MANUAL TO VERSION 1.1 OF THE ROWDY DIALER (By RowdyB) 1st Release: April '93 ------------------------------------------------------------------------- Please don't hesitate to bother me at either: at073@cleveland.freenet.edu or: RowdyB@utopia.hacktic.nl for bug reports, comments, bad poetry etc. Take note that the latter address may yield slower responses! - RowdyB - ------------------------------------------------------------------------- INDEX 1 INTRODUCTION 1.1 About the dialer 1.2 Features 1.3 About this manual 1.4 Disclaimer 2 USING YOUR DIALER 2.1 Alpha-numerical editing in general 2.2 Usage and editing of the Multi-Frequency keys 2.3 Usage and editing of songs 2.4 Number scanning 2.5 Guard banding 2.6 Sweep test 2.7 Key logging 2.8 Miscellaneous functions 2.8.1 Doorbell mode 2.8.2 Adapting key buffers 2.8.3 Program execution 2.8.4 Resetting your dialer 2.8.5 Saving your modifications 3 PROGRAMMING EXAMPLES 3.1 A word on the presets 3.2 Programming examples 3.2.1 Some signalling sequences 3.2.2 Pulse signalling 3.2.3 Dividing phreak stages 3.2.4 Auto-phreaking 3.2.5 Scanning country codes APPENDICES A: Trouble shooting B: Where to get the Demon Dialer? C: Acknowledgements 1 INTRODUCTION 1.1 About the dialer Early '92 I programmed a quick and dirty tool to play around a bit with C5 only. Shortly after that I came in touch with an ingenious hardware multi-box; the Demon Dialer (aka Bill's Box) by Hack-Tic Technologies. It offers a maximum of flexible control over all types of phreaking through easy to learn and smart keycombinations, giving audio feedback whenever needed. It features DTMF, C3, C4, C5/R1, R2 (forward/backward), ATF1, tone slots, a palette of other frequencies to be found in automatic telephony and datacommunication, as well as guard banding, advanced (nested) macro programming, user-definable mark/space timings and frequencies, tone sweep and stepping, number- scanning, password protection, RAM battery backup, auto shut off, hookswitch control and an RS232 interface. It's about the size of a pack of cigarettes. I understood I either had to buy it or add some of its features to my C5-thingy. Due to a cashflow problem ''at the time'' I chose the latter option. As time passed it sort of became most of the features, since I started all over again programming an empty, programmable box that afterwards could be divided to my personal taste. It again offers a maximum of flexible support to phreaking, since basically phreaking is a lot of work which one is more inclined to perform when well supported (especially when one confuses laziness and life-style, as yours truly does). For information on how to order a Demon Dialer ($250 US or 350 DM/Gld for a very complete do-it-yourself package) see Appendix B. This is a =PIZZAWARE= program, meaning that if you enjoy working with it, I'd like you to send a Pizza Salame Xtra cheese (no anchovy) to the following adress: Rowdy Blokland Schotdeuren 52 4241 BS ARKEL The Netherlands (Bank-account: PostBank (ING) 3366741, The Netherlands) If it's likely to arrive cold, I'd rather have *oh surprise* the cash equivalent. (Advice: Get 'm cheap!) In the tradition of all xxx-WARE clauses I should now waste a few lines on a fruitless effort to convince you, the potential user, what's so smart about sending money to a total and utter (quite probably bad-breathed and perverted as well) stranger. As a matter of fact, I don't even know this myself. French kissing an AT&T operator sounds like a smarter thing to do. Rather than crippling features, withholding manuals or promising surprisingly uninteresting sourcecodes or an occasional successive version I simply trust you to go bananas completely during a possible adrenaline-boost that correct appliance of this program may inflict on your body which will make your local pizza-dealer cry happy tears. You'll regret it though. 1.2 Features The Rowdy Dialer (RD) offers in short 10 fields of 16 Multi-Frequency keys, to be applied in up to 99 songs. All values and attributes with respect to songs and MF-keys are fully user-definable, thus allowing you to program anything ranging from Morsecode to your national anthem. Initially you'd be satisfied with the following concerts your RD is already composed with: * DTMF * CCITT 3 (audio), 4 and 5 (/R1) * R2 forward/backward * Red-/greenbox * ATF1 * Tone slots * Several line- and other signals and features a.o. * Number scanning * Guard banding * Sweeptest * Frequency stepping * Song programming and invocation * Preprogrammable songkeys (10*10) * User-definable timings/frequencies per song/MF-key * Direct marktime/volume stepping * (Password protected) key logging * Program execution presented through a macho and informative graphical interphace. 1.3 About this manual This manual is NOT a manual on phreaking as such. There's already a truckload of files out there supplying information on history, folklore, terminology, box-schemes etcetera w.r.t. this, and your local technical library can also be of help. In this textfile your dialer's various functions and possibilities are described step-by- step and how to make good use of them. All keycombinations have been chosen with some logic and all input is made foolproof - or so I'd like to think .. Btw: don't bother to memorize what keypress goes with what function, it's all runtime available in short under . 1.4 Disclaimer "The amount of time people waste to get something for nothing is highly remarkable" - Robert Lynd The user of this program is solely responsible for his or her use of it - legal or illegal. I'm merely a poor toolmaker and simply cannot and will not take any responsibility. This argument works for the arms industry, so why wouldn't it do the job for me! (Of course, I do lack relevance in the highest echolons of any government.) As a matter of fact, I would strongly advice against use of this tool at all. It has rumour that getting a job and paying your bills might work as well, but I wouldn't know. 2 USING YOUR DIALER 2.1 Alpha-numerical editing in general All alpha-numerical editing is taken care of by GFA's standard formatted-input routine. Unfortunately it is not fit for a graphical environment and has the irritating habit of adding 1 or 2 blanks when entering/editing fullsized input; temporarily giving the interface a rather silly look. On the other hand it's quite a luxurious input routine and making one of my own just to meet this would be too big an effort. DO NOT report this to me as a bug! After entering your string all possible damage will be restored. The editing commands are: Move cursor left/right Move cursor to begin/end Move cursor to begin/end Toggle insert/replace mode Delete character left of cursor Delete character right of cursor Clear string Enter string Don't worry about entering incorrect, out-of-range or no data. Depending on the situation the data will be mapped in range (absolute value or bottom/top of range etc.), replaced by the last value (e.g. when entering nothing) or an error message will appear. Accidentally including control-codes in your comments on songs, MF- keys or fields however can sometimes fuck up the look of the interface; so don't. If you did, remove them. When needed, you can redraw the entire screen by pressing Redraw screen 2.2 Usage and editing of the Multi-Frequency keys The use of the MF-keys is to both define (interregister-)signals for use in songs and to (a.o.) provide a way to explore line signalling directly. Especially immediate marktime- and volumestepping can be of great help w.r.t. the latter. The attributes of each Multi-Frequency key (MF-key) are two frequen- cies, its duration or marktime, its volume and a twelve character comment. Each MF-key corresponds to the numerical keyboard as shown. The frequencies and marktime are printed on each key, the volume and comment show up in the infobox at the right when pressing an MF-key. As said before, there are 10 fields of 'em. Simply use the keys to change to a previous or next field. When you get to know the fields it's often handier to jump directly to the one you need. For this press and enter the desired fieldnumber. Different signalling systems are spread over different fields when- ever possible to facilitate simple field-usage in songs (see below). For clarity each field is commented upon in the upper infobox to the right. How to change an MF-key's attributes: Frequencies: Can be changed by entering a value directly or by frequency stepping. First press together with the MF-key you wish to edit to enter the MF-key editing box at the left. Freq1 can now be changed. Press or to enter a new value. The allowed range is 31 .. 4000 Hz; from the lowest frequency the ST can produce to the upper border in outband signalling (voiceband 300-3400, outband 3400- 4000). Entering 0 Hz is also allowed and interpreted as silence. Pressing swaps from freq1 to freq2 and back. This swapping takes place automatically when entering values directly, in order to facilitate entering lengthy multi-frequency tables. To decrease/increase a frequency with a certain stepsize (default 10 Hz) press . This frequency stepping can be made audible by pressing which toggles audio on/off, using the MF-key's volume. Press to change the current frequency's stepsize (Range: 1 .. 999 Hz). Btw: Make sure the two frequencies are not identical - soundwave interference may muffle the volume from time to time. Marktime: Can be changed in three ways: Entering a value via the MF-key editing box, entering a new value directly or changing it according to a desired stepsize. When already editing frequencies in the MF-key edit box, changing the marktime as well can be done by pressing (Range: 1 .. 999 milliseconds). Entering a new value directly is done by pressing . When exploring the timing required for a certain line signal (e.g. starting low and increasing with a certain step) it's best to use the <+/-> keys to achieve fast results. The MF-key you pressed last (actually: about which info is updated in the info box - eventual field changes are taken into account as well) will be affec- ted. Initially the <+/-> keys are switched off. Activate them by pressing <+/->. This toggles them on/off, indicated by the bold or grey look of 'em. (ADVICE: When you don't need them, switch them OFF. You don't want to accidentally change timings unseen). Default the stepsize of the <+/-> marktimes is 5 ms. Press <+/-> to change either one (Range: 1 .. 99 ms). Volume: Can only be altered by use of the <+/-> keys. Press <+/-> to toggle between MARK or VOLUME stepping (only when they're active). As with markstep- ping the MF-key last pressed is affected. Range is 0 .. 15 (logarithmically scaled of course, to match human hearing). Comment: The comments on both a single MF-key and a field of MF- keys can be changed. Press to change the former or to change the latter. Comments can be up to 12 characters. Range is technotalk to sexual explicits, yet unnecessary and gross abuse is recommended. ONE IMPORTANT EXCEPTION: If one wishes to play C4 signals one should formally use songs under preprogrammed keys (see below), since those signals are combined ones. Nevertheless, an obscure option has been added to enable you to play C4 signals comfortably via MF-keys: * When the first three characters of the comment field match 'C4:', the RD will overrule the timing and frequencies belonging to that MF-key. Instead, the following characters immediately after 'C4:' will be examined and played: Char: Freq1: Freq2: Marktime: P 2040 2400 150 X 2040 0 100 Y 0 2400 100 Q 2040 0 350 R 0 2400 350 x 2040 0 35 y 0 2400 35 (Actually, Q and R should read XX and YY to match the notation used in CCITT Rec. Q.121; I prefer straightforward parsing though.) The interpretation of these C4 strings is, of course, case-sensi- tive. The first character not matching one in the table marks the end of the sequence. To improve readability, this can e.g. be a blank followed by a remark, as done in field #1. (Btw: MF- characters in a song still refer to the normally specified frequencies and timing of an MF-key (see below).) Intervals are 35 ms and the MF-key's volume still applies. Of course, unless low-cost timetravel is added to the list of human rights real soon, I could have saved myself the trouble of implemen- ting this. 2.3 Usage and editing of songs To create and play strings of (combined) signalling systems the use of macro's or songs is provided. In the songbox at the bottom of the screen you'll find the songlist. You can scroll it using the keys. Scrolling 10 songs up/down at once is done by pressing , and jumping directly to the top or bottom of the songlist by pressing . Each song can contain up to 25 characters that may refer to the MF- keys, indicate song invocation(s), song expansion or field overruling (see below). Attributes per song are a fieldnumber (FLD:), mark- (MRK:) and spacetiming (SPC:) and an 18 character comment. The fieldnumber indicates the field the MF-characters correspond with, the mark- and spacetime indicate the duration of the signals and their intervals (in milliseconds). If FLD: or MRK: are printed grey instead of bold, their specifications do not apply. Instead, the currently displayed field or the marktimes of the MF-keys themselves are used, respecti- vely. Playing the current song can be done by pressing . It's also possible to preprogram keys 1 .. 0 on the main keyboard with your favorite songs. This way you can directly play songs without having to look them up first in the songlist: - Scroll to the song you wish to preprogram. Now simply press and one of the <1 .. 0> keys you want to store it under. - When pressing <1 .. 0>, the stored song is jumped to and played immediately. If you just want to check what song is under what key and don't want to hear a (possibly lengthy, e.g. ATF1-) song; press . This toggles Direct play on/off. Songs will now only be played by either pressing the <1 .. 0> key again (after the jump), or by pressing . - Actually, there are 10 groups of keys <1 .. 0>, each keygroup again indexed by <1 .. 0>. To change from one keygroup to another just press <1 .. 0>. Initially keygroup 0 is active. Of course one most likely won't need 10*10 preprogrammable keys as such. The idea is to spread several phreakstages over a few keys, in order to facilitate repeating a stage whenever needed, (e.g. Key 1: DTMF sequence; Key 2: Line signal A; Key 3: Line signal B; Key 4: Interregister signal sequence (Keys 5 .. 0: as Key 4)) and several of these (possibly similarly looking) phreakstages can in turn be divided among different keygroups. Changing a song's attributes: Fieldnumber: To toggle specified field usage on/off press . When off, the currently displayed field applies instead of the specified fieldnumber. To change the fieldnumber press (Range 0 .. 9). Marktime: To toggle specified marktime usage on/off press . Press to change the marktime (Range 1 .. 999 ms). When switched on you can easily adapt the mark time of signals needing a uniform length only, otherwise you'd rather switch it off and use the MF-key mark times instead. Spacetime: Press to change the spacetime (Range 7 .. 999 ms). Information: Press to change the information on a song. Up to 18 characters can be entered (For range see MF-key's comment attribute). Song itself: To change the contents of a song press , after which up to 25 characters may be entered. Allowed entries are: - All MF-key characters, where an E represents the ENTER-key. - Song invocation: is established by entering an 's' followed by a two-digit song number (Range 01 .. 99). Invocations can be inserted repeatedly and anywhere within a string. As with playing an MF-character, the invoked song is bordered by the space times of the invoking song. Invocations allow you to e.g. combine different signalling systems with different timings, to create pulse signals with an interval of their own within a sequence having larger intervals, to invoke a stringpart that is subject to number scanning (see below) etcetera. Invoking an undefined song has the same effect as leaving the invocation out. - Song expansion: To expand a song simply enter a ';' at the end of your (possibly empty) string (in fact, it'll always be at the end - what tails it is removed). The song is now concatenated to the next one. Effectively this is parsed up to 4 times. Apart from possibly using this as an alternative to song invocation, it's main purpose is to enable you to enter up to 5*25 characters. If those are e.g. 40 successive invocations (8 times 'sXX' plus a ';' in 5 concatenated songs) this yields up to 5*8*25 or 1000 characters (plus one, if you end the last song with a character instead of a ';') - especially of use to ATF1. When concatenated, the space time between the last signal of song N and the first signal of song N+1 is equal to the space time of song N. An empty song containing only the expansion character transparently glues the previous and next song together. - Field overruling: To pick an MF-character from a field different from the specified (or current, when FLD: is switched off) field, enter an 'f' followed by the desired fieldnumber (0 .. 9) and the MF-character. Everything following this will be subject to the normal field specification again. This allows you to use signals not included in the same field, such as signals not fitting the 16 MF-key field or pauses to be found in line signalling field #8. Of course, this can also be solved by use of invoca- tion, expansion, or even reprogramming a field, pen- ding the situation. Overruling will come in handy though. Restrictions with respect to song programming are: - Songs may not invoke themselves, simply to avoid loops. - Nesting may only be 1 level deep, i.e. an invoked song may not contain further invocations, and - An invoked song may not be expanded. Since a song is parsed and transformed to a bunch of arrays just before playing, these restrictions make sure there's a predictable limit to the sequence to be played (1001 signals). Apart from that, you'll have a hard time making up a phreaksequence that couldn't be realized using the offered flexibility - if at all ! You DON'T need to bother memorizing these restrictions yourself; your RD keeps track of whether a song is invoked by others and howmany times, whether a song may be invoked, expanded or invoke others etcetera. If you enter out-of-range, invalid or conflicting data the RD will display the erratic input within the string in grey and sing a two-tone beep alert. Pressing will show a few tiny helpscreens recapitulating the correct songformat, and removes the erratic parts upon exiting; pressing will simply remove the errors at once. (Btw: Input is not case-sensitive, solely to improve readability an e/E is always mapped to uppercase and f/F, s/S to lowercase.) TWO IMPORTANT EXCEPTIONS: As mentioned before, a song's minimum spacetime is 7 ms. This is simply the smallest amount of time the compiled code uses to initialize the next signal's frequency, volume and timer routines. Shorter, say near-zero spacetimes would involve a totally different approach by use of an assembler. In practice, you'll never need spacetimes even close to 7 ms. Only ATF1 and tone slots (100 baud and 70ms marktime respectively) don't need a spacetime whatsoever. For those two the following exceptions have been implemented: * To play a song at 100 baud (10ms mark, no intervals), make sure the first five characters of the information on a song match 'ATF1:'. Mark and spacetiming are now overruled, and only freq1 of an MF- character is taken into account - all other parameters still apply. * To play tone slots, simply type 'TSL:' at the beginning of the information field. Marktime is now 70ms with zero spacetime, songs are further dealt with as with 'ATF1:'. 2.4 Number scanning Songs that consist of digits only can be sequentially in- or decreased with a specified stepsize for scanning purposes. Also a part of a (not necessarily numerical) song can be made subject to scanning, in behalf of e.g. scanning interregister subscriber num- bers, countrycodes, routingcodes etc. When pressing , number scanning is applied to the current song. The songparameters above the songbox are now replaced by the current play song number and stepsize. The play song number indicates the song that is played during scanning. This can be a song different from the one to be scanned, in which case the latter should be part of the play song by means of invocation or expansion. (Btw: the scanned song may contain max. 12 digits (and an eventual semi-colon at the end); this in connection with straightforward integer calculus - dealing with larger numbers would be useless anyhow, until automatic interplanetary telephony is a fact.) During this mode the following controls rule: Decrease/increase number with the current stepsize. This never affects the amount of digits in a number; 000..0 is followed by 999..9 and vice versa. Initially, the play song is played each time as well. When you wish to in- or decrease the number several times without playing the play song, toggle udio on/off. or both play the current number again, in case it needs to be repeated. simply matches the usual play key - see what suits you.

Enter a new play song number (Range 1 .. 99). Initially the play song number always matches the song number of the song subject to scanning. Having changed this number once will fix it on your own choice perma- nently. Enter a new stepsize. Range is 0 .. 999, yet the number of digits can never exceed those of the scanned number. The stepsize remains fixed unless you'll scan another song with lesser digits - the stepsize will then be adjusted accordingly. <1 .. 0> To combine scanning and phreaking, the preprogrammable keys of the currently active keygroup are also available. (This of course implicitly offers a second way to define a play song.) When exiting this mode, the number song is fixed at the last scan value. 2.5 Guard banding Adding an extra tone when signalling may fool filters into believing you are speaking rather than signalling, and thus will not disconnect your link. Such a tone is called a guard tone. You can choose from and redefine up to three guard tones (G1, G2 and G3) by means of frequency stepping or entering the desired value, each having its own volume. A guard tone can be played either continuously or only when signalling. To toggle the current guard tone on/off press . The field in the infobox at the right above which 'CURR. GUARD:' is printed displays which guard tone is active. Also the GUARD switch is set Y/N accordingly. Initially the tone will be played continuously, indica- ted by a (C) between brackets tailing the GUARD switch. Playing it only during an MF-key's marktime or a song's mark- and spacetime is achieved by pressing . This toggles between continuous or marktime play of a guard tone, indicated by a (C) or an (M) behind the GUARD switch respectively. Picking or redefining a guard tone: is pressed to enter the guard tone editing pop-up box, and must be read as hoose guard tone. still applies and toggles guard tone on/off, and still toggles continuous/marktime play. keys make you choose between G1, G2 or G3. The currently active guard tone changes accordingly. de-/increases the current guard tone with the step size shown in the upper-right corner. Each guard tone has its own step size. Press to enter a new step size (Range 1 .. 999 Hz). Default G1, G2 and G3 have step sizes 25, 50 and 100 HZ respectively. / allows you to enter a new guard tone frequency. Range is 31 .. 4000 Hz. toggles between the frequency- and volume list of G1, G2 and G3. When the latter is shown, keys de-/increase the current guard's volume (ranging from 0 to 15) with step 1. 2.6 Sweep test To scan a line for filters the full ST's in- and out-band range (31 to 4000 Hz) can be sounded, during which the callee should listen for gaps. Pressing makes the sweep-test box appear. The following controls now apply: changes the direction of the sweep. When the upper or lower border is reached the direction always swaps. holds the sweep at the current frequency. <+/-> in-/decreases the sweep delay (Range: 0 to 99) both when sweeping and when holding the sweep. Default is 3, yielding a sweep that takes about 16 seconds back and forth. * As the sweep increases the frequency resolution displays conside- rable gaps. This is due to the way the ST's soundchip (Yamaha YM 2149 or the identical AY-3-8910 from General Instruments) generates its frequencies. The three voices or sound-generators each have an output frequency of 125 Khz that can be divided by a 12 bit period. This yields a frequency range of 31 to 125000 Hz, with a rather restricted resolution of (125000/1 .. 4095) Hz ; part of which are the ones used during the sweep. As a result of this, any desired frequency is actually 125000/ROUND(125000/frequency) Hz. Pending the desired frequency, deviations under 1000 Hz can range from 0 to 5 Hz (10 is the largest step, and frequencies in between are automatically rounded to the nearest (higher or lower) resolution point); deviations in the 1000-2000 Hz can range from 0 to 16 Hz and at the upper border of 4000 hz the highest step is 118 Hz (deviation up to 59 hz). This need not be a problem for phreaking purposes. Central Offices (CO's) can theoretically deal with deviations of up to 1.5 %, whereas e.g. the ST's C5 signals have deviations 0.11 to 0.64 % and R2 has deviations 0.11 to 0.43 %. To have an MF-key's frequency deviation displayed press to toggle this display on/off. Now each time an MF-key is played the deviations in [+/- Hz] of freq1 and freq2 are printed in the MF-key edit box. Note that it is useless to attempt to use the actual ST's frequen- cies: desired frequencies are automatically mapped to the nearest (higher or lower) resolution point and readability would just be unnecessarily compromised. 2.7 Key logging Suppose you guessed a Voice Mail Box access right, stumbled upon a phun number, hacked an answering machine or phreaked a CO success- fully by chance - and forgot what exactly it was you did. Logging your key strokes would come in handy then, which is exactly what happens when the 'LOGGING' switch is set to 'Y' (default). The last 256 MF-key strokes or song plays (whether via the songlist, a preprogrammed keygroup or during number scanning) are recorded, as well as the idle times in between. (Btw: In case you wonder why 256: Don't. I chose this size at random, found it to be not too cheap nor overabundant, and gave it a power-of-two-touch to make dyed-in-the- wool users nod with mundane understanding rather than ask embarassing questions.) Let's have a look at the log report: is pressed to enter the report, which has log entries numbered from 0 to 255. When entering the report, always the most recent log entry is displayed. keys scroll the report one entry up/down. scrolls the report ten entries up/down. jumps to the tail or head of the report. exits (- as it does from all subroutines). As you can see the standard format of a log entry is: "LOG: KEY: FLD: FRQ1: FRQ2: MARK: VOL: IDLE:" which actually is the format of a logged MF-key, and indicates from left to right: LOG : the number of the log entry, ranging from 000 to 255, where lower numbers mean going back in history, KEY : the symbol of the pressed MF-key, FLD : the active fieldnumber during the keystroke, FRQ1: the value of freq1 at the time, in case it's been altered meanwhile, FRQ2: ditto for freq2, MARK: the MF-key's mark time, e.g. of interest when stepping mark times of a line signal (btw: when doorbell mode is active then the doorbell time is recorded - see below), VOL : the MF-key's volume at the time, concluded by IDLE: the idle time between log entry n and log entry n+1, formatted as "seconds:milliseconds", e.g. of use to check the timings you used when phreaking using a preprogrammed keygroup or other- wise. The largest interval measured is 99:999 ms; everything exceeding that is fixed at that number. When phreaking, intervals are never that big - if a CO allows you to play around with an uncompleted line longer dan 1.5 minutes at all. To convert MF-key strokes to songs according to the logged data in a straightforward manner, the actual silences ('space times') between the signals are measured, NOT the key stroke intervals. In the following situations this precise format does not apply and is treated otherwise: - MF-keys instructed to play C4 signals as demonstrated at the end of paragraph 2.2 do not sound freq1 and freq2, nor do they use the MF- key's mark time. Therefore information on FRQ1:, FRQ2: and MARK: for these log entries is replaced by the contents of the MF-key's comment field, which contains the used C4 string. - Played songs are indicated under KEY: as SXX, with XX being the song number. FLD: is filled in pending the type of field specifica- tion used (see paragraph 2.3). Since a song has no specific frequencies or volume only the mark and space time are recorded (unless mark time specification is switched off, in which case that log entry field reads 'OFF'). - Songs with timings overruled by an ATF1 or tone slot timing, as discussed at the end of paragraph 2.3, have a log entry matching 'ATF1 Timing [100 bit/s]' and 'Tone Slots [70ms MARK]' respec- tively. Switching logging on/off: Suppose you wish to complete a few international calls but don't want the phreakholes you worked so hard for displayed on the screen, e.g. in case your younger brother - always seeking for a way to become immensely popular at high school - pretends to string his shoes right behind your back. Unless he has perfect hearing, pressing may offer some minimal protection. This toggles logging on/off, and causes the following to happen: - The MF-key editing box, the information fields on MF-keys in the info box at the right and the information in the song box will no longer be updated and therefore turn grey. All editing functions with respect to this information are now blocked. - MF-keys no longer light up when pressed. - Dialer reset, disk I/O, exiting the RD, calling the log report and program execution (for some of these, see below) are blocked as well, to prevent your relative from saving your ROWDY_DL.DAT datafile on a disk of his own, checking it under GEM, nosing about your logged activities or simply executing your dialer again through program execution respectively. Instead, the two-tone beep alert is sung. - And last but not least, the log report itself is no longer updated. Functions with respect to preprogrammable keygroups etcetera are still active, allowing you to phreak as usual yet without visual feedback. In case you need to leave your ST you can switch logging off pressing instead. You are now prompted for a case-sensitive, alpha- numerical password that can contain up to 15 characters, echoed as X's. Only applies as an edit key. Avoid typo's and remember what you entered, since you won't be asked twice or anything - way to annoying. When switching logging on again pressing , you'll be prompted for it again. Upon forgetting your password, reset your ST or ask your brother in detail how his crack-patch works. Again, this only offers a minimal run-time protection. Having your harddisk password protected or encrypting your disks to make your datafile unaccessible would still be necessary. (I've elaborated a bit on a possible encryption of the datafile to go with the password and concluded it'd be best not to wind up in a tiresome and fruitless arms race with my fellow c0de hackers.) The most recently played MF-key and song information are updated when switching logging on again. 2.8 Miscellaneous functions 2.8.1 Doorbell mode Pressing toggles the doorbell mode on/off (default off). When on, all MF-keys are played whilst pressed. The time you held down an MF-key is counted in the 'D.TIME:' field at the right, in milliseconds. (In combination with a silent (0 Herz or volume) MF- key this could also be used as a simple stopwatch, e.g. when measuring CO responses - of use only for those who can afford a watch NOT having that function.) This allows you to signal longer then 999 ms whenever needed. * During the doorbell mode all keypresses are scanned about 50 times a second (thus giving the D.TIME a resolution of about 20 ms) without a pause after the first hit. As an unfortunate result of this, all input routines that prompt for input directly after a single keypress or -combination would immediately be filled to the brim with a (control-)character. Changing the keyboard rate and clearing the buffer can't meet this problem - the keyboard processor only takes the new parameters into account with respect to keypresses following the current one. Rather than facing this irritating side effect I chose to unele- gantly BLOCK all input routines yielding a prompt after a single keypress. Those comprise song editing, comment editing, direct mark time editing and changing the <+/-> mark steps. Remember this when using the doorbell mode ! All two-step input (e.g. via the MF-key edit box or other pop-up boxes) is not affected by this side effect and thus normally available. All other functions as <+/-> stepping, switching func- tions Y/N etc. are buffered from the high sample rate, resulting in a slightly different 'feel'. Preferrably, you'd switch the doorbell mode off when not needed. Changes made to an MF-key's mark time will of course only be effective when leaving this mode. 2.8.2 Adapting key buffers Controls with respect to MF-key and song usage can be influenced by toggling the BUFFER switch Y/N by pressing . Swapping between BUFFER1 and BUFFER2 to reach their setting is done by pressing . BUFFER1: is the MF-key buffer. Subsequently playing MF-keys or ploughing through MF-key fields is buffered when switched on. BUFFER2: is the song buffer. Playing preprogrammed keygroups or the current song, as well as in-/decreasing, repeating and playing keygroups during number scanning are buffered. The settings of those two is totally subject to personal taste. Usually buffering commands gives a smooth feel, but if you haven't grown used to the controls yet and find yourself repeating signals by mistake too frequently, switch either one off. The buffers are switched off automatically when the doorbell mode is switched on - the direct and high key sample rate would just stuff them beyond reason. Their original switch settings are restored upon quitting the doorbell mode. Both buffers are active by default. 2.8.3 Program execution In case you wish to possibly read/update a scanlist when phreaking or control your modem after hooking up to a carrier, executing an editor or a terminal program whilst keeping the RD resident is possible by means of program execution. Pressing makes a fileselector box pop up, showing the contents of the current drive's root directory. Simply seek your favorite executable and double-click it. (The created path will be stored for later use.) Upon finishing you'll return to the RD as it was. (Using a Kuma Switch-oid tool can of course do the same for you !) Executing resident programs is not allowed. 2.8.4 Resetting your dialer Pressing shows the reset box. Use the keys to choose the data set you wish to reset, and confirm with . By doing so your RD resets to (part of) the data it initializes with when starting up. ALL CHANGES you made with respect to the chosen data set WILL BE *LOST*; if needed SAVE your changes first (see below). The three data sets comprise: ALL : current field 0, field comment, MF-key attributes: freq1, freq2, mark times, volumes, comment, song attributes: songs, their fields and mark times (plus setting on/off), space times, song comment, current song 01, preprogrammed keygroups, current keygroup 0, guard attributes: frequen- cies, volumes, step sizes and current guard G3. SONGS : Song attributes: songs, fields and mark times, space times, song comment, current song 01, preprogrammed keygroups, current keygroup 0. MFKEYS: current field 0, field comment, MF-key attributes: freq1, freq2, mark times, volumes, comment. The values of 'ALL' match those in the initial 'ROWDY_DL.DAT' datafile that came with the dialer. (I furnished the dialer according to my own taste using the various editing functions described, then saved and merged it with the source in the same format.) For comments upon these presets see chapter 3. 2.8.5 Saving your modifications The disk I/O box pops up by pressing . As with resetting the keys apply for choosing, and for executing a disk command. The choices are: LOAD : Loads all data from the datafile 'ROWDY_DL.DAT', to be present in the (sub)directory you executed the RD from. When it's missing the beep alert will sound whilst printing 'NO.DAT'. The restored data equals the summary concerning data set 'ALL' in paragraph 2.8.4., except the information on current field, current song, current guard and current keygroup. Those four parameters contain the values active when you last saved your changes; thus allowing you to pick up phreaking exactly where you left it. SAVE : Saves all data as described above to 'ROWDY_DL.DAT'. Your last save (if present) will be moved to a last but one version named 'ROWDY_DL.BCK' for eventual backup recovery. VERIFY: Compares the contents of the datafile with the current settings, except for the relatively unimportant (cosmetic) parameters: current field, current song and current guard. 'NO.DAT' appears when the datafile is missing, 'NOT OK' when the datafile doesn't completely match the settings and 'OK' when it does. 3 PROGRAMMING EXAMPLES 3.1 A word on the presets This section comments upon the initial values your RD starts up with or was resetted to. Since the various frequencies and their meanings are displayed quite clearly through the user interface, frequency tables and redundant commentary have been left out. Though subject to my personal taste, you'll find the current division quite workable. FIELD 0: Contains CCITT #5 signals. 14 Interregister and 2 line signals are present. The missing 'code 12' signal (delay operator) can be found in field 4, and could (when program- ming a song) be invoked by means of field overruling. FIELD 1: Is programmed with CCITT #4 forward signals as demonstrated in paragraph 2.2. Again the four missing (interregister) signals (two space codes, code 12 and incoming half-echo suppressor required) are stored at field 4. Backward signals are not included. For those interested they are: Proceed-to-send (Terminal) X Proceed-to-send (International transit) Y Number-received P Busy-flash PX Answer PY Clear-back PX Release-guard PR (read: PYY) Blocking PX Unblocking PR (read: PYY) The specified single frequencies on these MF-keys (overruled by the C4 specification and thus for use in songs only) are the tone slot frequencies. FIELD 2: Contains all R2 forward interregister signals, and FIELD 3: contains all R2 backward interregister signals. The forward signals can have three and the backward two possible meanings (group 0, I or II and group A, B respectively), pending the phase of the quite talkative protocol (which is way too comprehensive to elaborate on in this document). FIELD 4: Apart from the missing C4 and C5 signals as mentioned above, this field contains the C4 signal elements as shown in the table in paragraph 2.2 for use in songs, a 2280 Hz MF-key for use in C3 sequences and the bit 0 and 1 frequencies for use in ATF1 (B-Netz) bitstrings. FIELD 5: Contains three types of redbox frequencies for different systems (named ACTS, IPTS and non ACTS) and the greenbox frequencies alert, coin collect, coin return and ringback. The remainder of this field as well as both FIELD 6 and FIELD 7 are filled with modem tones, subscriber information tones and several other frequencies that may be of use to fool operators (some should be combined first), make shy modems answer, reprogram private switches or whatever use you would have for them. When for some reason you feel like 'adding' other signalling systems (better: shuffling the current division on behalf of e.g. Italian OOB-MFC, French SOCOTEL, German IKZ 50 or C4 backward stuff), field 6 and 7 are probably most appro- priate. You can always regain the original values by resetting your RD as illustrated in section 2.8.4. FIELD 8: is filled with several line signals, to be used in various signalling systems. To fill the comment fields highly uncreative and straightforward meanings have been added. FIELD 9: concludes this summary and contains all DTMF (or Touch Tone) frequencies. The use of A, B, C and D tones can be stumbled upon in a number of occasions. In military networks their meanings are Flash Override, Flash, Immediate and Priority. In contrast with all volume settings elsewhere applied, the DTMF volumes are default 13 instead of 15. This is done to avoid recognition problems that easily occur when DTMF-ing too loud. The following songs are preprogrammed with systems using signals consisting of several signal elements rather than a single signal: 38 .. 40: Redbox payphone coin signals indicating a nickel, dime and quarter (non ACTS system). 41 .. 43: Same as 38 .. 40, using the ACTS system MF-tone. 44 .. 46: Same as 38 .. 40, using the IPTS system MF-tone. 47 .. 61: CCITT #3 pulse signals. 66 .. 85: CCITT #4 forward signals. 86 .. 99: ATF1 signals. To sequence these signals by means of song invocation more comfor- tably, effort has been made to make digits match the second digit of the song number. 3.2 Programming examples To illustrate a few practical appliances of your RD some programming examples have been added. They are commented upon in the next paragraphs. Realizing a desired sequence can of course be performed in a variety of ways given the flexibility w.r.t. song programming; the examples only display one possible way to do so. Songs that are still '-- undefined --' will play strings from field 0, using MF-key mark times and 50 ms space times by default; i.e. the popular C5 interregister signals and timings. Filled with both educational and possibly useful songs as it is, the songlist initially contains only 25 undefined entries. Don't hesitate to overwrite all songs you have no use for, since resetting your RD (see 2.8.4) will restore them whenever needed. After discussing all functions in detail as I have by now, the following better be a blunt insult to your intelligence. 3.2.1 Some signalling sequences Song 01: To turn an undefined (FLD: 0, MRK: 50, SPC: 50) song into a DTMF number press: <9> to use field 9 DTMF tones, and to overrule the MF-keys' 80 ms mark times (smooth when dialing manually) with speedier 50 ms mark times, to edit / enter your (DTMF) string, and to eventually add a comment. Song 27: plays a C5 string and thus uses the default parameters. Song 28 and 29: song 28 invokes its country code part in song 29; together they equal song 27. Song 37: To play tone slots press <1> to use field 1 tone slot frequencies, <'TSL: ..'> to overrule the timings with tone slot timings as mentioned in paragraph 2.3. to edit / enter tone slots. 3.2.2 Pulse signalling Song invocation can a.o. be of use to play pulses with an interval of their own within a sequence having a different (larger) interval: Song 30: Plays C3 pulses by means of invocations. Each C3 digit (song 51 through 56) has its own field specification and timings - only the space time of song 30 applies and spaces the digits. The space time was enlarged by pressing <500> . Song 31: Plays C4 signals (song 71 through 76) spaced by 140 ms. Song 62 .. 65: Use invocations to play an ATF1 string. Since one song can contain 8 invocations only, extra songs are concatenated by use of the song expansion character ';'. The 600 ms preamble can not fit one song (25 ATF1 0-bits on a row only last 250 ms) and is realized by three times invoking a 200 ms preamble (song 86). To extend this ATF1 string song 66 could be added as well (e.g. to make a double ATF1 string; not to add 8 more digits to the bogus 22-digit phone number in this example), since expansion is parsed effectively up to 4 times as mentioned in paragraph 2.3. To program an ATF1 string, make sure the timings of the first song are overruled by the 100 baud ATF1 timing by pressing <'ATF1: ..'> (again: see 2.3 for more detail). This overrules the timings of both invoked and concatenated songs, so you'll only have to enter it once. 3.2.3 Dividing phreak stages Four typical C5 phreak stages have been split up under keys <1 .. 4> on the main keyboard, belonging to keygroup 0 (which is active by default). They illustrate the generic idea w.r.t. keygroup usage as mentioned in paragraph 2.3. When pressed, they jump to and play song 01 (DTMF number), song 32 (clear forward signal), song 33 (seize signal) and song 28 (C5 string) respectively. This way you can repeat a stage whenever needed, e.g. by using your left hand's little- through forefinger whilst stretching a nostril with the right one. Song 32 and 33 have their specified mark time switched off, so that the MF-key's mark time they refer to can be altered by means of the <+/-> keys as shown in paragraph 2.2. Preprogramming these keys was done by first scrolling to the desired song, followed by pressing <1 .. 0>. All other preprogrammable keys will initially jump to and play song 'XY', where X is the number of the current keygroup and Y is the digit of the pressed key (e.g. pressing <3> and <7> reaches song 37). (Necessary exception: key 0 of keygroup 0 is mapped to song 01.) 3.2.4 Auto-phreaking When a phreakhole has stable responses and you know the intervals and timings, you can easily combine several signalling systems in order to phreak by means of a single keypress. Song 34 shows one possible way to do this. This song first plays a DTMF number followed by a 12.5 second pause, three clear forwards of 120 ms with intervals of 0.5 second, a 120 ms seize, another 0.5 second pause and ends with a C5 string. In detail this song reads: s01 : invokes the 50 ms mark and space timed DTMF number in song 01. ........ : plays eight times the dot MF-key in field 8, which is a 999 ms pause (silence), spaced by nine times the song's 500 ms space time. This adds up to an almost 12.5 second pause. f0(f0(f0( : plays the '(' MF-key of field 0 three times (a 120 ms clear forward) by temporarily overruling the song's field specification. Intervals are still 500 ms. f0); : plays the ')' MF-key of field 0 (a 120 ms seize) using field overruling as well. The expansion character ';' concatenates song 34 to song 35, spaced by song 34's 500 ms space time. s27 : invokes the C5 string in song 27 which uses MF-key mark times and 50 ms space times. In this example, completing calls to different destinations using the same phreakhole can be done by invoking different C5 songs in song 35 rather than changing the contents of song 27. 3.2.5 Scanning country codes If you wish to examine what countries you can reach via a certain CO using C5, number scanning combined with song invocation comes in handy. As an example, song 28 and song 29 contain C5 strings with identical timings. Song 28 plays its country code part by invoking song 29. Simply scroll to the latter and press to make it subject to number scanning. All controls as explained in paragraph 2.4 now apply. When in-/decreasing the country code the complete C5 string can be played by pressing

<28>, which redefines the play song to song 28. When using the preprogrammed phreak stages under keys <1 .. 4> on the main keyboard as demonstrated in paragraph 3.2.3, it is handier to use key <4> to play the play song. In that case you should toggle udio off to in-/decrease the country code silently. APPENDICES A: Trouble shooting Some of your RD's features can have puzzling side effects, e.g. functions overruling standard procedure. They have already been described in detail in this manual, which is probably the reason you missed them: * Some songs don't seem to respond to the specified mark and space timings. Remove the 'ATF1:' or 'TSL:' string heading their comment fields. These overrule the specified timings as discussed at the end of paragraph 2.3. * Editing song parameters, comments, mark times or the <+/-> mark steps suddenly seems impossible. These functions are blocked when the doorbell mode is active. See 2.8.1 for an explanation, or just toggle it off by pressing . * The volume of an MF-key varies now and then. Make sure that freq1 and freq2 have different values. If not, soundwave interference may muffle the volume. * Some MF-keys persistently play C4 signals, no matter what frequen- cies or mark times I enter. Remove the 'C4:' string heading their comment fields. These make them signal C4 strings as mentioned at the end of paragraph 2.2. In songs the specified frequencies and mark time still apply. * The user interface looks like a mess since tear-gas bombs are fired through the window. Burn your notes and deny everything. B: Where to get the Demon Dialer? For ordering Demon Dialers dial Hack-Tic's Voice Mail Box number: +31-20-6001480 The do-it-yourself package includes a preprogrammed MC68HC705C8P/DD chip, a keyboard print, a processor print (both 65 x 72 mm), keys, all necessary analogue parts, a battery holder, an operation and reference manual and a very clear construction manual. Hack-Tic's address is: Hack-Tic (Technologies) P.O. Box 22953 1100 DL Amsterdam The Netherlands Fax: +31-20-6900968 C: Acknowledgements I would like to thank CarloKid for his (sounder than GFA's) sound routines, Hackbear for his (non-loop) timer routine, Arie for his scanning gear, the Hack-Tic illustrator KoHo who's fun drawings I digitized without asking, Troed and Zaphod for their excellent BBS- services, ItsMe for making me go astray and Pieter for pretending sincere interest during the development of this program. Thanks guys!