 ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::   D
 ::::::::::::::::::::      ::::             :::    :::   :::::       ::::   E
 ::::::: ---- :::::::::::    ::::::::  ::::::::    ::    ::::    ::::::::   C
 ::::::  /  ::::::::::::::     :::::  ::::::::     :     ::::      ::::::   O
 :::::  / mprovised::::::      :::::  :::::::   :     :   :::  ::::::::::   D
 :::: ---- ::::::::::::      :::::::  :::::::   ::   ::   ::   ::::::::::   I
 :::::::::::::::::::     ::::::::::   :::::    ::::::::   ::   ::::::::::   N
 :::16-Nov-93::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::   G

                                    by

                            o l e B u z z a r d


 INTRODUCTION

 DTMF  stands  for Dual Tone/Mutli-Frequency  and  it is the process by which
 TouchTone(c) phones operate.  When a button is it on a TouchTone(c) phone  a
 dual tone is created each of which  generates  a  unique frequency. Combined
 these tones equal 2600Hz. 

 Now, it is important to note that this file as very  little to  do with  the
 workings of DTMF and nothing to do with frequency manipulation. I ask you to
 keep this in mind if you  see an  error in  statements made regarding  DTMF.
 DTMF in and of itself is not relevant to this file.

 DTMF DECODING

 Most people outside the phreaking world never think  about  decoding  a DTMF
 number  if  for no other reason than that they usually know what number they
 dial. But  within the phreaking  world the ability to decode a DTMF tone can
 be a phreaker's greatest tool. Often in  my travels I have heard DTMF  tones
 blurp out at 38ms or less interval spacing (very fast dialing) and just knew
 it was the number to the God of GODs. Just ask yourelf how many times either
 while just doing  phun stuph  or even just watching  television  (like CNN's
 Future Watch) you heard a number dialed. Wouldn't it have been kk0ol to have
 known  what  that  number  was.  (<- Note  the  period  because  that  was a
 rhetorical question.) Well thats what DTMF Decoding is all about.

 Now DTMF Decoding is nothing new. In fact HAM Radio users do it all the time
 because DTMF are often  broadcast  over  the  radio-waves.  I  mention  this
 because where theres a demand theres a supply. Heres a  couple consumer DTMF
 decoders available mail order.

 [ Taken from Monitoring Times Vol.12 No.10 Oct-93 ]
 ----------------------------------------------------------------------------
 OPTOELECTRONICS                         | MOTRON ELECTRONICS
 5821 NE 14th Avenue                     | 310 Garfield Street Suite 4
 Ft. Laud., FL 33334                     | Eugene, OR 97402
                                         |
 DYNAMIC DUO--FM Intercept, Detect,      | Tone-Master TM-16 and TM-16 Plus
 Decode Tones...CTCSS, [ DTMF ], and DCS |
                                         | The TONE-MASTER Line of Hande Held
 The R10 is a unique FM Communications   | Tone Dedcoder Display Products. 
 Test Receiver with security and         | Decode Touch-Tones from a phone,
 surveillance applications. The R10's    | scanner, tape recorder, or nearly
 full spectrum audio output interfaces   | any audio source.
 directly with the DC440 to monitor      |
 CTCSS, and [ DTMF ], FM Deviations      | 
 and Relative Signal Strength            | 
                                         |    
 Optoelectronics Advantages              | Tone-Master Line
 1. Decode & Display CTCSS, DTMF or DCS  | 1. 16 Digit LCD Display with 80
    & DTMF simultaneously.               |    character scrollable memory.
 2. 127 Character DTMF Buffer with       | 2. Portable 9-volt battery or ext.
     scrollable 10 Character Display.    |    power operation.
     No Lost Data                        | 3. Completely stand-alone. No 
 3. LCD Display, visible in bright light |    computer necessary.
 4. Serial Computer Interface            | 4. Metal enclosure w/built-in
 5. Activity Indicator--lets operator    |    monitor speaker. Only 2.75"
    see when unit is activley decoding.  |    x 6.1" x 1.2"
 6. High Quality NiCad Battery pack      | 5. TM-16+ includes RS-232 output
    option.                              |    and software for automatic
 7. Actual DTMF Characters Displayed!    |    date/time/number logging w/Comp
                                         |
 Package Price: $549                     | Price: TM-16 $169   TM-16+ $239     
 ----------------------------------------------------------------------------

 Notice anything? Yes thats  it....go ahead  and  say it... 'They  both  cost
 money.'  Actually,  the Tone-Master TM-16 is not a bad deal at all. It would
 be great for field phreaking. But lets assume you're not  going to  be  'tin
 canning' on a  regular basis and you would  just like to be able to decode a
 tone every  now and then when you're  phreakin around.  Well the TM-16 would
 still  be a  good deal, but in case  you don't have the  extra $170 bucks, I
 will show you how you can do it for free.

 IMPROVISED DTMF DECODING

 Through  the  wonder of  Automatic Number Identification  (ANI)  anyone  can
 decode DTMF tones easily and  (more importantly) without cost.  How it works
 is this:  Nowadays  the phone  line are run  over-roughshod  with Voice Mail
 Boxes (VMBs). These VMBs, while worthwhile, and  very fun to hack, can serve
 another purpose. They  can decode DTMF tones for us!  Now VMBs are not all a
 like. There  are many VMB systems  such as  Audix, Aspen, and ROLM to name a
 few.  For the purpose of this file  we will be  focusing on  Merridian  VMBs.
 The Merridian proves very useful for the purpose of improvised DTMF Decoding
 because Merridians  utilize ANI technology to provide verbal feedback to VMB
 selections. What happens is this: when you  call a Merridian it will ask you
 which mailbox you  wish to leave a message at.  You then enter a box number.
 The Merridian will indentify the box number you entered and tell you whether
 or not the box is valid.  By doing so the system has  decoded the DTMF. Used
 as  just  described  constitutes  intended  use. For use as  Improvised DTMF
 Decoder follow the following (what?)

     1. Record desired DTMF tones. These are the tones you recorded
        while out 'tin canning'.
     
     2. Call a Merridian VMB [1-800-946-8888] 
   
        * NOTE * This  is the  number to  a  real-live  investment firm
        (IDS - Investment Diversified Services).  What  does this mean?
        Well it means  that if you call them during  business hours you
        will talk to a  real-live  person. Call after 6:00pm CST to get
        the VMB. (Lighten up...no one phreaks during the day any how.)

     3. Bypass the outgoing message by hitting 0 + 3 and then 1
    
        * NOTE * Now I don't know if hitting those keys  works for  all
        Merridians  or not, but I do know  its not that hard to stop an 
        outgoing  message.  For more info  on Merridians  contact Video 
        Vindicator at <videov@zero.cypher.com>

     4. You will hear a message that says:

             'Express Messaging...to mailbox?' 

        At this point play the recorded DTMF tones *LOUDLY* into the
        handset.
     
        * NOTE * A real preak would have some sort of 'Box' to play the
        tones directly into the phone line.
 
     5. After tones have been played press the Pound (#) Key. You will
        hear a message which says either:

              'There is no box number at xxx, please try again.'
        Or,
              'Mailbox xxx, please leave a message after the tone.'

        In either case the DTMF is decoded (yeah.)

        * NOTE * This method of improvised DTMF decoding  can  be
        achieved on other systsems which utilize ANI such as AT&T
        VoiceMessaging(c).  I have chosen Merridian VMBs as ideal
        because they allow  tone string of  up to 255 NUMBERS!!!
                                                  ^^^ 
 DTMF'IN

 To aid in your DTMF Decoding theres a couple of things you should probably
 have.

 1. A Tape Recorder, preferably a small one, but any tape recorder with an 
    in-shape recording head will do.

 2. A Microphone. I recommend Radio Shack Model 44533 Telephone Pick-Up Mic..
    $4.19

 3. Tones to decode. Heres a little list of DTMF ToucTone sources

    a. 'Tin-Canning' You know the big, green things that say USWest.
    b. CNN's Future Watch (5:00pm Sundays EST)
    c. Movies (there were all kinds of DTMF tones in WarGames).
    d. Surveillance. (see 'Tin-Canning'

 DTMF NUMERIC CORRESPONDENT

 Heres a little DTMF/Number conversion list I'm throwing in to  make my file
 look more legitimate. It as  no real value  to this file other than to make
 me look good..(better). Have Phun!! oB
        
               697Hz + 1209Hz -> 1      770Hz + 1209Hz -> 4  
               697Hz + 1336Hz -> 2      770Hz + 1336Hz -> 5 
               697Hz + 1477Hz -> 3      770Hz + 1477Hz -> 6 

               852Hz + 1209Hz -> 7      941Hz + 1209Hz -> *
               852Hz + 1336Hz -> 8      941Hz + 1336Hz -> 0
               852Hz + 1477Hz -> 9      941Hz + 1447Hz -> #

Shout outs to: Nobody (at oB's), Disorder (at Flatline), and all my users at...
--------------------------------------------------------------------------------
 oleBuzzard's kn0wledge phreak  %  sUmthyn lykE 4000+ text fylez  %  C.R.a.P.N. 
 AC 3o3.447.89o6--NUP = NO NUP  %  hAck/phrEAk/AnArky/vIrII/cArd  %  Call Right 
 24oo-14.4ooKiloBaud-Open 24/7  %  n0 phUckyn lAmEr wArEz do0dz!  %  Phuckn Now
--------------------------------------------------------------------------------
