

           &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
           &                                                  & 
           &   SIGNALLING SYSTEMS & THE BLUE BOX REVAMPED     &
           &                                                  &
           &                       By                         &
           &                                                  &
           &                  Lazlo 20/07/92                  &
           &                                                  &
           &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

NOTE: This file is for informational purposes only and in no way is
      any toll-fraud suggested by the author.

INTRODUCTION
============

I will in this file discuss some of the international trunk-signalling systems
used and methods to box over them. The main reason for writing this article
is the downfall of US boxing due to:


 *  2400 & 2600 detectors on trunks
 *  CCIS
 *  Snooping on subscribers who place several (lengthy) calls to 800 numbers


Detection could simply by avoided by boxing off another country (on a tollfree
line of course) and then calling globally using a signalling system other than
the ones used in the states.

I have also included an in-depth review of the R2.


USAGE
=====

The signalling systems used widely today are: CCIS, CCITT 4, R1, R2 and SOCOTEL.
CCITT 4 can be found mainly in African and South American countries and is very
seldom worth boxing off due to the long routing needed and the poor quality
acheived. R1 and R2 is still very popular in Europe and the US and is really
worth boxing with, especially R2, which offers a multitude of options yet
uncovered for the enthusiastic phreak. The only system listed here that I
haven't boxed off myself is SOCOTEL, which, according to my knowledge is used 
somewhere in Europe (who knows where).
.Using R1 to box off Europe (or any other country) from the US is not
recommended. US trunks are maybe not used to route the call, but the fraud
detectors do not know this and sooner or later you *will* be in trouble.
Using systems like R2 from the US is a good idea, since no detector in the
US is looking for R2 tones, and boxing off 800 numbers that offer Country
Direct services should not seem suspicous.


The CCITT R1 system
===================


-----------------------------------------------------
Freq.     700   900   1100   1300   1500   1700  [Hz]
-----------------------------------------------------
Digit
  1        x     x
  2        x           x
  3              x     x
  4        x                  x
  5              x            x
  6                    x      x
  7        x                         x
  8              x                   x
  9                    x             x
  0                           x      x
 11        x                                x
 12              x                          x
 KP                    x                    x
KP2                           x             x
 ST                                  x      x
-----------------------------------------------------

50/50ms timing can be used with all digits, even 20/20 is possible on some
systems if you want fast dialing.

One problem with R1 is trunk seizure. The normal procedure would be sending
2400/2600, waiting a while, then blowing 2400, and the trunk would be seized.
This is very unlikely to work, though. Even more so is sending 2400 or
2600 directly. The telco equipment is nowadays very exact with timing and 
the only way to find it out is by testing. Usually the 2400/2600 (hangup tone)
should be sent for at least 80ms and no more than 200ms, if 200 ms is not
enough, you probably aren't on r1. A way to find out the timing is to send
2400/2600 starting with 200ms, then decreasing the timing with 1ms steps.
With 200ms, the trunk is likely to hang up when you send the hangup tone. 
Find the timing that hangs up, but leaves you on the trunk (this can be heard
by a wink), then keep the 2400/2600 timing that way and adjust the delays
and the 2400 timing. Timings suggested for AT&T + MCI trunks are as follows:

2400/2600 delay     2400    delay     [ms]
------------------------------------------
   137     100       137    1200
   100     100       100    100
   140     400       140    1200
   120     100       60     300
   150     0         150    150

The delay before KP or KP2 is sent may/may not be important and must sometimes
be very accurate. this can be adjusted by ear. If the line hangs up before you
start dialing, then make the last delay shorter. 

NOTE:Not all trunks work with the same timing, and sometimes when dialing 
the same number you are routed another way. This is a problem, but if you have
a trained boxing-ear, you can learn to separate trunks from each other.


The KP2 is used for international dialing.

KP2-CC-0/1-NPA-PREF-SUF-ST

Where 0 = Connect by cable
      1 = Connect by satellite

Thus, a call to the US via cable would appear like:

KP2-1-0-NPA-PREF-SUFF-ST



SOCOTEL
=======

This system is identical to R1, except for that the line signals are
out of band, and are hard to produce on the foneline.

Hangup is 3850 and is sent with 50ms pulses.

Dial timing is the same as is for r1 (50/50)


CCITT R2
--------

This is probably the most complicated signalling system (with the exception of
Common Channel Signalling systems) and offers a very wide range of 
possibilities for phreaking. One of the problems with R2 is that it is more
or less based around PCM, and on such systems all the line signalling info
(the important tones such as seize and hangup) is sent over a different 
timeslot (PCM uses a timesharing method for sending voice/signals) and
is then difficult to control. On some R2 systems the PCM method is not
implemented at all and this is the one I will discuss in detail. The 
supervisory tone (3825Hz) can normally also be a mess to send over the lines.
There have been test numbers for telco personnel that connects to a trunk,
but this does not help much, since the seize signal must be sent before
dialing anyway and is, as I said before, a mess to get through.
.The R2 uses special signalling methods not seen elsewhere, e.g
there is a separate set of backward tones that the receiving CO sends back
between each digit. I have, merely for the sake of accuracy, included these.
The backward signals may seem unnecessary but there might be some room for
phreaking with them too. Another feature of R2 is that no specific timing
exists. Every digit should be sent until the receiving CO responds with 
another Backward digit, which could in turn have some other meaning. A 
specification for R2 is that it should handle 6/7 signals per second, this 
is quite slow, though, and usually much faster speed can be acheived than
with for instance R1.
.On R2, register signals are two frequencies from a group of 6 
separated by 120Hz. Line signals are all 3825Hz and vary in pulsing length.
Register signals are not only split in Backward/Forward groups, but also
in groups I/II on forw. signals and A/B on backward signals. Group I is 
mainly normal dialing digits while group II signals are messages that specify
Subscriber types etc. I have tried to include as much as I know about the
messages, if anyone has got more info on this or anything else in this 
phile, please contact me.




                      R2 Register signals

------------------------------------------------------------
Forward   1380    1500    1620    1740    1860    1980  [Hz]
------------------------------------------------------------
Backward  1140    1020    900     780     660     540   [Hz]
------------------------------------------------------------
Digit
  1        x       x
  2        x               x
  3                x       x
  4        x                       x
  5                x               x
  6                        x       x
  7        x                               x
  8                x                       x
  9                        x               x
  10                               x       x
  11       x                                       x
  12               x                               x
  13                       x                       x
  14                               x               x 
  15                                       x       x
-----------------------------------------------------------

These are translated as:


-----------------------------------------------------------                    
                    Forward Signals
-----------------------------------------------------------
Digit         Group I               Group II
-----------------------------------------------------------
  1             1                   Normal subscriber
  2             2                   Priviledged subscriber
  3             3                   Test subscriber 
  4             4                   Payfone 
  5             5                   Operator
  6             6                      ?
  7             7                   Normal subscriber
  8             8                      ?
  9             9                   Priviledged subscriber
 10            10                   Operator
 11            KP2E                 Forwarded call
 12            KP2                  Reserved
 13            Reserved             Reserved
 14            Reserved             Reserved
 15            ST                   Reserved
----------------------------------------------------------


-----------------------------------------------------------------------------
                        Backward signals
-----------------------------------------------------------------------------
Digit         Group A                       Group B
-----------------------------------------------------------------------------
  1           Send next digit (x+1)         Sub.vacant, call tracing (BAD) 
  2           Send previous digit (x-1)     Send guide tone
  3           Receive group B signals       Subscriber busy       
  4           National net failure          Net Failure
  5           Specify subscriber type       Disconnected number
  6           Connect voicechannel          Subscriber vacant - Sup
  7           Send (x-2)                    Subscriber vacant - Non-Sup
  8           Send (x-3)                    Subscriber malfunction
  9              ?                                ?
 10           Reserved                      The number has changed
-----------------------------------------------------------------------------



                  R2 Line signals, non-PCM (3825Hz)


---------------------------------------------------------------
 Signal                           Direction        Duration[ms]
---------------------------------------------------------------
 Seizing                            -->               50 or 150
 Seizing ACK (wink)                 <--               50 (or longer)
 Answer                             <--               150
 Metering (count)                   <--               100
 Clear back                         <--               600
 Clear Forward                      -->               1500
---------------------------------------------------------------

The backward signals are used to ask the calling CO questions while
dialing. This may cause problems since you may not know when to send
digits and when to send info, especially signals like send x-2 may
cause headaches. One way to find this out is usually by testing
different orders. Usually the subscriber type question is only sent when
making national calls and is asked after all the digits have been sent.
On intl. calls the subscriber type is asked after the CC (like on R1).
The thing is that the Telco knows these things and are trying their best to
make life hard for boxers by programming their equipment to send questions
at unexpected times.

A boxed call may take place as follows:

Dial number 555-1212

 CO1                   CO2
---------------------------
 Clear Forward ->
 Seize         ->
           <- Seizing ACK

 I-5 ->
                     <-A-1 (send next digit)
 I-5 ->             
                     <-A-1
 I-5 ->              
                     <-A-1
 I-1 ->               
                     <-A-1
 I-2 ->               
                     <-A-1
 I-1 ->          
                     <-A-1
 I-2 ->               
                     <-A-5 or A-3 (specify subscriber)
 II-5 -> (operator)
                     <-B-6 (no ST needed on local calls)
----------------------------

Any1 with more info on this, please contact me.
                                                
<End of File>
