 2207 VCO CHIP BY EXAR ELECTRINICS

REMEMBER THE ABOVE IT IS ONLY FOR VCO#1 BUT THE SAME GOES FOR VCO#2.



R3-R4 150 OHM RESISTORS 5%

** PAUSE **  C3-C4 .1 UF ELECTROLITIC CAPACITOR 10VDC

P1-P10 200K TRIMMER POT - 20 TURNS

DIODES USED IN THE KEYBOARD ARE 1N914 TYPE (40 OF THEM)

AND 13 SWITCHES FOR THE KEYBOARD SPST. MOMENTARY.



SPKR= YOU CAN USE A TELEPHONE SPEAKER FOR THIS(IT WORKS BEST)

BUT REMEMBER TO TAKE OUT THE DIODE THAT IS CONNECTED ACCROSS IT.

***********************************************************

IMPORTANT NOTES



1. DO NOT USE ANYTHING ELSE THAN A MYLAR CAPACITOR FOR C2

2. PINS 10,9,8 SHOULD BE TIED TOGETHER AND BE LEFT FLOATING.

3. ALL RESISTOR SHOULD BE 5%! NOTHING ELSE

4. A TELEPHONE SPEAKER GIVES THE BEST RESULTS

***********************************************************





TROUBLE SHOOTING



BY NOW YOU SHOULD HAVE CONSTRUCTED THE TWO VCO'S ON A BREAD BOARD OR ANYTHING

THAT PLEASES YOU.



CHECK FOR COLD SOLDER JOINTS, BROKEN WIRES, POLARITY OF THE BATTERY, ETC......

...

** PAUSE ** 

BEFORE WE APPLY POWER TO THE VCO'S WE HAVE TO ADJUST THE POTS FOR THEIR HALF W

AY TRAVEL POINT. THIS IS DONE BY TURNING THEM 21 TURNS TO THE RIGHT AND THEN 10

TURNS TO THE LEFT. DO THE SAME FOR ALL TEN OF THEM.



NOW APPLY POWER TO THE UNIT CHECK TO SEE THAT YOU HAVE POWER IN THE CHIPS BY P

UTTING THE POSITIVE LEAD OF YOUR VOLT METER ON PIN 7 AND THE NEGATIVE LEAD ON PI

N 12. IF YOU DON'T HAVE ANYTHING THERE TURN OFF THE UNIT ANT RECHECK THE WIRING.



WHEN YOU GET TE RIGHT VOLTAGES ON THE CHIPS, CONNECT A DIODE TO A PIECE OF WIR

E (LOOK AT FIG. 2 FOR THE ORIENTATION OF THE DIODE) FROM GROUND TO ANY POT AT PO

INT T (LOOK CAREFULLY AT THE SCHEMATIC FOR POINT T IT IS LABELED T1-T10 FOR ALL

POTS) YOU SHOLD BE ABLE TO HEAR A TONE, IF NOT DISSCONNECT THE LEAD AND PLACE TH

E SPEAKER CLOSE TO YOUR EAR AND IF YOU HEAR A CHIRP LIKE SOUND, THIS MEANS THAT

THE TWO VCO'S ARE WORKING IF YOU DON'T, IT MEANS THAT EITHER ONE OR BOTH OF THE

VCO'S IS DEAD. SO IN THIS CASE IT IS ALLWAYS GOOD TO HAVE AN OCILLOSCOPE ON HAN

D.



DISCONNECT THE SPEAKER FROM THE CIRCUIT AND HOOKUP THE OCILLISCOPE TO ONE OF T

HE LEADS OF THE SPEAKER AND THE GROUND FROM THE SCOPE TO THE GROUND OF THE BATTE

RY. CONNECT AGAIN THE GROUND LEAD WITH THE DIODE CONNECTED TO IT FROM GROUND TO

ANY POT ON THE VCO THAT YOU ARE CHECKING AND YOU SHOULD SEE A TRIANGLE WAVE IF

NOT TURN THE POT IN WICH YOU ARE APPLYING THE GROUND TO UNTIL YOU SEE IT. WHEN Y

OU DO SEE IT DO THE THE SAME FOR THE OTHER VCO TO MAKE SURE IT IS WORKING. (AMPL

** PAUSE ** ITUDE IS ABOUT 2VAC)



WHEN YOU GET THE TWO VCO'S WORKING YOU ARE SET FOR THE ADJUSTMENT OF THE INDIV

IDUALS POTS...



ADJUSTMENT





DISCONNECT THE SPEAKER FROM THE CIRCUIT AND CONNECT A FREQ. COUNTER (THE POSI

TIVE LEAD OF THE COUNTER TO ONE OF THE SPEAKERS LEADS THAT BELONGS TO VCO#1 OR C

ONNECT IT TO PIN 14).



CONNECT THE NEGATIVE LEAD TO THE BATTERY NEGATIVE AND CONNECT THE JUMPER LEAD

WITH THE DIODE FROM GROUND TO POT NUMBER 1 T1 .( THE FIRST POT NUMBER 1 POINT T1

) IF YOU GOT IT WORKING YOU SHOULD HEAR A TONE AND GET A READING ON THECOUNTER.

ADJUST THE POT FOR A FREQ. OF 1700HZ AND CONTINUE DOING THE SAME FOR POTS 2-5 E

XCEPT THAT THEY GET DIFFERENTS FREQS.





P1= 1700HZ

P2= 1300HZ

P3= 1100HZ

P4= 900HZ

P5= 1500HZ

** PAUSE ** 

NOW DISCONNECT THE FREQ. COUNTER FROM THE SPEAKER LEAD OF VCO#1 OR FROM PIN 14

(WHICH EVER YOU HAD IT ATTACHED TO AT THE BEGINNING) AND CONNECT IT TO THE SPAK

ER LEAD OF VCO#2 OR TO PIN 14 OF VCO#2 AND PERFORM THE SAME ADJUSTMENTS TO P6-10

.



P6= 1100HZ

P7= 700HZ

P8= 900HZ

P9= 2600HZ MAGIC NUMBER!!!!!

P10= 1500HZ



WHEN YOU FINISH DOING ALL OF THE POT GO BACK AND RECHECK THEM AGAIN.





KEYBOARD

IF YOU LOOK AT FIG-2 YOU WILL SEE THAT THE KEYS ARE SIMPLE SWITCHES CONNECTED

TO GROUND AND TWO DIODES ON THE OTHER END. THESE DIODES ARE USED TO SIMPLIFY THE

CONSTRUCTION OF THE KEYBOARD BECAUSE OTHERWISE THE DISTRIBUTION OF THE GROUND S

IGNAL FOR BOTH VCO'S WOULD HAVE BEEN DONE MECHANICALLY. ONE DIODE WILL GO TO VC

O#1 AND THE OTHER WILL GO TO VCO#2. FIG-3 SHOWS THE ARRANGEMENT OF THE KEYS ON T

HE KEYBOARD.





** PAUSE **  BELOW IS A TABLE THAT WILL HELP YOU CONNECT THE KEYS TO REQUIRED VCO'S POTS.





TO TO FREQ OUT FREQ OUT



KEY POT ON VCO1 POT ON VCO 2 PIN 14 VCO1 PIN 14

VCO



C 1 6 1700 1100



0 2 10 1300 1500

E 1 10

1700 1500

1 4 7

900 700

2 3 7

1100 700

3 3 8

1100 900

4 2 7

1300 700

5 2 8

1300 900

6 2 6

** PAUSE **  1300 1100

7 5 7

1500 700

8 5 8

1500 900

9 5 6

1500 1100

X - 9

---- 2600



***********************************************************

REMEMBER THAT FIG-2 IT IS THE SAME FOR EACH KEY EXCEPT THE "X" WHICH ONLY TAK

ES ONE DIODE.

***********************************************************





AS A FINAL WORD YOU CAN BUILD THIS IN ANY TYPE OF ENCLOSURE AND SHOULD NEVER

BE USED TO MAKE FREE CALLS USING THE TELEPHONE LINES. I HOPE THIS BULLETIN WILL

CLEAR ANY QUESTION YOU MAYHAD ON THE BLUE BOXES. IF YOU HAVE ANY QUESTION PLEASE

LEAVE ME A MSG. AND I WILL BE VERY GLAD TO ANSWER IT.

TXS

MR. AMERICA



PS. I WOULD LIKE TO THANK MY KEYBOARD, MY FINGERS, AND ME FOR HELPING ME WRIT

** PAUSE ** ING THIS PHILE!





[1] Tfiles: (1-26,?,Q) :