        The muther fuckin awesome Telix Hacker (TH, duh) for IBM and
             IBMish type komputers. If you run Telix, then you can
             use this. If not, you wasted some filez pointz.

      Shawn-da-Lay Boy Productions (tm) (c) 1989, 1990, 2001...
            In cooporation with the Macro 2 division of
                     Insanity Softwarez Inc.


                Opening shit: Version 0.40 Beta

     Inspired by Phry Code Pro, fellow travelers, and cause I wanted to
     see the shit on my screen.  And cause I wanted to show the awesome
     power of Telix scripts. (Waste of time to tell phuckin pirates
     to register Telix). Good for Telenet, PooPnet, or any other
     komputer that you wanna hack on. I don't approve BBS hacking so,
     SYSOPs, don't blame me if some fucking kid uses it against
     your system.  I claim no responsibility for the use, abuse, or
     effects that this Telix script will generate.

    Feel free to modify this to make it work the way you want. Hell,
    that's why you got the Bob damned source. But, don't expect me
    to fix problems exposed by your changes.  If you don't program,
    then leave the friggin source alone. Problems and suggestions can
    be forwared to me on any of the awesome BBSes that I grace my
    presence with.  I may not accept your ideas, but I wanna hear
    them, dude.  Of course if you don't know who I am, this could
    present problems, but I hope that the kind SYSOPs will pass on
    any relavent comments or Email.  Since I actively modem, I am
    sure word of serious problems will reach me.  However, a few
    kind words are always appreciated like, "Fuck, Rad spaggetti code
    dude."  You aren't still reading this paragraph, are you? I dozed
    off about 3 sentences back.

    Following this shit, the shit is divided into 4 sections.
    general, config, control, and other.



                   General Shit:

    Ok, first you gotta compile the salt source.  See your Telix dox
    if you don't know how to do that. (like enter CS THxxx at the DOS
    prompt, the xxx is the version number of your source, the file
    with the extension of .SLT, got it?)

    Second, edit the TH.CFG (Telix Hacker config file). And change
    things you want changed.  See TH config file description for
    gorey details. (don't you hate when they do that??)

    Third create the Telix Hacker control file (pointed to in the
    config file or manually entered, if in manual mode).  See
    TH control file specifications.

   Forth, fire up Telix and invoke the script. Then take a nap, watch
   about 10 hours of TV or maybe take a weeks vacation, cause this
   is gonna take a while. Of course, if you specify good patterns
   (aka plates) then you might get a valid account faster, but it
   is probably going to take a muther fucking LONG time.  But at
   least you can see what is happening and will know you're not
   spinning your wheels.




                 Config shit:

   This file specifies shit about how the hacker is to operate. It
   has several record types which I will describe shortly. All
   Keywords must be delimited by a blank, an equal sign, and another
   blank. Like "AUTO = OFF".  Keywords may be specified in any order,
   just one keyword per record.  If a keyword is speficied several times
   the last specification will be the one in effect.  The config file
   must be called TH.CFG and be in your active directory (phuckin MS-DOS
   shit).

 keyword               Silly description

   *      This signifies a comment record. All text after that will be
          ignored. It must be followed by a blank.  It can start a
          record or be used to comment a config record.

  AUTO    This tells the hacker to operate automatically. Huh? What
          this means is: If AUTO = OFF, then the hacker will ask you
          for a control file name and use the one specified in the
          TH.CFG file has the default. If AUTO = ON, then the hacker
          will just start hacking with the CONTROL filed specified
          in the config file. AUTO = ON is useful if you are using a
          timed event to fire it up at 3:00 AM when you ain't around
          to reply to the prompt. If this record is ommited, OFF is
          assumed.

  CONTROL This is used to specify the hacker control file that you
          wanna use. The control file controls the actually hacking
          shit to use. (see control file description later on).
          Example "CONTROL = TELENET.HAK". If ommited, the hacker
          will look for a file called TH.HAK. If the file isn't found
          the hacker will format your C drive. Just kidding, you'll get
          a wonderful message asking if you got yer head up your ass
          or something equally stupid.

  CR      This is required. It specifies the two characters that will
          designate carriage return. Leave it has CR = ^M. If you change
          it, besure that it is two characters.

  LF      This is required. It specifies the two characters that will
          designate line feed. Leave it has LF = ^J. If you change
          it, besure that it is two characters.

     Here's a sample TH.CFG file:

  * Sample Telix hacker config file.
  AUTO = ON             * Just start hacking
  CONTROL = SAMPLE.HAK  * hacking samples today...
  CR = ^M               * carriage return
  LF = ^J               * line feed



                 Control shit:

   This file specifies the actual hacking that is to occur. It's
   format is the same has the config file, but with different keywords.

   The TEST, LOG, CODEZ, DIAL, COUNT, PLATEn, SEEDLn, SEEDHn, DELAY, FORCE,
|  LOOP, SHOW, PASSFILE, MASTERFILE, and GOOD records may be specified
   any amount of times, with the last one taking affect.  This does not
   apply to the SEND, WAIT, and HACK records, cause their relative order
   and multiple use control the way the hacker runs.

 keyword               Silly description

   *      This signifies a comment record.

  TEST    This tells the hacker weather to really dial and hack or not.
          If ommited, TEST = NO is assumed. To see how your control file
          will work use TEST = YES and the stuff will be displayed on
          the screen.

  LOG     This should normally have a value of NO, ie, "LOG = NO".
          Anyother value will cause the hacker to log every attempt
          to a file. Like "LOG = TRIES.DAT" will create this file
          and write every attempted hack string to it. If ommited,
          LOG = NO, is assumed.

  CODEZ   This specifies the file where good codes should be kept!!!
          If ommited CODEZ = TH.FND is assumed. If a file already exists,
          then it will be added to, if yer lucky enough to crack a
          code, that is...

   DIAL   This wonderful record tells the awesome hacker what phone
          number to dial. It's format is the same as what you
          enter in your dialing directory. If ommited, the hacker
          won't do shit. Example: DIAL = 10 , hack my 10'th dialing
          directory entry. Or: DIAL = M9765555 , for a phone number
          not in your directory.  The hacker will dial the number
          forever, until a connection is made and redial the number
          every time the connection is dropped.

   FORCE  This optional record tells the hacker how many attempts to
          make before hanging up and forcing redial. If omitted,
          FORCE = 0 is assumed which means keep hacking and only redial
          if the connection is lost.

   COUNT  This is an optional record, If controls how many attempts to
          make. Example, COUNT = 10000 says try 10,000 times. If ommited,
          keep trying forever, or until the hacker is manually stopped,
          which ever comes first.

   STOP   This tells the hacker to stop after a valid code is found.
          YES, means stop and NO means keep on hacking. Ie, STOP = YES
          will cause the hacker to stop and hangup the phone. If ommited
          STOP = YES is assumed.

   SHOW   This tells the hack to display the hack string each time a new
          code is about to be tried. Use SHOW = YES to display each
          hack string before it is sent.  Note that it will be displayed
          in column 41 of the current line to keep it seperate from the
          active terminal session text (hopefully). If ommited, SHOW =
          NO is assumed.

   PLATEn This specifies a plate for hacking. You can have 0 thru 9
          of them. What's a  PLATE you say? Well it's how you tell
          the hacker what characters to try.  It is composed of
          special characters that have the following meanings:
          # = any number, 0 through 9.
          & = any upper case letter, A through Z.
          @ = both numbers and upper case letters, 0 through Z.
          % = any lower case letter, a through z.
          $ = both upper and lower case letters, A through z.
          * = all three, 0 through z.. that's 62 possible values.
          Example: PLATE0 = &&&###@@@ for specifing a plate of 3 upper
          case letters, followed by three numbers, followed by three
          upper case alphanumerics (0 through Z). Got it? Good!
          Anyother characters are passed along has is. Ie, PLATE0 =
          PCP###@@@ would generate a hack string of PCP followed
          by 3 numbers, and then 3 alphamerics. Plates can only be
          up to nine characters long.

   SEEDLn These may be ommited, but if used must correspond to the
          plate of the same number. It's used to tell the hacker
          where you want the hacking to start. If omitted, lowest
          values are used to start. This is useful for restarting
          a hacking session.  Example: If PLATE0 = &&&###@@@ and
          SEEDL0 = CCC555@@@ then the hacker will not use A or B in
          in the first three letters and will not use numbers less
          that 5 in the three numbers. @@@ still means use all alpha-
          merics, Note that numbers come before letters in alphameric
          fields so if CCC was speficied for the alphameric field, then
          no numbers would be used along with neither A nor B.  Clear
          has mud, eh? If you have specific letters in the plate then
          the corresponding positions in the seed are ignored.
          There is no error checking done to see if your seed agrees
          with it's plate. So the hacker will run, but the results
          may not be what you want. TEST = YES is good for seeing the
          effect your seed has.

   SEEDHn Just like SEEDLn, but specifies high limits. If PLATE0 =
          &&&###@@@ and SEEDH0 = YYY888@@@ then the hacker will not
          use Z in the first 3 positions or 9 in the second three.

   GOOD   This record contains a string that the hacker should expect
          to receive when a valid code has been hacked.  It should be
          the last record in the file, duh. Example, GOOD = WELCOME*.
          The "*" is used to end the string. It can contain no more
          than 40 characters.

   PASSFILE  This is an optional record that will specify a file that
          contains a list of strings to use for hacking.  Example,
          PASSFILE = PASS.DAT would mean read the PASS.DAT file for
          strings to use for hacking.  Note, for the strings to really
          be used, you must have the uppercase word "PASSFILE" in a
          HACK record, ie, HACK = PASSFILE*.

|  MASTERFILE This is a optional record that is used to tell the hacker
|         weither or not to switch to the master password file (called
|         THPASS.LST) after all the records in the PASSFILE have been
|         processed. To cause the switch, MASTERFILE = YES, must be
|         coded. If ommited, MASTERFILE = NO, is assumed.

   DELAY  This is the number of seconds to wait for the GOOD string.
          If ommited, DELAY = 6 is assumed.

   SEND   You may have has many of these has you need, up to 10. They just
          specify a string to be sent once the connection is established.
          Example SEND = N  ... each SEND record encountered will be
          sent just has specifed. Useful for the inital shit a system
          may ask you before the signon. Note if you want a carriage
          return sent you must include that, like SEND = N^M . (^M is
          telixese for carriage return.) The string cannot exceed 40
          characters The SEND string is terminated by an "*". Example:
          "SEND = C C00512^M* send the string and carriage return"
          sends 9 bytes, the 8 byte string "C C00512" and the carriage
          return.

   WAIT   Like SEND you can have all of these you want, up to 10. It
          specifies text that you expect to receive and will cause the
          hacker to wait for it, for up to 5 minutes. If time expires,
          the hacker will quit with an error msg. Example: WAIT = NAME:* ,
          wait for a NAME: prompt.  If you specify a number, then
          the hacker will wait that many tenths of a second. Example,
          WAIT = 10 , means wait 1 second. For text values, no more
          than 40 characters may be specified. Like SEND the string
          is terminated by an "*".

   HACK   This tells the hacker to start hacking. Example:
          HACK = PLATE0,PLATE1 PLATE2* any non PLATE values are
          assumed to be literals and are sent has typed. If multiple
          plates are specifed, then the first one goes through all
          possible values before the second one is incremented.
          You can have multiple hack records. If so you would probably
          seperate them with a WAIT record. The first hack record is
          rotated through all possible values, before the next one is
          incremented.  If a plate is specified in more than one
          hack record, it is incremented independantly of the others.
          Currently, you can have up to 10 HACK records. Each hack
          value (the stuff after the = and before the *) cannot
          exceed 60 characters in either the raw form or after the
          plate(s) have been substituted. Note, that you can specify
          both PLATEn and PASSFILE in a HACK record, if you want.
          However, the PASSFILE keyword should only be used once, in
          one HACK record only. There is nothing to stop you from
          using PASSFILE in mutiple HACK records, but why would you?
          Also be careful with the length of the strings in your
          PASSFILE so that they don't overflow the HACK string after
          the PASSFILE string has been inserted in the HACK string.

   LOOP   This optional record has no value. It's purpose is to tell
          the hacker that a loop needs to be done from the next SEND,
          WAIT, HACK record until the last SEND, WAIT, or HACK record.
          If omitted, then the program will loop from first HACK record
          thru the last SEND, WAIT or HACK record.  Or if you have only
          one HACK record, then the program will loop that one.

     Here's a sample control file:

  * sample hacker control file, dudez.....
  TEST = YES            * Show me the modem program.
  LOG = NO              * they said leave it this way...
  CODEZ = SAMPLE.ACT     * valid accounts and PWs here please, please..
  DIAL = 1              * USE MY FIRST ENTRY...
  FORCE = 0            * just keep hacking
  COUNT = 35            * TRY 35 TIMES, I AIN'T GOT ALL DAY..
  STOP = YES            * just get me one code...
  PLATE0 = #&&&&&&#         * HACK a number, six letters, and a number
  PLATE1 = &                * ONE LETTER
  PLATE5 = ###              * HACK 3 NUMBERS
  PLATE7 = @@               * HACK 2 ALPHAMERICS
  * EDL0 = 5YYBBBB#          * DON'T some stuff  (commented out SEEDL0
  * EDH0 = #YYYYYY#          * DON'T TRY Z'S     (commented out SEEDH0
  GOOD = AT* look for an AT to say we are in!!!
  DELAY = 2 *wait 2 seconds
  *
  * The following records control the modem. (modem program?? eh??).
  SEND = @* SEND an @ sign
  WAIT = 5* WAIT 5 TENTHS OF A SECOND
  SEND = D^M^J* SEND D, a CARRIAGE RETURN, and a LINE FEED.
  WAIT = :* WAIT for the : prompt
  LOOP     *actually this is not needed here has I have only 1 HACK record
  HACK = ID=YOMAMA,PASS=PLATE0PLATE7^M^J*hack the fucker

    The "*" is used terminate the string in the SEND, WAIT, GOOD, and
    HACK records so that they may contain embedded blanks. None of
    the other record type may contain embedded blanks. Ie, the COUNT,
    DIAL, PLATEn, TEST, LOG, CODEZ, DELAY, LOOP, SEEDLn, SEEDHn,
|   SHOW, PASSFILE, MASTERFILE, and FORCE values are all delimited by
    a blank.



                 Other shit:

    Ok, if you have been trying to read this shit and figure out if
    this is useful or not, let me just say that hacking takes so
    much time, that you have to be smart about your attack. In other
    words, trying to hack a plate like six numbers would represent
    one million combinations. Even at an unattainable rate of 1 second
    per hack attempt, it's a long time. Well, its about 11.25 days,
    so it ain't forever, but in reality, it's much longer, like 9 weeks.
    Of course you could get lucky and crack one, say, after a week.
    But even that seems a tad too long for my tastes. Yours too. So,
    phuck, what are you gonna do? Well, you have to know something
    about your target. Like if you think the password is 2 letters and
    a 6 digit number, then try SS313### as a plate or things like
    that. 3 numbers represents 1,000 tries that at 9 seconds per hack
    attempt (a reasonable number) would take 2.5 hours.  If your are
    guessing six digit numbers, I would run it with at least 3 digits
    specified or even 4 if I was watching.  Of course at 9600 you might
    get the time down to 6 seconds per attempt, but if the system
    drops carrier every three attempts, then 6 seconds is about as
    good as it gets.

    Well, that was a lot of shit, wasn't it? Hopefully after you try
    it a bit, the descriptions will make more cents...

    This fucking code would have been a lot easier if the damn thing
    supported arrays... Oh well kuldge away!!!!!

    Note that all of the "|"s in column one of this text specify changes
    to the previous versions of this text.

    Finally, I have spent my time makeing the telix hacker work correctly
    when the control and config shit is correctly entered.  I have not
    tested (much, anyway) what happens when things are specified wrong,
    like if you specified a High seed value of 0 for an alphabetic
    field in the plate. So if you have problems please brefily state
    what's not working and include the CONTROL file that you are trying
    to hack with.

                         Shawn-da-Lay!!!!!!!!!
