Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Phreaking Cellular - Misc. :: cdc_241.txt

Cell Hell by Video Vindicator.

Better a bottle in front of me than a frontal lobotomy.



                                    _
                                   | \
                                   |  \
                                   | | \
                            __     | |\ \             __
      _____________       _/_/     | | \ \          _/_/     _____________
     |  ___________     _/_/       | |  \ \       _/_/       ___________  |
     | |              _/_/_____    | |   > >    _/_/_____               | |
     | |             /________/    | |  / /    /________/               | |
     | |                           | | / /                              | |
     | |                           | |/ /                               | |
     | |                           | | /                                | |
     | |                           |  /                                 | |
     | |                           |_/                                  | |
     | |                                                                | |
     | |      c   o   m   m   u   n   i   c   a   t   i   o   n   s     | |
     | |________________________________________________________________| |
     |____________________________________________________________________|

  ...presents...
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::: ____ : ____ : _ :::: _ :::::::::: _ : _ : ____ : _ :::: _ :::::::::::
::::::: |    | | ___| | | :: | | :::::::: | | | | | ___| | | :: | | ::::::::::
::::::: | ||_| |  _|  | | :: | | ::: ___  | |_| | |  _|  | | :: | | ::::::::::
::::::: | | _  | | .: | | :: | | :: |___| |  _  | | | .: | | :: | | ::::::::::
::::::: | || | | |__  | |__  | |__        | | | | | |__  | |__  | |__ ::::::::
::::::: |____| |____| |____| |____| ::::: |_| |_| |____| |____| |____| :::::::
::::::::.    .:.    .:.    .:.    .:::::::. .:. .:.    .:.    .:.    .::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::THE:DIRECTORY:OF:CELLULAR:MODIFICATION:::MITSUBISHI:800:::::::::::
:::::::::::::...:.........:..:........:............:::..........:...::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
==============================================================================
                WRITTEN, CREATED, AND TESTED BY VIDEO VINDICATOR
==============================================================================

                      >>> a cDc distribution......1993 <<<
                        -cDc- CULT OF THE DEAD COW -cDc-
  ____       _     ____       _       ____       _     ____       _       ____
 |____digital_media____digital_culture____digital_media____digital_culture____|

INTRODUCTION
~~~~~~~~~~~~
     Here it is... the long-awaited first file on cellular modification.  Not
just some bullshit that tells you how to reprogram the NAM, but the down and
dirty ripping of the ESN.  This is the first in what should (and I hope) will
be a neverending series of files from me on some of our happy cellular
manufacturers' fine (and not so fine) products.

     In the interests of keeping health and happiness, this modification was
completely tested on ten test humans who said they had no problems, except for
a large growth located behind their left ears.  Cellular phones causing cancer?
Yeah right, I think my toilet puts out more harmful (and the key word is
harmful) radiation then a fucking 0.5 watt handheld.  And shit, even if they
do, I'll still use 'em.

     This file deals with the general layout of the Mitsubishi 800, and also
includes the binary for a generic tumbling modification.


WHAT YOU'LL FIND INSIDE
~~~~~~~~~~~~~~~~~~~~~~~
     The Mitsubishi has got to be one of the best phones out there to modify,
since it needs only the most smallest permanent modification, and NO soldering
on the PC boards themselves!

     The ESN is located on what I have referred to as Board C in the first
diagram below.  This chip was manufactured by CSI and is a 93C64K.  One easy
way in which to modify this particular phone would be to replace it with a ZIFF
socket, and an EEPROM (or preferably a flash PROM) which would contain the new
ESN.

     The software chip is located on the underside of Board A, and is a
standard 27C256 (32K) software EPROM.  For the sake of compatibility, I have
included the binary source to the version I preformed this modification on
(and there are several other revisions out there!).  To replace it, simply
choose an EEPROM that is faster than 25ns (I would recommend a 15), and if
you plan on tampering with the software at all, then get flash PROMS.  Make
sure that the chip you program has the proper checksum, which is E1A5, and
for your own information, this is revision CB6.

     The phone uses a Mitsubishi proprietary processor, the M50747, which was
discontinued this year and replaced by the M38000.  This is a Motorola 68HC11
compatible chip, and does not have any special instructions AS FAR AS I KNOW.
If you are interested in modifying it, there are quite a few PD cross-
assemblers out there, although I have only seen a very few copyrighted
programs.


DISASSEMBLING THE PHONE
~~~~~~~~~~~~~~~~~~~~~~~
     Unlike what most people would like you to believe, this is probably one of
the easiest modifications to do and requires very little soldering.  The only
tools needed to remove the boards from the Mitsubishi 800 are a small flathead
screwdriver, a small Phillips, and a set of Allen wrenches.  Here we go....

(1) Remove the handset and cradle/battery from the main phone component.
(2) Remove the three Allen head screws from the main body and then gently pry
    the top off with the screwdriver.
(3) Remove the four Phillips screws from Board B (refer to diagram) and unplug
    all of the exposed antenna relays, as well as all of the wire connections.
(4) Gently pry the board up with the screwdriver, making sure to keep the board
    level (so as not to bend the pins connecting Board B to A).
(5) Remove the antenna lead from the metal casing surrounding Board D, and then
    unscrew Board C.
(6) Remove the EPROM from the underside of Board A with the screwdriver.  It is
    installed in a tower and requires no soldering (how thoughtful of them).

     That's it, the unit is as disassembled as we need.


THE BOARD LAYOUT
~~~~~~~~~~~~~~~~
     Here is the top view of the phone's boards and screw locations.  This
is 1/3 scale on a NEC 4D.


             .----CONNECTED-----.  BOARD C
             |                  |   ___
             |     BOARD A      |  |  o|                LEGEND
        ___  |  _____________   |  |###|                ~~~~~~
       / O |___|             |  |                       # - Wire connect
      |     ###    o        o|  |____|                  : - Drop Pins
      |                      |                          o - Screw for Board
      |               (1)   O|                          O - Case screw
      |           ___________|                          1 - Processor
      |          |_                      BOARD B
      |           :|                   ____________
      |   o       :| <--CONNECTED-.   |o           |
      |           :|              |   |:       o   |
      |           :|              `-> |:           |
      |          |                    |:           |
      |         _|                    |:   o       |
      |       #|                      |            |
      |       #| <-----.              |            |
      |   o   #|_      |              |            |
      |____      |     |              |            |
          ~| # O |     |              |            |
      .--> |_#___|     |              |            |
      |                |              |            |
      |             CONNECTS          |    o      o|
   CONNECTS         TO BOARD D        |            |
   TO POWER         (NOT SHOWN)       |____________|
   INPUT


     General information on the Boards involved:

BOARD A - The main board controls all the other boards in the phone.  All
          antenna relays and power controls are present here.  The software
          EPROM is also on this board.  Battery and NAM functions reside here.

BOARD B - Controls all receive functions, and also tone synthesis for reverse
          channels.  Tone crystal is located on board A.  Antenna loops from
          Board D.

BOARD C - This board only contains the ESN.

BOARD D - Controls all transmit functions, and also the D/A conversion process.
          Antenna loops from Board A.


BOARD A REVERSE SIDE CLOSEUP
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         LEGEND
         ~~~~~~
         @ - Inputs from Board B
         s - Crystal for subaudible tones
         c - Crystal for Touchtones
         O - Case screw
         o - Screw for Board                 ___________________
         Z - Input for handset              |O           o  ZZZZ|
         Y - Handsfree/Horn hookup          |          BBB  ZZZZ|
         X - Power hookup                   |          BBB   YYY|
         C - Software EPROM                 |                YYY|
         B - Battery                        |CCCCCCCCCC s    YYY|
         H - TDK heatsinks                  |>CCCCCCCCC s   XXXX|
                              ___________   |CCCCCCCCCC     XXXX|
         _________        ___|@@@@@@@@@@@|__|           o   XXXX|
        |O        |______|                                      |
        |                                                       |
        |                                                      _|
        |                                                     |
        |____                                ccc              |
             |_ o                    o                        |_
               |                                                |
               | HHHHHHHHHHHHHHHH HHHHHHHHHHHHHHHH             O|
               |_HHHHHHHHHHHHHHHH_HHHHHHHHHHHHHHHH_____________/


BOARD C CLOSEUP
~~~~~~~~~~~~~~~
     This is the board that we will be concerned with most in the modification,
since this is the primary piece modified.  On the "facing down" diagram, the
'%' represents the ESN IC, which is identified above.  The '.'s represent
solder spots.  Now one thing that is interesting,    W1 Y1 Y2 Y3 Y4 Y5
if you notice on the "facing up" side, there is a    :  :  :  :  :  :
':' between two of the solder spots.  This is their  :  :  :  :  :  :
security fuse.  Wow, real secure.  The easiest way   :  :  :  :  :  :
to bypass this                                       :  :  :  :  :  :
(or any you might come       FACING DOWN             :  :  :  :  :  :
across that are the     ____________________       __################__
same layout), is to    |  .  .  .  .  .  .  |     |  ################  |
simply find out the    |                    |     |  . . . .  . . . .  |
pinout assignments,    |  | | | |   | | | | |     |               :    |
and then connect the   |  %%%%%%%           |     |  ` ` ` `  ` `.` `. |
appropriate pins into  |  %%%%%%%   | | | | |     |                .   |
your EPROM reader (or  |  | | | |           |     |                    |
use a logic probe that |          .   /~~\  |     |  /~~\   .          |
will create an IBM     |  . . . . .   \__/  |     |  \__/   . . . . .  |
formatted disk which is|____________________|     |____________________|
then read).  I will                              FACING UP / CONNECTS TO A
hopefully have another mod for this same phone, using a very similar setup that
connects to the HP 95LX and uses it as a real-time psydo-PROM (one of the
advantages of my operating system for the HP).


REPROGRAMMING THE NAM
~~~~~~~~~~~~~~~~~~~~~
     The Mitsu 800 is like all of the Mitsu family, and can be reprogrammed an
unlimited amount of times through the handset.  Although this procedure has
been outlined elsewhere, I will go into a little more detail about what exactly
each option means.

     To enter programming mode, power up the unit and hold the (STO)re button
down while entering '5474432'.  Release (STO)re and it should display the
following information; remember, press SEND to move to the next option:


 OPTIONS         DISPLAY     DESCRIPTION
---------------|-----------|---------------------------------------------
 0/1             DUAL        Dual number mark (0 = Single / 1 = Dual)
 (xxx)xxx-xxxx   NO1         10 Digit Mobile phone number
 xxxxxx          SID1        6 Digit Station ID Number (Odd [A] / Even [B])
 0/1             LU1         Local use mark (Preregistration 0 = Disabled
                             1 = Enabled)
 0/1             MIN MARK    Min Mark
 0333/0334       IPCH        Paging Channel (0333 = A / 0334 = B)
 00-15           ACCOLC      Access Overload Class
 0/1             PS1         Preferred System for First phone number
 00-15           GI1         GIM Mark for First phone number
 xxxx            SECURITY    Security code to lock/unload phone
 0/1             EE          Use DTMF (0 = External / 1 = Internal)
 0/1             DT          Discontinuous Transmission
 0/1             HF          Horn Alert (0 = On / 1 = Off)
 0/1             INHIBIT     Roam Inhibit (0 = Able to Roam / 1 = Unable)
 0/1             C TONE      Continuous DTMF Tones (0 = Enable / 1 = Disable)
 0/1             SYS A/B     System A or B selection (0 = A / 1 = B)
 0/1             DUAL HS     Dual Handsets (0 = Disabled / 1 = Enabled)
 0/1             INHIBIT LD  Inhibit Long Distance (0 = LD / 1 = No LD)
---------------|-----------|---------------------------------------------

     To exit the programming mode and store the changes, press END.  The phone
will then reset and display all of its information.


THE INFAMOUS 800 MOD
~~~~~~~~~~~~~~~~~~~~
     This particular mod is unlike most, since the EPROM is a 27C256 and has
little remaining room in it.  Also, Mitsubishi scattered their software
throughout the PROM as well, making it even more difficult.

     The software for this mod is located in the following hex locations:

          7236H to 7490H
          7500H to 7CF1H
          7D65H to 7EFFH

     There are also pointer reassignments at the following hex locations:

          0D0DH     130DH     185AH     285FH     2CCDH     4C4FH     4E37H
          6B2CH

     Now on to the actual workings of the modification.  Installation is
simple, just replace the existing software EPROM with the new modified one and
then close the phone back up.  Make sure to reconnect ALL of the antenna
leads, since if you do not, you will have problems.

     This particular mod is just the basic roamers scam, which means the phone
is registered to the local systems (usually the B side) as an out-of-state
cellular.  Then, due to the roamers' agreement most of the carriers adhere
to, it allows you to make overseas, long distance, local, 950, and 800
(pretty much the whole 9 yards) calls without validation.  Now, validation
is processed once the call is initiated, but they will not normally disconnect
you when it is discovered.  If you get a message which states "Welcome to
Cellular One," or "Cellular service to this phone has been temporarily
disconnected," or "Sorry, this number is not registered," then simply attempt a
new number set.  If you happen to live in an area that is not "roam-able" (such
as CA, TX, or IL), then you will more than likely only be allowed to make
local, 950, and 800 calls.  If you happen to get to a connection country
(Mexico or Canada), you will be allowed to make country-wide calls, 800, and
connecting state calls (i.e. In Canada to Montana, or Mexico to Texas).  Here's
how to activate the mod.

     Power up the phone, and then enter the NAM programming mode, then proceed
to press [SEND] until you reach the phone number location.  Enter an OUT OF
STATE phone number, and then valid cellular prefix.  The last four digits are
not important, and may remain fixed.  Next, progress to the ACCOLC (Access Over
load Class), which is the first part of the tumbled ESN (described later).  Set
this field to 00, and then add 1 to it every time the phone gets deactivated.
When you reach 15, set it back to 00 and change the security.  The last portion
of this mod which needs to be changed is the SECURITY, which should be set to a
number ending with either an 8, 9, or  a 0.

     Here is the ratio of changes:

     First to change:

     ACCESS     6 beeps     Change up to 15 times to avoid "service suspended"
                            message with 01 through 15 (change 100% of the
                            time).

     Second to change:

     SECURITY   9 beeps     Change after no ACCESS changes work, to avoid
                            "welcome to", "sorry unregistered" etc messages
                            with any 4 digits with 3,5,8,9 or 0 at the end
                            (change about 60% of the time).

     Third to change:

     NUMBER     1 beep      Change after no SECURITY changes work with one of
                            the above valid area code and prefix numbers with
                            any last 4 digits (change about 30% of the time).

     Last to change:

     AREA CODE/PREFIX       Change after no NUMBER changes work (change about
                            10% of the time).

     I would recommend the following settings for use with either the A or the
B systems:

          DISPLAY     A SETTINGS         B SETTINGS
          -----------|------------------|---------------------------
          DUAL        0                  0
          no1         Use list for A     Use list for B
          Sid1        00027/00019        00002/00034
          LU1         1                  1
          E1          1                  1
          IPCH1       0333               0334
          ACCoLC1     00-15              00-15
          PS1         1                  0
          G11         10                 10 or 12
          SECURITY    0008-9999          0008-9999 (end with 8 or 9)
          EE          1                  1
          dt          0                  0
          HF          1                  1
          InHIbIt     0                  0
          C tone      1                  1
          SyS Ab      1                  1
          dUAL HS     0                  0
          InHIbIt Ld  0                  0
          -----------|------------------|---------------------------


WHAT THE CELLSITE SEES
~~~~~~~~~~~~~~~~~~~~~~
     This will give you an idea of what exactly you are doing when you change
any of the information in the NAM programming area.  Using this table, it would
even be feasible to use this phone, like a clone, by simply entering in the ESN
in the tables method, and then entering the corresponding phone number.  The
full 8 digit hexadecimal ESN is controlled solely by the ACCOLC and SECURITY in
the program.  No other data revealed on the DDI is transmitted.

     SECURITY IS SET ON 1238 AND REMAINS UNCHANGED (positions 4,5,8 & 1).

          ESN              ACCOLC     NOTES
          ~~~              ~~~~~~     ~~~~~
          1 23 45 67 8     xx         1-8 ESN Digit Positions
          - -- -- -- -     --
          8 1F 12 00 3     00         As ACCOLC is changed note pos 6&7 and
          8 20 12 01 3     01         2&3 change as pos 1,4,5,8 remain the
          8 21 12 02 3     02         same.
          8 22 12 03 3     03
          8 23 12 04 3     04
          8 24 12 05 3     05
          8 25 12 06 3     06
          8 26 12 07 3     07
          8 27 12 08 3     08
          8 28 12 09 3     09
          8 29 12 0A 3     10
          8 2A 12 0B 3     11
          8 2B 12 0C 3     12
          8 2C 12 0D 3     13
          8 2D 12 0E 3     14
          8 2E 12 0F 3     15

     Note that while security only affects positions 4,5,8 and 1 respectively,
the changing of the ACCOLC 00-15 changes not only its positions 6 and 7 into
its hexadecimal equivalents, but also steps in sequence positions 2 and 3
through 1F-2E to correspond to 00-15.

     ESN DIGIT POSITIONS:

     MFR:    1   DIGIT 4 OF SECURITY     CAN ONLY BE NUMBERS 8,9 OR 0.
             2   CHANGED BY ACCOLC       POSITIONS 2&3 TOGETHER 1F-2E
     SN:     3   CHANGED BY ACCOLC       POSITIONS 2&3 TOGETHER 1F-2E
             4   DIGIT 1 OF SECURITY     CAN BE ANY NUMBER
             5   DIGIT 2 OF SECURITY     CAN BE ANY NUMBER
             6   DIGIT 1 OF ACCOLC       POSITIONS 6&7 ACCEPT ONLY 00-15
             7   DIGIT 2 OF ACCOLC       POSITIONS 6&7 ACCEPT ONLY 00-15
             8   DIGIT 3 OF SECURITY     CAN BE ANY NUMBER

     Security with the following last digit gives the following responses due
to the fact that the first 2 digits are the manufacturer's code and a non-valid
mfr code yields an improper registration.

          1,2,3,4,5,6,7     "SORRY NOT PROPERLY REGISTERED FOR SERVICE"
          0,8,9             "CONNECTION ALLOWED"

     The following DDI reverse channel log is with the phone number set to
(617) 571-4590, and Access Overload set to 01, and the Security set to 7418:

          ----- Mobile Request ------
               SAT=2
               Continuous, 25 Mhz BW
               571-4590 (617) Page
               MFR: 82  SN: 074011  (2181513233)
                   130      475153
               Dialing: 80055512
               Dialing: 12

     This should give you a good idea of how the phone could easily be used in
a clone-type method, although it would have significant limits.


MIT800.EXE: THE PROGRAM
~~~~~~~~~~~~~~~~~~~~~~~
     The executable included along with this will allow you to enter an ESN,
and then test it for validity in the mod.  If it is valid, it will show you the
proper settings to make the phone.  To use this, simply select option '1' and
then enter the HEX ESN, like 82A92128 (8 chars long), and press return.  The
program will process the data, and output the appropriate response.

     Although this version does not support the DDI scan utility, what it will
allow you to do is enter a DDI log file, and then the program will search
through all the reverse channel data and redirect all valid NAM/ESN pairs to a
designated file.  This is especially convenient due to the limits set upon the
ESN generation.

     If anyone out there is using something other than the DDI box to receive
reverse channel, contact me and I'll make an import filter for that system's
capture file structure as well.


PHONE SPECIFICATIONS
~~~~~~~~~~~~~~~~~~~~
     For those who are interested in making more modifications for this very
versatile phone, here are the TR/RX and power specs:

     Frequency Channel       824.040 - 848.970 Transmitter
                             869.040 - 893.970 Receiver
     Number of Channels      832
     Spacing                 30 kHz

     Power Supply            13.7 VDC +/- 20%

     Standby Drain           90 mA Approx.
     Transmit Mode at Max    1350 mA Approx.

     Battery Capacity        Standby         Transmit        Transmit
         1400 mAh                            Max RF          Min RF
                             15 Hours        55 Minutes      90 Minutes
     Charge Time             5 Hours
     Battery Operating Temp  0 to +40 C
               Storage Temp  -30 to +70 C

     Power Output            3 Watt @ BNC Connector
                             50 ohm impedance
     Power Control           8 levels 4 db Apart

          WATTS
          LEVEL   0       1       2       3       4       5       6       7
          [High]  4.7     1.9     .760    .300    .120    .048    .019    .008
          [Norm]  3.0     1.2     .480    .190    .076    .030    .012    .005
          [Low]   1.2      .480   .190    .076    .030    .012    .005    .003

          dBm
          LEVEL   0       1       2       3       4       5       6       7
          [High]  36.8    32.8    28.8    24.8    20.8    16.8    12.8    8.8
          [Norm]  34.8    30.8    26.8    22.8    18.8    14.8    10.8    6.8
          [Low]   30.8    26.8    22.8    18.8    14.8    10.8     6.8    2.8

     Spurious Output         -48 dBc

     Adjacent Channel Power  -25 dB
     Frequency Stability     +/- 2.5 PPM
     Audio Distortion        -26 dB (5%)
     FM Hum & Noise          -32 dB
     Voice Modulation        300 - 3000 Hz
          Compressor         2:1 CCITT
          Pre-Emphasis       +6 dB per Octave
     Deviation Voice         +/- 10.8 kHz +/- 10%

     Ch. Switching Time      20 ms adjacent channel
                             40 ms non-adjacent channel
     Data encoding           10 kb/s Manchester
     SAT Transponding        5970, 6000, 6030 Hz +/- 1 Hz
          Phase Error        +/- 20 Degrees Maximum
          Setting Time       250 ms
          Measuring Time     250 ms
     DTMF Encoder            95 +/- 5ms Tone, Fixed
          Interdigit Time    65 +/- 5ms Minimum
          Voice              Suppressed during DTMF


PIN ASSIGNMENTS FOR HANDSET
~~~~~~~~~~~~~~~~~~~~~~~~~~~
     Here are the pin assignments for the handset, so you can build your own
RJ-11 interface and skip paying the money-loving cellular companies for one.
They are fairly straightforward and if you were successful modifying the
phone, then this should pose little difficulty.

     NAME        PIN  IN/OUT    SIGNAL TYPE   DESCRIPTION
     ------------|---|---------|-------------|------------------------------
     RX Audio +   1   OUT       AF            Balanced 10K ohms
     RX Audio -   2   OUT       AF            Balanced 10K ohms
     TX Audio     3   IN        AF            Unbalanced 10K ohms
     Ground       4   N/A       N/A           N/A
     HS-Outdata   5   OUT       LOGIC         Serial output data to handset
     HS-Indata    6   IN        LOGIC         Serial input data from handset
     HS-Power     7   N/A       N/A           13.7VDC Handset power
     HS-Off Sns   8   IN        N/A           ON/OFF Sensitivity
     ------------|---|---------|-------------|------------------------------

     I would say that the easiest way in which to figure this out is to connect
power to pin 7, then splice into 3, and merge 1/2 to a second line out.  Then
take a logic probe and connect leads to 5 and 6, and monitor the interaction
between the unit and handset since this is where the [SEND] and [END] will be
transmitted.  Then it would be feasible to make an interface for the serial
port (the second port) to trigger the send and end, and interface this with a
war dialer, etc.   Convenient for those unobtrusive scans.


OTHER MODIFICATION SOLUTIONS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     One other option for all those out there who may or may not want to modify
the operating software of the phone is Spy Supplies cellular mod software. 
They sell a package that lets you modify the MIN and ESN of about 75% of the
phones that are out (like all the Motorolas, etc).  One nice thing about this
is that it actually changes what the phone's ESN is, unlike a software mod, in
which it simply redirects the phone to look elsewhere.

     The package sells for around $500, and if you mention that I sent you
he'll knock $50 off of that.  This is DEFINITELY a nice choice for those who do
not wish to invest the time and money into modifying the particular software,
and this is an easy option to cloning.  Of course, he only sells it so you can
reprogram one of your other phones to share the same pair, thus eliminating the
second bill and just combining the two... and of course that's all we intend to
do with it, right?  He doesn't accept credit cards, so don't even think about
it... and at that price, it's well worth it and will pay for itself in less
than a month if used wisely.

     The software is fairly simple and menu driven, altogether total around
400k.  The package then includes diagrams (I believe he might actually have
pre-made cables available now) to build the interface cables.  Then all the
user does is plug the phone in, run the program, enter the data, and wham!
You're cloned.

     Spy Supply can be reached at 617-327-7272, 9am-5pm (ET) Monday through
Friday.  The book he sells is also interesting, although most of the infor-
mation contained within it is already available in other files.


CONCLUSION
~~~~~~~~~~
     Be watching for my own 'CONSUMER REPORTS' file which will let you in on
just how good the name brands stack up in modification, which are pitifully
easy to modify, and which can hold up through the test of time.  Remember, I
do not take any paid advertising, and am completely unbiased.

     One shocking bit of news... I finally have an Internet address and FTP
site!  Can you imagine that?  And just who was crazy enough to give me one...
none other than those wacky guys at cDc.  Just reach me at
videov@zero.cypher.com, or in the "vindicator" ftp directory.

     If you have any questions or comments concerning this file, then you can
(as always, and yet never) leave them to me on the systems below.  If you
fucked up your phone while doing this, then you're about the most pitiful thing
in the world, since you don't have to do anything PERMANENT to the phone!  As
always, I would like to extend greetings out to my faithful criminals:

          DYNASTAR           EREKOSE              DIGITAL HITLER
          DRUNKFUX           BOOTLEGGER           SWAMP RATTE'
          CAPT ZAP           FUNKY MONKEY         BRUJJO
          KLUDGE             GATSBY               MAXIMUM OVERDRIVE

     Blah blah blah...  be watching for the return of Scantronics.  Yeah,
that's right, Kludge and the boys are back, and still running on a '286 (just
goes to show you, hacking doesn't pay, but fraud does).  I would also like to
thank the demon lord Satan, without whom life would not be possible, and not
worth living; may the living and the dead hold his name forever in torment.
And always remember....

     The Surgeon General warns that using cellulars may cause cancer; yeah,
right, along with sex, drugs, and about 5,000,000,000 other fun things.
=============================================================================
Scantronics     [  ... it's coming, it's coming ...        ] 96  619-???-????
Demon Roach     [NUP required - cDc HQ - 'nuff said        ] 24  806-794-4362
Phunline        [Extensive satellite/virus sections        ] 96  916-481-2306
The Stash       [My European connection... lots of files   ] 96 46-498-222113
Reverse Channel [Drunkfux's board - cDc - dFx - HoHo       ] 96  713-468-5802
=============================================================================
  This concludes another wonderful file by Video Vindicator  (C)opyright 1993
 _______  __________________________________________________________________
/ _   _ \|Demon Roach Undrgrnd.806/794-4362|Kingdom of Shit.....806/794-1842|
 ((___)) |Cool Beans!..........510/THE-COOL|Polka AE {PW:KILL}..806/794-4362|
 [ x x ] |Metalland Southwest..713/468-5802|Lunatic Labs........213/655-0691|
  \   /  |The Works............617/861-8976|Ripco ][............312/528-5020|
  (' ')  |ftp - zero.cypher.com in pub/cdc |ftp - ftp.eff.org in pub/cud/cdc|
   (U)   |==================================================================|
  .ooM   |1993 cDc communications by Video Vindicator          12/30/93-#241|
\_______/|            Save yourself!  Go outside!  DO SOMETHING!            |




TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH