
               [ Hoahoa gillar bondagesex, med Rick Flair ]

                              \_________/
                              /\___|___/\
                             / /\__|__/\ \
                            / / /\_|_/\ \ \
       THiS FiLE WAS_______/_/_/_/\|/\_\_\_\___$$:AmigaSpirit
    DoWNLoADED FRoM:      /\ \ \ \/|\/ / / /\ +46-(0)340-84200
  28.8&28.8 DS /X 4.xx   /  \ \ \/_|_\/ / /  \ +46-(0)340-27740
    $y$ Terrorizer    /    \ \/__|__\/ /    \ [$$:ARViD TuBA
        _\/_____ ____ _/___ __\/_ _|___\/______\ ____ __  ______ ____\/_
         / V    V  _ V ___/ V    V ___/ V __/ _ V    V  \ V ___/V __/ \
     | [] | | \| __|| || | __||__ | __| [] |   \| __||__ |
       |    | |__| |__| || | | _| | ||    | |> | |_____| |
        | []_|____|____\| ___| | /___| || []_|____|________ |
           |/   V    V    V |/   |/     V   |/  |/   V    V        \|
           |    :    |    . :    |      :   |   |    :    .         |
           :    .    :      :    |      .   .   :    .              :
                           '    |                                  
                                 |
                               /\o/\
                               /\O/\
                                 "
Uploaded:06-May-95  Time:01:05:47  By:network             On Node:1



          _/l__________/\________/\______
         (__.  ____ _____)  _______)__. )----------.--------------.
         / |  |  _  /  \  \ |  \ |  \ SHQ '95  |+46 476 16656 |
         \___  |__|  \_  /___  l_  /  |__/ Violator |--------------'
          . `--' `---'\/tG`--'\/   :-----------.-'
nOTE! - oRIGIN aRE cURRENTLY lOOKING fOR tRADERS wORLDWIDE - cALL uS nOW!!
         .-----------------------------------------------------.
 _ __/\______/\_____    ______/\________/\__/\_/\_____________/\___________ _
    \       \       \  /     \       \     /  \_       /    _     /      /
     \__/\   \__/\   \/  /\   \__/\   \   /    /  /\__/\   /    //  __  /
     /   /   /   /  _/    /   /   /   /  _   _/   __/\  \_/    /\    \/
 _ _/    ___/   _   \_   /   /    ___/   /   \    \   \  /    /   \    \__
    \ ___/ / __/\    _____ _/\___ / \   /____/\ ______ \/    /\_______ /
     \/   \/    \  /    \/     \/   \_/       \/   \_______/ xCz/rVn\/
                 \/                                             
  __/\__ :      _ ____/\__/\   ___/\_    _/\__   _/\______ _     :
  \    /          \__   /  \_/      \  /    /   \       \       
  /    \ |          /   /    /  _/\   \/    /    / __/\   \__ _  |
  \/ |     _ __/   _    /     /   /    / /\ /     /   /    __/\__
         |        \    /   /\    /   /\   /  X_   _/   /     \    / ---.
         |         \  /___/  \_____ /  \_____ __/_______/      /    \    
  /X4.7            \/            \/        \/  \/             \/    |
   aMI                                                          |       |
  pEZe!  :               -{ nERO/pARADOx^sCUm }-                      |
 cONSOLe       -{ zYCh!/cLSeXERON&mANIAC/eQXsTORM sHADOW}-  : 4 nOdEZ!
 -dAYZ!         -{ sHARk^wAVEfRONt/pSGzEPHYR&cRUZ/fLT }-     pHANtASY!
         .                                                       .       
         `- -  - ------------------------------------+-- -  - -;       
                  sPECiAL oFfER! nO nUP 4 dA mOMENt!            `-------'
     .-----------------------------------------------'
     `- -> diAL! +46-476-21262, +46-476-21OO5, +46-476-21726 +46-476-21253
 [sAMEuSER.dATA^-^sAMEfEELING^-^sAMEsYSOP^-^sAMEcOSYSES^-^nEWnUMBERS!]
                                                                    __
   .------------------------------------------------------------- -\/---.
   |_________ _________        _____   ___:_          .____  ______  ___|__
_____\_____  .|\   ____/_______|    /._/   |___________|    \_\_____\/_____/__
\      ___/  || \______  \ /   \_    |          :  /        :     \/       /
 \____________|___________/______    l___________l_/__________|_____/       /
___|___ _______________\_____________|_____________________________/_______/__
\__:___\\_____________________________________________\/_________________:___/
   :aC!                                              \/\/                |
   `-------------------------------------------------TRE!----------------'
     [tRSIsWEhQ!][dPLeUROhQ!][bACKaGAINaFTERAfEWmONTHSoFsADNESS!]
  [tHEwELLKNOWNaSYLUMfEELINGwILLbEhEREsOwILLyOURaCCOUNTcALLbACK!]
 [sYSOP:jUAN/tRSIcO1:hARPOON/sRcO2:hIJACKER/cLScO3:fRANTIK/tRSIcO4:mAGMA!]
 [nODE.1 +46-31-eLITEkNOWS!] aSK aNY eLITE dOODE [nODE.2 +46-31-eLITEkNOWS!]

THE VOID BBS.....
                       ___                _____
             ___/\____|  .|__/\____  ____|    /___  ___ _____/\
      .------\_   _/  |_ ||   ____/--\   |   / __ \|  .|\____  \_- ---.
      |      _/   |   _/ |   _/  \_  \  :  /  |:  \  |/   |   /     |
      |  \____|___|___|________/\___/\______/___|_______/(K)  |
      |                                                               |
      |   (9) 28.8 MODEMS     +1-414-276-0785     FAAAAAAAAST!        |
      |  (12) GIGS OF FILEZ   +1-414-276-0860     COOOOOOOOOL!        |
      |                       +1-414-276-0722     HOOOOOOOOOT!        |
      |     AMIGA/CONSOLE     +1-414-276-0461                         |
      |         PC            +1-414-276-0782                         |
      |                       +1-414-276-0785                         |
      |   OPEN TO PUBLIC      +1-414-276-0790                         |
      |     FOR 1 WEEK        +1-414-276-0860                         |
      |                       +1-414-276-0868                         |
      |                                                               |
      `---------------------------------------------------------------'
THE VOID BBS....
 - --( Uploader: sigma             Date: 03-May-95 19:31:53    Node: 05 )-- -
     ( Location: HiDDeN EnErGy Ur  BB-TxtAdder v0.7 by BiLBo BaGGins/M! )

@BEGIN_FILE_ID.DIZnew and improved manual for cellular phone
hacking ... compiled from 18 separated docs
by sigma
@END_FILE_ID.DIZ
CELLULAR PRHEAKING MANUAL COMPLETE AND REVISED
(Compilation by sigma, EUROTICA BOARD, +598-2-776743)

PART I.          WHAT IS BROADCAST FROM A CELLULAR TOWER?

        When a cellular phone makes a call, it normally transmits it's
Electronic Security Number(ESN),Mobile Identification Number(MIN),it's
Station Class Mark(SCM) and the number called in a short burst of data. 
This burst is the short buzz you hear after you press the SEND button and
before the tower catches the data.  These four things are the components
the cellular provider uses to ensure that the phone is programmed to be 
billed and that it also has the identity of both the customer and the
phone.

        There are usually two cellular phone companies in an area.  One is
the wire-line carrier (Band B), which is usually Bell, and the other is the
non-wireline carrier (Band A). Within the two bands are 832 cellular phone
channels.  Each one has 416 bands, and within the bands are voice channels
that actually transmit and receive information from cellular phones.

        The ESN and the phone number (MIN) are the two primary identifiers
for any cellular phone.  By changing both, the cellular carrier will accept
the call and bill it to either a wrong account or provide service based on 
the fact that it is NOT a disconnected receiver.  It will also look at the
other two components, in order to insure that it is actually a cellular
phone and to forward billing information to that carrier.

        The Station Class Mark can also be changed if you wish to prevent 
the cellular carrier from determining the type of phone that is placing the
call.  By providing the cellular tower with a false SCM, the cellular
carrier, the FCC, or whoever happens to chase down cellular fraud is often
looking for a particular phone which in reality is not the phone they are
looking for.  For example, you can provide the SCM for a Radio Shack phone,
when in reality you are using a Novatell (How this is done from changing
the SCM I do not know...remember...I didn't write this).

        The Number Assignment Module (NAM) also has the SIDH (System
Identification for Home System) number programmed into it.  Refer to SIDH
TABLE.  The transmittal of the SIDH number tells the carrier where to forward
the billing information to in case the user is "roaming".  The SIDH table
tells the major cities and their identifying numbers.  Changing an SIDH is
programming job that takes only minutes, but be aware that the ESN is still
sent to the cellular phone company.  After they realize that the ESN is 
connected to either a fake number or a phone that is not in the network, they
will block service.  They only way around this is to reprogram the ESN.
PART II.                      DEFINITIONS


The following is a list of commonly used abbreviations used in cellular
phones.

SIDH

A 15-bit field in the NAM designating the System Identification for the Home
System.  Bit 0 of the SIDH corresponds to the Preferred System flag used
elsewhere in the NAM.  Bits 6 and 5 of byte 0 are international code bits.
Normally the SIDH is entered during programming of the phone as a 5 digit
decimal number.  Enter 0's to the left-most unused positions when 
reprogramming.

L.U.

Local Use Flag.  Tells the cellular phone user if it must preregister with
the system.  Preregistration with the system means that a mobile must 
transmit its parameters to the Cellular System as soon as the power-up
task and the control channel tasks are completed. "1" enables the flag.
Usually set to "1".

MIN MARK

A 1-bit flag designating that MIN2 (area code) is always sent when making
system access.  "1" enables the flag.  Usually set to "1".

MIN2

A 10-bit field representing the area code of the mobile ID number.

MIN1

A 24-bit field representing the mobile telephone number.  MIN2 plus MIN1
equals MIN, the 10-digit phone number.

SCM

A 4-bit field designating the Station Class Mark. A (3-Watt) 832 channel
mobile unit typically will be 1000, a 1.2 Watt portable 1001 or a 0.6 Watt
handheld 1010 or 1110 (discontinuous transmission, meaning push-to-talk).
These are class I, Class II and Class III power levels respectively.
With the SCM the cellular system determines whether or not a cellular phone
can be switched to one of the 156 channels.
        Bit-1 is "0" for 666 and "1" for 832. (See cellular freq. list)
        Bit-2 is "0" for a mobile unit and "1" for a voice-activated 
          transmit.
        Bit-3 and -4 identify the power class of the phone: 
                "00" = 3.0 watts
                "01" = 1.2 watts
                "10" = 0.6 watts
                "11" is not assigned

IPCH

An 11-bit field designating the initial paging channel to be used if in
the home system.  Normally it is 334 for wireline systems, 333 for non-
wireline systems.  But most phones allow other settings for test purposes.

ACCOLC

A 4-bit field designating the overload class for the cellular phone.  The
intention of this entry is to allow the Cellular System to be able to 
determine priority in the event of a system overload, however it is currently
useless as the system operators have generally not provided guidance for
thier installers.  The usual (and correct) system now in effect (in U.S.) is
to use a "0" plus the last digit of the phone number.  Test phones should be
set at "10",emergency vehicles at "11","12" through "15" are reserved.
(A class 15 system is supposed to be police, fire, or military).
P.S.

1 1-bit flag designating the preferred system.  If PS is "0", channels 334
through 666(EVIL!!!) are used.  If PS is "1" then channels 1 through 333 are
used.  Even numbered system numbers (B systems) require a PS of "0", odd
system numbers (A systems) require a "1".

GIM

A 4-bit field designating the Group Identification Mark.  This number tells
the Cellular system how far to look in the SIDH to determine if it is roaming
in a system which may have a roam agreement with the phone system.  It is
usually set to "10".

LOCK DIGITS

A 4-bit field designating the unlock code.  The digit "0" in the lock code
is represented by an "A" in the actual NAM hexidecimal data.  A lock code of
all "0" sometimes unlocks the cellular phone.(Note: Lock codes are 3 digits.
When programming a phone use "0" as the first number.)

E.E.

A 1-bit flag designating that end-to-end signaling is enabled.  End-to-end
signaling means that the DTMF tones will be transmitted on the voice channel
as well as being echoed on the handset.  This feature in necessary for
such services as Bank by Phone, activating answering machines and in third
party long distance services such as Sprint and MCI. A "1" enables the flag.
Usually set to "1".

REP

A 1-bit flag designating that repertory memory (speed dialing) in the
cellular phone is enabled.  And once a again a "1" enables the flag.

H.A.

A 1-bit flag designating that the horn alert feature in enabled. "1" enables 
the flag.

H.F.

A 1-bit flag designating that the handsfree option is enabled. A "1" enables
the flag.  Often, transceivers supplied as hands-free units require that
this flag be left at "0".
PART III.                      TYPES OF NAMS

                     NAM Types Used in Cellular Phones

NAM- Number Assignment Module - A 32 word by 8 bit PROM
The NAM contains all the information that can be programmed to the phone
directly from the handset. (i.e. SIDH,MIN,LOCK-CODE,etc.).

All phones except NEC will accept tri-state NAMs.  NEC requires an open
collector NAM.  Fujitsu phones will accept either open collector or tri-
state NAMs.

Brand Qualifications:  Fujitsu and Alpine phones will not operate properly
with any Harris Brand NAM or with any Signetics brand NAMs with a part
number NOT ending with an "A".  TI NAMs must not be used in GE Star models.
Panasonic has suggested only TI NAMs should be used in their phones.  NAMs
are available in ceramic (F) or plastic encapsulation (N).

BRAND        OPEN COL.    TRI-STATE      OPEN COL.        TRI-STATE
=============================================================================

Signetics        82S23       82S123

Texas Inst.     74S188       74S288     TBP18SA030        TBP18S030
                                        
AMD           AM27LS18     AM27LS19        AM27S18          AM27S19

Texas Inst. TBP38SA030    TBP38S030

Harris          HM7602       HM7603

MMI            53/6330      53/6331

MMI          53/63S080    53/63S081

NSC           DM54S188     DM54S288       DM74S188

NSC            DM82S23     DM82S123

Motorola   This is for a special NAM used in some Motorolas.  Requires
           an adapter.

Fujitsu         MB7056       MB7051

PART IV.                        NAM FORMAT MAP

                                                               HEX
MARK DEFINITION    MOST <-  BIT SIGNIFICANCE ->  LEAST       ADDRESS   
----------------------------------------------------------------------------
                  0         SIDH (14-8)                        00 
                            SIDH (7-0)                         01
LU=LOCAL USE**    000000          MIN                          02
LU                A/B*  RI*       MIN2(33-28)                  03
                            MIN2(27-24)       0000             04
                  0000      MIN1(23-20)                        05
                            MIN1(19-12)                        06 
                            MIN1(11-4)                         07
                            MIN1(3-0)         0000             08
                  0000      SCM(3-0)                           09 
                  00000     IPCH(10-8)                         0A
                            IPCH(7-0)                          0B 
                  0000      ACCOLC(3-0)                        0C  
PS=PREFERRED**    0000000   PS                                 0D
   SYSTEM         0000      GIM(3-0)                           0E 
                   LOCK DIGIT 1           LOCK DIGIT 2         0F
                   LOCK DIGIT 3           LOCK SPARE BITS      10
EE=END TO END      EE           000000          REP            11
  SIGNALING        HA           000000          HF             12
REP=REPERTORY      ----------------------------------------------
HA=HORN ALERT                                                  13
HF=HANDS FREE                                                  14
                                                               15
                                                               16
                              SPARE LOCATIONS (13-1D)          17
                              CONTAIN ALL ZEROS EXCEPT         18
                              FOR MANUFACTURERS OPTIONS        19
                                                               1A
                                                               1B
                                                               1C
                                                               1D
                                    NAM CHECKSUM ADJUSTMENT    1E
                                    NAM CHECKSUM               1F 
                                

The Checksum Adjustment and Checksum are calculated automatically after
the data has been edited for the NAM.  The sum of all words in the NAM plus
the last two must equal a number with "0" in the last two digits.  The radio
checks this sum and if it isn't correct, the radio assumes the NAM is bad or
that it has been tampered with.


 * - These bits are used only by AT&T,Hitachi and Mitsubishi. They are A/B
 Enable and Roam Inhibit. They must be "0" for all other models.

** - My information does not agree here. One source claims that address 03
     has 6 bits and that address 0D has 7 bits. The other source states the
     the exact opposite.
PART V.                     STANDARD NAM FORMATS

        NAMs are generally mapped the same in all cellular phones, and the
ones that have no "fancy" options are generally programmed the same.  This
chart provides the usual digits and settings for almost every NAM.

ITEM        DESCRIPTION             NO. OF DIGITS         USUAL SETTING
--------------------------------------------------------------------------
1           First 3 digits               3                     XXX
            of phone number

2           Last 4 digits                4                    XXXX
            of phone number

3           Lock Code(LOCK)            3 or 4               XXXA or XXXX          

4           Area Code (MIN2)             3                     XXX

5           Home Area System
            ID No. (SIDH)                4*                   XXXX

6           Horn Alert (HA)              1                    0 or 1

7           Hands Free (HF)              1                    0 or 1

8           End-to-End Signaling         1                      1
            (EE)

9           Repertory Mark (REP)         1                      1

10          Group Identification         2                     10
            Mark (GIM)

11          Access Overload Class        2                     XX*
            (ACCOLC)

12          Station Class Mark (SCM)     4*                   XXXX

13          Local Use Mark (LU)          1                      1

14          Min Mark (MIN)               1                      1

15          Initial Paging Channel       3                 333 or 334*
            (IPCH)

16          Preferred System Mark        1                   0 or 1*
            (PS)

* Notes- 

   1. Home Area ID Number normally consists of five digits. However, four
   are usually sufficient is the U.S.

   2.  Access Overload Class is generally made up of a "0" plus the last
   digits of the telephone number.  Some systems set at "15" or "00".

   3. Station Class Mark is expressed as four binary digits.

   4. Initial Paging Channel is 334 for wireline, 333 for non-wireline
   systems.

   5. The Preferred Mark System is set to "0" for wireline, "1" for non-
   wireline systems.


                                   

                          P A R T   O N E                                



It turns out that there are several Japanese handheld transceivers (HT's)

availible in the US for use by ham radio hobbyists that have hidden

features allowing them to operate in the 800MHz band used by cellular

telephones. Using an FSK decoder chip and a personal computer running an

assembly language program to record and decypher the ID beeps at the beginning

of cellular calls, a "phone book" of cellular ID's can be compiled. A simple

FSK oscillator controlled by the PC can then be used to dial out using the

Handheld Transceiver and the captured ID codes.



A low tech analysis could be done by taping the beeps and playing them back

at slow speed into an oscilloscope. An edited tape may even be adequate for

retransmission; no decyphering required.



Several radio stores in Los Angeles sell the HT's and have given advice in

the past about how to access the hidden out-of-band tuning features in the

ROMS of the Japanese HT's. It's possible now to listen in to cellular

phone conversations without building any special hardware. In fact if you

have a good antenna, or live near a cellular repeater tower, you can

pick up celluar calls using a UHF TV with a sliding tuner by tuning in

"channels" between 72 and 83 on the UHF dial.



Beside the obvious benefits of unlimited, untraceable, national mobile

voice communication, there are other uses for cellular hacking.

For instance: most people using cellular phones are pretty upscale.

It may be possible to scan for ID codes of the telephones of major

corporations and their executives and get insider stock trading information.

Simply by logging the called and calling parties you will be able to compile

a database mapping out the executive level command & communication structure.

If this is linked to a remote controlled tape deck you will know precisely

what is going on and be able to note any unusual activity, such as calls

between the executives of corporations that are in a takeover or leveraged

buy out relationship. It is even likely that you will occasionally intercept

calls between investors and their stock brokers, or calls discussing plans

for new contracts.



This data is most safely used for insider trading of your own; there will be

no way that the Securities and Exchange Commission can establish a link

between you and the insiders. A more risky proposition would be to offer any

intelligence gathered to competitors for a price as industrial espionage.
                __________/\______     /\_________  /\__________/\
              _/  _____  /___    /__  /_______    \/  _   \____   \
             _\_____   \/   /   /   \/   /   /____/   /   /   /   /
             \    _/   /   /   /    /   /   /    /   /   /   /   /
              \___    /\__/\___    /\__/\___    /\______/\__/   /
                 \___/        \___/        \___/- SiLiCON! -\__/

                               Member Board

nOTE! - oRIGIN aRE cURRENTLY lOOKING fOR tRADERS wORLDWIDE - cONTACT uS nOW!!
                  _            _        _       _           _
       _        /(_____  _____)\  _____)\     /(_____  ____)\_     _
      / \        \     /  \     /  \     /     \     /  \     |    / \
     /   \      /  .  \  /   --\  /   \     /  .  \  /  l__|   /   \
    /     \    /       \/       \/    T\   /   |   \/    _)   /     \
    \_. ._/   \/    T    \        \    :   \ /         \    \    \_. ._/
      /_\     /\   _|____/_______ /______  / \ ________/ ___/      /_\
               \ (             |/   >vnz\/   \|       \/
              _  \/        _     _    _       !_            _
    /\   /\ /(_____  _____)\____/(_  /(___    /(_____  _____)\ /\   /\
 /\/  \/\/  \\   __/  \     /\     /  \__  \   \     /  \     //  \/\/  \/\
 \/\  /\/\  //     \  /    \/  .  \  / |\  \  /   \  /   \\  /\/\  /\/
    \/    \//T   \/    __/       \/  !   \/    \/T   \\/   \/
           /         \    \/    T    \        \        \        \/
           \   ______/__  /\____|    /______  /________/_____   /\
            \ (         \/      | __/       \/               ) /  
             \/#1 +46-340-84200 |/      SysOp:AMiGASPiRIT    \/    
               #2 +46-340-27740 :     CoSysOp:ARViD TuBA
               #1 28.8DS #2 28.8DS      CoSysOp:Terrorizer
                          Locked at 57600 for Speeed
                    -  - -->A \x/arBerGer BoARD<-- -  -

    [ Denna fil passerade genom sveriges enda bas med kravmrkt sysop ]


                                               Stripped with TextStrip 0.27
                                               

 Ŀ
                         [WHERE_INFORMATION_IS_FREE]                         
                                           |
 |                                         :
 :                                           .
 .         +46-(o)16-3589o2 - 2:206/408@FidoNet - 14400 Bps, Open 24h         
       Textfiles - PC-Files - Modules - Cyber-related - P/H/A/V/C Areas
               Official HSi/iHA Distsite! I.N.I HQ! C.L.F SHQ!
