:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: D :::::::::::::::::::: :::: ::: ::: ::::: :::: E ::::::: ---- ::::::::::: :::::::: :::::::: :: :::: :::::::: C :::::: / :::::::::::::: ::::: :::::::: : :::: :::::: O ::::: / mprovised:::::: ::::: ::::::: : : ::: :::::::::: D :::: ---- :::::::::::: ::::::: ::::::: :: :: :: :::::::::: I ::::::::::::::::::: :::::::::: ::::: :::::::: :: :::::::::: N :::16-Nov-93:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: G by o l e B u z z a r d INTRODUCTION DTMF stands for Dual Tone/Mutli-Frequency and it is the process by which TouchTone(c) phones operate. When a button is it on a TouchTone(c) phone a dual tone is created each of which generates a unique frequency. Combined these tones equal 2600Hz. Now, it is important to note that this file as very little to do with the workings of DTMF and nothing to do with frequency manipulation. I ask you to keep this in mind if you see an error in statements made regarding DTMF. DTMF in and of itself is not relevant to this file. DTMF DECODING Most people outside the phreaking world never think about decoding a DTMF number if for no other reason than that they usually know what number they dial. But within the phreaking world the ability to decode a DTMF tone can be a phreaker's greatest tool. Often in my travels I have heard DTMF tones blurp out at 38ms or less interval spacing (very fast dialing) and just knew it was the number to the God of GODs. Just ask yourelf how many times either while just doing phun stuph or even just watching television (like CNN's Future Watch) you heard a number dialed. Wouldn't it have been kk0ol to have known what that number was. (<- Note the period because that was a rhetorical question.) Well thats what DTMF Decoding is all about. Now DTMF Decoding is nothing new. In fact HAM Radio users do it all the time because DTMF are often broadcast over the radio-waves. I mention this because where theres a demand theres a supply. Heres a couple consumer DTMF decoders available mail order. [ Taken from Monitoring Times Vol.12 No.10 Oct-93 ] ---------------------------------------------------------------------------- OPTOELECTRONICS | MOTRON ELECTRONICS 5821 NE 14th Avenue | 310 Garfield Street Suite 4 Ft. Laud., FL 33334 | Eugene, OR 97402 | DYNAMIC DUO--FM Intercept, Detect, | Tone-Master TM-16 and TM-16 Plus Decode Tones...CTCSS, [ DTMF ], and DCS | | The TONE-MASTER Line of Hande Held The R10 is a unique FM Communications | Tone Dedcoder Display Products. Test Receiver with security and | Decode Touch-Tones from a phone, surveillance applications. The R10's | scanner, tape recorder, or nearly full spectrum audio output interfaces | any audio source. directly with the DC440 to monitor | CTCSS, and [ DTMF ], FM Deviations | and Relative Signal Strength | | Optoelectronics Advantages | Tone-Master Line 1. Decode & Display CTCSS, DTMF or DCS | 1. 16 Digit LCD Display with 80 & DTMF simultaneously. | character scrollable memory. 2. 127 Character DTMF Buffer with | 2. Portable 9-volt battery or ext. scrollable 10 Character Display. | power operation. No Lost Data | 3. Completely stand-alone. No 3. LCD Display, visible in bright light | computer necessary. 4. Serial Computer Interface | 4. Metal enclosure w/built-in 5. Activity Indicator--lets operator | monitor speaker. Only 2.75" see when unit is activley decoding. | x 6.1" x 1.2" 6. High Quality NiCad Battery pack | 5. TM-16+ includes RS-232 output option. | and software for automatic 7. Actual DTMF Characters Displayed! | date/time/number logging w/Comp | Package Price: $549 | Price: TM-16 $169 TM-16+ $239 ---------------------------------------------------------------------------- Notice anything? Yes thats it....go ahead and say it... 'They both cost money.' Actually, the Tone-Master TM-16 is not a bad deal at all. It would be great for field phreaking. But lets assume you're not going to be 'tin canning' on a regular basis and you would just like to be able to decode a tone every now and then when you're phreakin around. Well the TM-16 would still be a good deal, but in case you don't have the extra $170 bucks, I will show you how you can do it for free. IMPROVISED DTMF DECODING Through the wonder of Automatic Number Identification (ANI) anyone can decode DTMF tones easily and (more importantly) without cost. How it works is this: Nowadays the phone line are run over-roughshod with Voice Mail Boxes (VMBs). These VMBs, while worthwhile, and very fun to hack, can serve another purpose. They can decode DTMF tones for us! Now VMBs are not all a like. There are many VMB systems such as Audix, Aspen, and ROLM to name a few. For the purpose of this file we will be focusing on Merridian VMBs. The Merridian proves very useful for the purpose of improvised DTMF Decoding because Merridians utilize ANI technology to provide verbal feedback to VMB selections. What happens is this: when you call a Merridian it will ask you which mailbox you wish to leave a message at. You then enter a box number. The Merridian will indentify the box number you entered and tell you whether or not the box is valid. By doing so the system has decoded the DTMF. Used as just described constitutes intended use. For use as Improvised DTMF Decoder follow the following (what?) 1. Record desired DTMF tones. These are the tones you recorded while out 'tin canning'. 2. Call a Merridian VMB [1-800-946-8888] * NOTE * This is the number to a real-live investment firm (IDS - Investment Diversified Services). What does this mean? Well it means that if you call them during business hours you will talk to a real-live person. Call after 6:00pm CST to get the VMB. (Lighten up...no one phreaks during the day any how.) 3. Bypass the outgoing message by hitting 0 + 3 and then 1 * NOTE * Now I don't know if hitting those keys works for all Merridians or not, but I do know its not that hard to stop an outgoing message. For more info on Merridians contact Video Vindicator at 4. You will hear a message that says: 'Express Messaging...to mailbox?' At this point play the recorded DTMF tones *LOUDLY* into the handset. * NOTE * A real preak would have some sort of 'Box' to play the tones directly into the phone line. 5. After tones have been played press the Pound (#) Key. You will hear a message which says either: 'There is no box number at xxx, please try again.' Or, 'Mailbox xxx, please leave a message after the tone.' In either case the DTMF is decoded (yeah.) * NOTE * This method of improvised DTMF decoding can be achieved on other systsems which utilize ANI such as AT&T VoiceMessaging(c). I have chosen Merridian VMBs as ideal because they allow tone string of up to 255 NUMBERS!!! ^^^ DTMF'IN To aid in your DTMF Decoding theres a couple of things you should probably have. 1. A Tape Recorder, preferably a small one, but any tape recorder with an in-shape recording head will do. 2. A Microphone. I recommend Radio Shack Model 44533 Telephone Pick-Up Mic.. $4.19 3. Tones to decode. Heres a little list of DTMF ToucTone sources a. 'Tin-Canning' You know the big, green things that say USWest. b. CNN's Future Watch (5:00pm Sundays EST) c. Movies (there were all kinds of DTMF tones in WarGames). d. Surveillance. (see 'Tin-Canning' DTMF NUMERIC CORRESPONDENT Heres a little DTMF/Number conversion list I'm throwing in to make my file look more legitimate. It as no real value to this file other than to make me look good..(better). Have Phun!! oB 697Hz + 1209Hz -> 1 770Hz + 1209Hz -> 4 697Hz + 1336Hz -> 2 770Hz + 1336Hz -> 5 697Hz + 1477Hz -> 3 770Hz + 1477Hz -> 6 852Hz + 1209Hz -> 7 941Hz + 1209Hz -> * 852Hz + 1336Hz -> 8 941Hz + 1336Hz -> 0 852Hz + 1477Hz -> 9 941Hz + 1447Hz -> # Shout outs to: Nobody (at oB's), Disorder (at Flatline), and all my users at... -------------------------------------------------------------------------------- oleBuzzard's kn0wledge phreak % sUmthyn lykE 4000+ text fylez % C.R.a.P.N. AC 3o3.447.89o6--NUP = NO NUP % hAck/phrEAk/AnArky/vIrII/cArd % Call Right 24oo-14.4ooKiloBaud-Open 24/7 % n0 phUckyn lAmEr wArEz do0dz! % Phuckn Now --------------------------------------------------------------------------------