Just wanna say HEY! to a few people , family , friends , aquaintences, and even a few ex'es ...adam (bc..' bud), alan (old times lost), alice (my aunt ), bonnie (an ex), chris (another best bud), christopher (old friend), connie (and his wife), dad (miss you), damon (shiva rules!), david (hey big bro!), debbie (don' t lik(\ california or sumthin?), ellen (i hear you 're shrinki ng), genevieve (lost love), god , jan (best bud's girl) , jell , jeremy, jerome (hi bro!), jesse (how's the ribs?), jim (iimarnrnal ), kristen (love that pony tail), laura (sorry I keep forgetting to call), lisa (hiya sis) , liz (Iizba) , lori (yet another sis), marion (another aunt ), mom (i OW ( you big time), niel (cool cous in), robyn (leather baby, yeah!), sandra (one of these days i'm gonna look you up), another sandra , sandy (i have your number but never call), scott (another bro who needs to ge t his head out from between his girls legs ), another scott ('sup man) , sean (dj, dj, calling dj), shannen (another leather wench) , tom (theramin man), wendy (introduced me to Pink Floyd). people that make it happen: Editor Packing & Distribution Brian Skywise Rendering & Assistant Editors Raytracing OJ, Zack Man Krokus Photography Office Babes Pixel God Jan, Kate, Connie, Alicia Artwork FOOD Scribble Dominoes, Jack in the Box software that makes it happen: POVRay for Windows, 3D Studio R4, Microsoft Publisher 98, Windows95, WindowsNT, Netscap e Communicator, Microsoft Internet Explorer, ACDSee, Photoshop 4.0, Corel Draw, Photo Styler, Quark Express, ICQ, PageMaker, Crystal FTP, mlRC32 and some other mise software. ISSN XXXX-XXXX (Pending) 2397985356295141-0001 THUD Magazine, Inc. P.O . Box 2521, Cypress CA, 90630 THUD Magazine (The Hackers Underground Digest) is copyright 1998 by THUD Magazine, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical , including photocopying, recording, or by any information storage and . retrieval system, without express written permission of THUD Magazine, Inc. The contents of THUD Magazine are for educational purposes only and do not necessarily reflect the viewpoints of the editors, their staff or the various contributors to the magazine. The information is provided on an "as is" basis. THUD Magazine, Inc., its owners, its staff, nor its contributors take any responsibilty for losses incurred, real or otherwise, for use or misuse of the information found in this publication. Responsibility lies solely with the end user. Many of the articles within this publication discus s procedures, processes and activities which may be illegal, dangerous, or just plain stupid to actually act out. We do not recommend that anyone rely on the information contained herein as fact. Use commo n sense, or if none is available, find someone who has some and borrow it. Printed in the United States of America 2 Volume 1 Issue 1 - Spring 1998 TH UD influence: Another DeeJay Consumertronics Bill Hayes Dr. Whip Solar Prophet Telecode Blacklisted! 411 Shiva Mycal Oxygene Iron Feather Journal Orion and, of course, those wishing to remain anonymous. what's inside: 4 Brain Dump (editors letter) 32 Cable Test Chip FAQ - by Telecode 5 Just What is a Hacker? 34 Data Depot (News) 8 Building Your Own Pirate Radio Station 36 Q&A (Letters) 12 Deadline 43 The 555 Timer IC For Dummies 13 The United States Senate 45 Wireless Cable Television FAQ 18 Amusement Park Freqs 50 Acronyms A-B 20 Hack Exchange (Classifieds) 53 Pirate Radio Resources WEB Listings 21 Police Codes 56 Neato Stuph (pics) 22 Cool Edit 96 - Review by Solar Prophet 57 Cool Book List 23 Pager Freqs 58 Driver Bits 24 Stopping Power Meters - Review by Shiva 59 Subscription Info 26 Pyrotechnic Chemicals other information: How to contact us: Articles: THUD Magazine THUD Magazine Articles P.O. Box 2521 P.O. Box 2521, Cypress, CA 90630 Cypress, CA 90630 Letters: Subscriptions: THUD Magazine Letters $20 U.S., $24 Canada, $35 Foreign P.O. Box 2521, Cypress, CA 90630 U.S. funds only. THUD Volume 1 Issue 1 • Spring 1998 3 Dump A message from the editor Welcome, ladiez, gentz, hackerz, phreakerz, wormz, and whachamacallitz. You're staring at the premier issue of . THUD, The Hackers Underground Digest. First, let me tell you what we're all about. Basically, we're a bunch of twits who figured we could make our own hacking magazine, and guess what! we did!! Cuz you're looking at it! But seriously though, we're not a bunch of people who think we can be better than anyone else. I for one hate people like that. I've been reading magz like 2600 and Blacklisted! 411 forever, and they're both really good. Each has it's strong points, as well as weaknesses. No publication is perfect, and I'm sure there's gonna be people out there who have their problems with THUD. Frankly, I'd be upset if people didn't write in spouting off shit about what's wrong with this, what's fucked up there, and what not. That's called feedback. But anyway, what I am hoping to do with THUD is to provide yet another source of information for those of you out there that are into this shit. I am a firm believer in the phrase 'knowledge is power' and when I seek knowledge , I do not seek it from only one source. I try to corroborate by searching in many places. I would like to provide yet one more source for you. I would also like to provide more technically detailed information on the subjects we talk about. Oh, of course we're gonna have the usual shit like lists of freqencies, or what chemicals you 'shouldn't' be playing with and other general stuph like that. But beyond that, we're going to present to you articles written so that the beginner can understand, yet provide such a vast amount of information that even more advanced techno-philes should still learn a thing or two; or maybe to remind them of what they may have forgotten. We're gonna show you pictures, we're gonna give you schematics, we 're gonna give you part sources, we 're gonna give you assembly instructions, we're gonna give you operating instructions, we're gonna give you what you need to succeed. All you have to do is pay attention and understand and learn . One thing that I've always felt uncomfortable with is the term 'hacker'. If you feel the same way , you can put your mind at ease by reading Bill Hayes article, "Just What Is A Hacker?" Bills, contribution basically put into words how I feel. Hackers are not the tongue-pierced , tattooed, only wear black, computer gadget in every pocket, can't live without electricity, evil malcontents bent on destroying the world by using the worlds electronics networks to wreak havoc on the unsuspecting public by destroying data and disrupting communications. Sure, I'll admit there are those types out there and frankly I think they've given the rest of us a bad name. SHAME ON YOU!! But also, much of the blame I think goes on the media for pushing that image onto the uneducated gullible world. To get a taste of what a REAL hacker is, read the article. You're gonna be surprised at who some the most famous hackers really are! There's many fundamentals beginner electronics students learn. Mainly it's how everything is really broken down into little sections . And it's how to put simple circuits together to perform relatively simple tasks that's really important. Knowing on a fundamental level how something works, and having practical experience in using that knowledge really helps. In this issue you're gonna find an excellent article by Orion (gee, that's an obvious alias!) about the 555 timer IC. I remember when I learned about this little gizmo when I was in tech school. Man, it seemed like there wasn't anything that couldn't be done with a 555 and a few external components. Well , we present to you here a very in depth article that just about sums up all the basics of how to use the 555 timer. Oh, and it's well written too. The guy manages to desribe some of the sticky details , yet in such a way that a beginner shouldn 't be overchallenged, yet it definately reminded me of some of the things that I learned waaaay back when . (no, I don't feel old....yet) Great article , I'm sure we'll have more from Orion in the future. Ever hated listening to the radio? Turning that knob and checking out your twenty favorite stations ...and even a few you don't like...and can't find ANYTHING worth listening to? Ever thought, man, if I had my own radion station, I know what I'd broadcast. Wanna do it? There's a nice little kit from Ramsey Electronics called the FM-10 . It's a small kit, a low power FM radio broadcaster. That's right you can be your own disc jokey. The FM-10 kit is totally legal when unmodified. This issue contains an article from Mycal about all sorts of modifications you can make to the FM-10. Now, I must warn you that many of these modifications when used on the FM-10 and used to broadcast openly could get you into big trouble with the FCC. But the information is present to you none-the-Iess because knowledge is power. It is meant for educational purposes for those of us who are curious and want to know how these things work. Have fun but be careful, you're the one responsible for your own actions. Anyway, you're also gonna find several other articles of great interest. There's a nifty little program called Cool Edit 96 that was given a great review by Solar Prophet. once I read the article I grabbed a copy myself and love it. There's also a short about the IRS being unable to prosecute certain individuals. Quite informative. You'll also find a list of all the U.S. Senators for all those of you who have something to gripe about. Come on, I know you've got a gripe!. We all do. For all you scanner buffs that also love amusement parks, there 's a nice list of frequencies you'll find at your favorite entertainment facility. Shoved somewhere in these pages is a list of chemicals used for pyrotechnics, mostly fireworks . Lotsa info. There's also a short list of police codes. There's also a great review on a book and video about stopping power meters. Once again this is technically illegal but one can learn a lot about how these things work. And last but not least, a list of books that should be an excellent source of further information on quite a diverse range of subjects. Lastly, I'd like to thank our friends at Blacklisted!411, Iron Feather Journal , those who contributed articles to us and the members of our staff for all the help in putting the rag together. The teamwork is great and it couldn't have happened without you. Congrats to all! 4 Volume 1 Issue 1 - Spring 1998 THUD 000 0 0 0 0 0 000 0 000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 o o o o o Just What Is A Hacker? o o o o By: Bill Hayes o o 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000 0 0 0 0 0 0 000 0 0 0 0 0 0 0 0 0 0 0 0 0 This magazine is called "THUD - The Hackers Underground Digest," referring of course to "hackers ." Hackers? Most people, even in 1998, still don't get it. The term, while it refers to most of us who read this magazine (and write for it), was not invented for the late '70s, when little computers came out, or the '80s, when they started to work well, or the '90s, when a lot of little computers (I'll define what a "little computer" is later) could outperform mainframes, and the Cray-on-a-desktop dream was a reality---for a price. The word "hack" is a pretty old one . Seems the word dates back to the 1920s, when it was applied to quick , and not especially good, writers. But it was not CODE way back then that they wrote, but words . Journalists, pulp writers, novelist wannabes all were WRITERS, but some, for various and usually derogatory reasons , were called "hack writers ," later shortened to "hacker." "Yeah, I gotta hack out last night's crime report for the evening paper ." The word "hacker" seems to apply to those of us, after about 1975, referring to writing code or doctoring programs. This does not, however, explain, in our present context, just what a hacker is right now. When I was invited to write for the lead off issue of this magazine, the editor and I were discussing our own hacking abilities and likes. I mentioned Thomas Edison as the ultimate hacker; the editor stated his vote was for Alexander Graham Bell. But just what were these two men? They wrote no code---not the kind we use anyway (telegraphy and encryption "codes" do not count for this illustration). This is way before the age of the electronic computer. They were tinkerers, and in fact they were probably the best tinkerers of the 19th century. Oh, so to be a hacker you must tinker---right? Well, it certainly helps . Is the person who can build a PC from mail-order components a hacker? Well, yes. Maybe . How about the Mr. Fixit, who never met a Sears tool he didn't like, and can fix any car or powered device? No. So, what's the difference? A Hacker (and we deserve this capitalization) refers to electronics, generally computers, but specifically about doing things that are just not "out of the box." Can you get your just-ordered Dell right out of the box, and put it together and get it to boot up and run right the very first time? Congratulations , but that's what you're supposed to do. Anyone past tenth grade (at worst) should be able to accomplish such a "feat." However, can you take a friend 's dead PC, strip it for parts, upgrade your box, put that bigger transformer on another friend's PC, hook up your sister's old stereo speakers to the sound card for some really big sounds on your game ...that's more like it. Make an old 386 clone run like a champ with some memory upgrades, tinkering with the Bios, and defragging and partitioning the hard drive ...you are there. But it's not just what you do with you hands and tools . A Hacker is someone, male or female , with a specific mindset. Some of these people (poor victims of the current public school system, no doubt) aren't even into computers, but they have the right mindset, and they would do just fine if introduced to the right pieces of equipment. That mindset flows out from our knowledge of number crunchers, sound makers , game players , and word manipulators . We see the other, the possible but not available, that which is not offered as an option or add-on but we want NOW. And we try to do it ourselves. Like the similar-minded hot rodders of the '50s and '60s , who could make a '53 Chevy do things not exactly within its initial design parameters, and look quite a bit different from the show room floor , take a pickup truck, or VW Beetle , or fin-laden Caddy, and do with it that which was not exactly intended, designed, or even sought. But consider the outcome, and the designs, performance, options, availabilities, and variations now available, because of hot rodders in the last two generations. The Japanese sure caught on, and after a bit, so did Detroit and Wolfsburg. As with them , so with us. Forgive me if I need to deviate to make my point. While this is not intended to be a history of small computing, this background is necessary, so please bear with me. Consider if you will, way back in the summer of 1981, when what is now considered the modern era of computing began (well, some of you good readers may have been a little too young at the time; I was a Science Officer, spending 4 months testing prototype equipment in the desert in lovely EI Paso, Texas, reading the business section of the paper when I read that it happened). Business computing got serious---or at least threatened as much . In a three week period, two business-only microcomputers were released , to huge fanfare. The Apple III, a business box running faster versions of VisiCaIe, Peach Tree Accounting, and WordStar, seemed to dominate the papers : this was the box that would put Tandy in its place! One could hardly blink before the next big announcement: Charlie Chaplin's character, "The Little Tramp" from the movie "Modern Times" was the new logo and silent spokesperson for The 1.8.M. Personal Computer (you just had to see the ads, hear it on the radio, to believe the voice inflections). Where did these two competing, totally incompatible boxes come from? Totally different from each company's past, that's for sure. Apple, tired of the "rich man's toy" banner that so many had slapped on it, tried to go BUSINESS with this box, in a big way. For business applications, especially word processing, people were encouraged by the embryonic computer press, to go with Radio Shack, specifically the Tandy TRS III. The Apple 11+, not quite as fast but in may ways a better system, seemed to suffer from its very abilities. It was a great game machine, had good built-in color (no color or graphics card needed), and generated decent sound, for serious playing of Star Castle, Pac-Man, and various other shoot-em-ups. Due to the fact that every kid (and adult) wanted the Apple 11+ as a game player (that could also do neat layouts for word processing documents), it was labeled the game computer or the kid's computer. Not saddled with so many games or options, but still an excellent box, Tandy went after the "serious, business side" of computing. And for a while, both companies were winners . A little point I should make here about "little computers." On a great (and now extinct) radio show called CBS Newsmark, Steve Jobs talked about not trusting big computers due to the "Big Brother" label that went along with them. He said that he was told , back before his Apple days, that you could trust a computer , but only one you could pick up. If you can't pick up the THUD Volume 1 Issue 1 • Spring 1998 5 computer in question, and throw it out the window, just don't trust it. Not too bad an idea for now, if you asked me... Apple put its very best people into the Apple III, this very serious, business-only system. And its excellence for doing only business, and the lack of vision, killed an otherwise good product. Bad call : Jobs insisted the Apple III be complet ely incompatible with Apple II "recreation" software, and it would only display in monochrome, that is, beautiful green, or as an option, stunning black and white. "We won't be labeled as a kid's platform any more!" was the Cupertino battle cry for this business box. So, this inflexibility to run from the label of kid's computer killed the system . At that point, there were thousands of programs (only about half of which were games), that could run on the Apple II or 11+. There were maybe a dozen (when it debuted) that would run on the far more expensive Apple III, all monochrome, no sound, all business, no games. Poor idea, one that would be the first of may near-fatal errors for such a great startup with so many talented , creative people, and wildly, rabidly loyal users and fans. (Note: I was one of them.) International Business Machines, the bluest of any bluechip American company, took a totally different course . IBM, the home of the white shirt and dark blue tie as an employee requirement, was actually dealing with the enemy. Not trading with the Soviets or Chinese, but something just as outrageous. Having amateurs (those we'd now call Hackers) design the hardware and software of a small computer . The mind just boggled. Don Estridge, an IBM V.P., and head of the new division called "Entry Systems" in Boca Raton, Florida, had the vision to step away from the other blue suits, get a couple of kids (Gates and Allen) who'd shown some great innovation , if a lack of discipline, and try to make a desk top , that is, an entry system, not in the mold of IBM, but more in the mold of a hobbyist's computer, a garage job . Dare it be said-s-a Hacked microcomputer and its operating system? Yes. Estridge, blue suit, white shirt, and engineering degree, had the vision . He could see things as they were not. And he brought in the talent to make it happen. And this was not even IBM's first foray into desktop computing . Back in 1974, their engineers (all homegrown and party-line , it should be noted) built a giant typewriter looking thing that was a "desk top minicomputer" as they called it. Get this, it only ran the APL programming language. Bet you'd love to fly in an aircraft or drive a car designed by that, huh? IBM, in spite of this serious failure (I think they sold about a thousand of the things), and had no non-IBM software developed for it due to the fact they refused to license anything, the engineers at IBM kept plugging . Some of them, Estridge at the top, knew they needed new ideas, new blood. After all, these guys were used to building computers that could be as big as a house, but only as small as a large refrigerator. Small computers had been around , in some shape or other, since the Altair 8800 debuted in 1975. New blood was brought in. Bill Gates and Paul Allen , who'd written the BASIC for the Altair, and had written some game programs, were brought in. While they certainly did not fit into the corporate culture of IBM, they could see things in a different way, new computers could be great even if they weren 't huge, and their input (but not really their design) has partially resulted in the computing world we have today---definitely in software, but somewhat in hardware as well. The vision of IBM, to do something greater and different from the "big iron" they'd successfully flooded the corporate and military world with, was broad enough to accept this new view: some of their customers wanted smaller ("Hey, I know, let's do smaller!"). Their stilted, military-industrial world view was able to produce a distinctly non-IBM vision, and with the input of amateurs, hackers, non-engineers, and college dropouts, thus came the IBM PC. The computer world , from that moment on, would never be the same . (Note an old saying from the Bible Belt that may be illustrative: "Amateurs build Noah's Ark, professionals built the Titannic .") Do not think this is blanket and blind praise for Big Blue. Not from me! I've owned computers of some kind or other since 1980, and used computers since 1978. But I was of the old school---terminals, Z-80s, or Commodore, or Apple. My first expensive box was a Macintosh; I didn't cave in and buy a DOS or Windows anything until 1992, when I bought a Dell 486 from a Sam's Club. I'd felt for so long that so much creativity was diverted into "compatiblilty," and not into generating some Blacklisted! 411 The Official Hackers Magazine Tired of the same old thing? NOW you have a choice! Published by Syntel Vista, Inc. "We 're in our 4th year, now! Join the thousands of other happy hackers around the world! Take a look at our rag!" ./ Hacking/Phreaking ./ BBS/lnternet Updates/News ./ Telephone Technology ./ The Underground ./ Cable Television Technology ./ Sovereign Citizenship ./ Satellite Communications ./ Pirate Radio ./ Radio Communications ./ Sources ./ AudioNideo/Computers ./ Survival Guide ./ Encryption & Virii ./ Hardware Hacking....and We publish reader questions and article submissions. Got something to share with the hacker community? We're your resource AND your means to communicate with fellow hackers! Blacklisted! 411, P.O. Box 2506, Cypress, CA 90630 \ ,. (714 )899-8853 ;'1),'\j ) SUbscriptions are $20/yr U.S., $24/yr Canada. $35/yr Foreign (U.S. Currency) ""'-J\, Samples are $5 each (most current issue unless otherwise requested) NITt9F1"11IJl'In lin IIIA1tFL' NOTE: We're a quarterly zine - we only publish 4 issues per quarter. 6 Volume 1 Issue 1 • Spring 1998 THUD of the neat things done by Apple or Commodore or Osborne , but these three companies all shot themselves in the foot, and while more creative, they wasted their early leads, failed to successfully compete, and therefore failed to thrive . Did these companies, in a blind race to embrace the "business market," ignore their hackers? A brief mention of John Scully is in order. As you know , Scully was recruited by Jobs to run Apple, back in 1985 or so. It was thought that, as someone who'd run a significant #2 company (Pepsi) in an environment of a gigantic, global #1 (Coca-Cola) , he'd be ideal to successfully run Apple versus the Goliath IBM. Good thought.. .wrong execution . Scully, great businessman that he had been with Pepsico, had no idea how to compete in the computer world (remember, he was recruited as a Suit). It is easy, from 1998, to see three different occasions when Scully could have killed off Windows as an OS, just by licensing the Mac's OS for cloning purposes. He didn't. Well, he did, but far too late to matter one bit. Look at what happened, and the environment we're stuck in. [Don't forget, Don Estridge, white-sh irted, home grown VP of the evil empire, had the vision, not to try it with his own team, but to bring in the kids, see what might work , risk failure and his job, for a bunch of hackers ...] The Mac's better interface could only be (legally) used in a more expensive Apple box. DOS, then Windows, not very friendly or even very good at first, just got better. Apple, and to a lesser extent Tandy and Commodore, tried going business, and failed, yet IBM, that Great Satan of computerdom, developed the box that was the model for 90% of the world's desktops. Due to hiring amateurs with a vision. Allowing games to be played on their business systems . They brought in the tinkerers. Those who could see the same things as everyone else, but see a different end, a different result, a different end use. A whole different world. So who were these different thinkers? I believe we'd call them Hackers. Some input from February 1998 might now be in order. In an interesting short news piece in an Investor's Business Daily article, the ISO, the International Standards Organization, selected Apple's QuickTime and QuickTime VR as the cross- platform viewing standard for video documents. Some of Apple's hackers, it seems, are still in place. Wozniak is gone, Kay is at Disney as an "Imagineer" or some such, and Steve Jobs, now King of Pixar, is the Man Who Would Be President of Disney . So Apple's hackers are still there. Just not in any position to establish policy, make decisions, direct the company . Let's take a look at the two great inventors mentioned at the top of this article. Edison, home schooled due to his "inattentiveness" (actually, his near-deafness was the cause), learned to look for solutions, and looked for ways he could make money . Physical labor led to telegraphy (certainly less physical), which led to innovation, which lead to invention. Edison tinkered with everything he could get his hands on. Even in his now famous laboratory, where tinkerers and thinkers came up with all sorts of consumer products (now a little company called General Electric), when Edison had surpassed 1,000 issued patents, he still took apart, reassembled , and fussed with everything that came his way. Bell, also with some difficulty in hearing, was fascinated by electrical currents , storage, phonics for the deaf, and box kites. Bell developed an entire phonetic alphabet for the deaf. He also loved to publish what he was doing, and what others were doing in the various scientific disciplines and exploratory fields. By the way, his publication is still available for all to read: National Geographic Magazine. Think of what we'd be missing without the works of these two tinkerers. These two men learned to look at the same things in a manner different from the rest of people at that time . So, Hackers are not just people who love computers, or who wear a lot of black (although , that's usually true) . Not just coders and writers , not just good with a keyboard or soldering gun or mini tool kit. And not just tinkerers. The Hacker sees things in a different way, for a different use. The "highest and best use" is a term used for specific assets (such as buildings or a well-located piece of vacant land) in the business world . The alternative use is more like it for the Hacker. What can this "black box" REALLY be used for? How can we use this whatzits in a better way? Why do we use such expensive stuff to do such-and-such? Remember, back in 1975, Steve Wozniak took a 5-1/4 inch disk drive, and reduced its total chip count from 50 to 9---and it worked. Same drive, same performance, but far cheaper to build, repair, upgrade. Same thing, viewed a different way. Hacked. People who are not Hackers , who may not be "computer literate" (although I cringe at the overuse of that term), who view things merely as they are presented, think that we're a threat. We must be regulated, or we'll break something! (Or worse, break into something.) I've had people stare at me, dumbfounded, when I mention that my Cyrix 133 with all the gizmos on it is one that I slapped together one weekend. The fact that is was fun and saved me $600 completely misses the point with these folks. For every virus intentionally put into a company's network, for every domest ic attempt on the Pentagon 's network or NORAD 's systems or Citicorp, there are a thousand acts of "Hey, I can fix that for ya" or "We can do this cheaper---Iet's try it this way" or "Wait for the Rep? I'll install it before lunch!" We see the alternatives, and if we risk a bit of failure with someone watching, one not as technically adept as are we, we still take the chance and try. This is a bad thing? View things differently. Try alternatives with the unwashed (or the Suits) watching you. Wear black when it's just not fashionable. Be willing to break things when you attempt to fix or upgrade . It's OK. Hack. Go on. Be a Hacker. Bill Hayes, a hacker who's been called much worse, writes for THUD and Blacklisted! 411, as well as other magazines. If you are interested in keeping your life from being hacked, try his book, ''Take Back Your Privacy: Keeping Your Life Off The Information Superhighway." It's $20 total ($17 plus S&H), does not wear black, and will help keep the government and corporations from hacking you and yours. Bill Hayes, 12289 Pembroke Road, Suite 151, Pembroke Pines, Florida 33025. THUD Volume 1 Issue 1 - Spring 1998 7 t-@-tSf+tSo-:et: ~¢{)-@-+ 7 11!o-:e vt+tS¢{) ~i+itS¢{)o-:e Building :Jour Own Pirate Radio Station by: mycal@mycal.net reprinted from Iron Feather Journal edited by: navig8er graphics by: covert o-:e¢{)tSi+i~ ¢{)tS++V +i++tSl o-:el l17 IIII-@-¢{)~ o-:etS+ftS-@-t the dislaimer 800mw, and a 5 watt . Instructions for modifying the Ramsey Here is a rough compilation of information about the Ramsey PA-1 for FM broadcast band operation. A section on how to FM-10, and other BA1404 Stereo FM broadcasters. Some of design and build your own antenna. Plans for a power meter , the modifications may make you BA1404 based broadcaster regulated power supply, and a dummy load. A block diagram illegal to use on the open airwaves in the US and Canada. showing a typical station. Spec sheet for the BA1404. FM-10 Also, it has been brought up the the stock Ramsey FM-10 kit modifications. Sources for parts and info. A more up to date may exceed FCC power limits when used with a proper design of my digitally synthesized transmitter. Loaded with antenna. The information contained in this article is in no way schematics, board layouts and diagrams. And now, complete, nor do I take any responsibility for it's accuracy. schematics and construction details of the FRB 5 watt With that in mind, along with the above paragraph, I must say transmitter . The price for this packet is $5 in the US and $8 "this file is for information purposes only." overseas . Address to send the money to is: mycal about this file P.O. Box 750381 When I first started hacking on my FM-10, a few of us on Petaluma, CA alt.radio.pirate were exchanging information on the mods to 94975-0381 improve the range, stability and audio quality of the FM-10. You can also use this address to send me any info that would After a couple of posts about filters and amps, my mailbox be hard to send bye-mail. I will trade info packets for hard was swamped with requests for copies of previously posted copy information, e-mail me for details . Note: this packet is in information and other questions about the FM-10 . So rather a constant state of change, more info could be added at any than drive myself crazy with sending a piece of info here and time. there, I decided to dig through my mailbox and notes and compile this file. I hope it helps. Also, if anyone has more other places to look in cyberspace information about the FM-10 or FM transmitters , antennas, alt.radio.pirate is another good forum to find or post mixing equipment, programming information, stories about information on FM radio transmitters. Although you may not pirates, or anything else that falls into this realm, please send have pirate aspirations, many of the things talked about can it to myca/@netacsys.com. I will try to update this file as new benefit everyone. Other places to scan are scLelectronics and information becomes available. (editors note: please feel free the amateur radio groups. The American Radio Relay League to submit your information to THUD magazine, find addresses (ARRL) has a useful service - the ARRL Information Mail on back cover.) Server. This is an automated mail server that lets you access many of our information files, conta ining information about FM·10 mailing list various facets of amateur radio. Some of the information has First things first. There is now a mailing list that deals with technical value that is related to all radio services. To use it, the topic of the Ramsey FM-10 and other BA 1404 based FM mail messages to info@arrl.org with the message "help". This Stereo Transmitters. Feel free to join up and contribute. To will give you all the information you need to use this service . send a message to the mailing list, send your question, reply, comment , or contribution to fm-10@dg -rtp.dg.com . To add or radio resistors bulliten delete yourself from the list, send a short message with the A little 'zine that sometimes discusses pirate/micropower funtion (add/delete/change address) along with the relevant radio along with public radio stuph. Send Frank a buck to help e-mail addresstofm-10-request@dg-rtp.dg.com . If you have out with the copying and stamps. any questions I can be reached at myca/@netacsys.com. Frank Haulgren RRB P.O. Box 3038 FM·10 archives Bellingham WA Yes, it is finally here; message archives of the FM-10 mailing 98227-3038 list and a place to puUfind schematics, reviews , stories, etc. and related to the FM-10 and other BA 1404 based FM FM·10 myths transmitters. Currently a 350mw amp plan, 800mw amp There have been several myths about the FM-10 kit. The plans , "Radio is my Bomb" text, slim jim plans/info, and the most prevelant are: BA1404 spec sheet are located there. People can FTP in dg-rtp .dg.com with the user name "anonymous" and your 1) The FM-10 puts out 100mw of power . This is not true , or at e-mail address as the password. In the FM-10 directory you'll least not true for the Ramsey FM-10's that I have tested. They currently find two sub-directories: put out between 8 and 12mw when driven with a 12 volt supply . (note: there has been several revisions of the FM-10 INCOMING - This is writable by everyone and this is where and it is possible that the original version put out more power , people should upload new stuff. but I find even that highly unlikely since it would require another amplifier stage.) Also, the FM-10 is the only low-cost MSG-ARCHIVES - This directory will have files names kit that I have seen with an amplifier stage . Most others have according to the date they were last 'sealed' . The file power outputs in the fraction of a milliwatt area. "Currant" is a running log of all e-mail messages from the last 'seal' date of the archives. I want to thank Ed Savage and the 2) The FM-10's output can be cranked up by reducing the guys at Data General, NC for making the list and the archive value of R9. This, like the above is also not true. R9 and R10 possible . are optimized for maximum output and greatest harmonic snail mail info packet suppression at 12 volts . There are much better ways of "Pirates Guide to FM Stereo" getting more outpur power than to mess with this output The information packet has evolved yet again, it is now 24 stage . Lowering the value of R9 will most likely degrade the pages . It includes plans for 4 amps; a 200mw, 350mw, FM-10's performance and cause lots of interference. 8 Volume 1 Issue 1 • Spring 1998 THUD FM-10 improvements anti-drift mod note: I sent this file and a list of other modifications to John There has been quite a bit of discussion on the FM-10's Ramsey. Low and behold 4 months later the FM-10a is frequency stability . There have been complaints that digital released. The new FM-10a incorporates all of these following receivers cannot lock onto the FM-10's signal for any great mods. length of time. I have used the follwing mod with good results (I used an N750 negative temperature compensated disc), but stereo pilot mod I have been told that mylar or polystyrene caps are even One of the first problems experienced with the FM-10 is better. difficulty in getting the stereo pilot to operate correctly. One solution is to replace C7 and C8 with a 28KHz crystal. This The FM-10 was designed to be inexpensive and cost saving works and is recommended. If you cannot find a 38KHz measures with components are inevitable. Disc ceramic crystal, you can make your life a whole lot easier withg a capacitors are less expensive than silver-mica caps , and also couple of part changes. As indicated on the Ramsey much less stable. Simply replace C16 with a silver-m ica, schematic, about 100pF is necessary to tune the oscillator. tantalum oxide, or temperature compensated disc cap (say The components supplied to achieve this are a small fixed anywhere from N150 to N750) of the same value. value capacitor (C7) and a slightly larger value trimmer capacitor (C8). Since propper setting of the trimmer occurs Ramsey FM-10 70mw output amplifier within a very small 'window' (about 5% of the trimmers range), This mod provides almost 9dB gain to bring the output power it can be difficult or impossible to adjust the pilot to 19KHz and of the Ramsey FM-10 Stereo Transmitter from 8mW to have it stay put. This can be cured by increasing the value of 70mW. Not the best design, but all the parts can be found at C7 to 100pF and replacing C8 with a 6-50pF trimmer (Radio Radio Shack! Much better designs are available at the archive Shack #272-1340); a 5-30pF trimmer will do the trick also. site. The RS trimmer will not fit the holes in the PC board. You need to cut the leads off a spare resistor and solder them to +12v the legs of the trimmer (or just use bits of stiff wire) to mount it on the component side of the board. On a second note, I replaced C7 with a 68pF cap and found it much easier to tune R1 2200hm 1/2W a rock solid 19KHz at the test point. C2 crystal mod \. 1', 1 ..... - .... ~ output Remove C7 and C8 and replace them with the 38KHz crystal and 10pF capacitor. Not that the 10pF and the crystal are running in series and the old cap setup is running in parallel. C1 note: there have been good and bad reports on using the Epson crystal from Digi-Key. From what I have heard the i nput ~ t------II--.......... crystal is quite delicate, and in at least one case the experimenter destroyed the crystal. In on of the positive the C1 cap was replaced two 22pF caps run in parallel. This yielded a rock solid stereo. GND C8 10pF 38KHz You can also use 2440 ohm 1/4 watt resistors run in parallel in place of R1. I built this thing right on the underside of the HD FM-10 kit. C1 is the cap that currently goes to the RCA antenna jack, the 9K and the 220 ohm resistor have to be bought. Not that if you cannot find 220 ohms you can make one by using two 440 ohm resistors in parallel; and that a 10K will work in place of the 9K but yields poorer performance (-5%) . The MPS2222A is from Radio Shack, part number 276- 2009. Use this part! If you substitute it for a 2N2222A you will get only half the gain. Be very careful to get the leads in the correct orientation! treble boost mod C2 is of the same value as C1. I took the one that goes to the Trebel boost is also known as pre-emphasis. The FM-10 on board antenna pad. appears to have been designed by someone outside the United States since it operates at the European audio Important! The value for R1 that seems to be optimal is 220 standard of 50 microseconds. Receivers in the US are set up ohms , but it is very close to the saturration point of the for 75 microsecond de-emphasis . R3 and R6 determine the transistor. If the amp seems noisy (interference with the TV time constant for the pre-emphasis curve . Replacing them etc.) back this value off to 240 ohms . If you lower this value 75K ohm resistors (standard value 68K ohm is close enough) below 205 ohms the power meter may read higher power but will result in improved audio response. this will not be true. The transistor will be spewing all kinds of junk and the power meter will mistake this for higher ouput (in A much better pre-emphasis/input circuit is shown in the July reality the signal we want will drop considerably). 1992 issue of Radio Electronics . Not only do they use 75K ohm resistors in their pre-emphasis, but they filter stray RF Well, that's it. Effective range with a good antenna should be signals by inserting a .001uF cap between pin 1 (of the a little over double. BA1404) and ground, and pin 18 and ground. Ramsey PA-1 2-meter to 3-meter conversion mod It has been noted that the above mod actually cause The Ramsey 2-meter amp (PA-1) can be converted for use distortion on cheaper stereo receivers, since they were mass on the FM broadcast band. The inductors L1 and L2 need to produced for the world market. They were designed for the be changed to the following: European audio standard, which Japan and other Asian nations use too. Try it out and let me know what works for you. L1 - Should be replaced with a 1-turn 1/4" diamter coil. It is identical to the stock L2 coil shown in the PA-1 manual. THUD Volume 1 Issue 1 - Spring 1998 9 L2 - Should be replaced with a 2-turn 1/4" diameter coil, one need very little coax cable. Line loss using RU58u can be more turn than the L1 coild above. killer at 100MHz . You could also try a 5/8 wave length antenna. This would give you 2+dB gain, or almost 2x power Tune up should be the same as in the PA-1 manual. Note gain on transmit. that a FM-10 kit cannot be used to drive a PA-1 kit alone . The FM-10 kit doesn't put out enough power to turn on the PA-1 kit filter design for fm radio transmitters running class C. So you have two options . One, you can do It is very important to have a clean signal. The way 99% of the "biased on" (newer kits may call this class B) modification all people who get busted for illegal transmitting is that the shown in the PA-1 manual. Doing this you can drive the PA-1 people that live around them complain about interference. with a stock FM-10, yiedling about 200-300mW of output Most of this interference is caused by harmonics. Filters cut power. Or two, you can drive teh PA-1 with the output of the down these nasties. So don't draw attention to yourself. Keep 70mW amp shown above and get close to a watt of output everyone happy, including yourself . Be clean , use a filter! power. When you amplify a signal, you get unwanted byproducts . It should be noted here that running the PA-1 "biased on" (or These are called harmonics . They show up at multiples of class B) produces a much cleaner output signal than running your starting frequency. For example, if you amplify a 50MHz the PA-1 class C. Also note that you can run the PA-1 "biased signal you may get echo's on 100MHz, 150MHz , 200MHz, on" while driving it with the 70mW amp, but you will show 250MHz and so on ... If you interfere with your neighbors TV, slightly less gain than in class C. the local fire department, or anyone else, you are just asking for trouble . If you are only on the FM band, you will hardly be antenna - most important noticed . Do you have a good antenna? I think that is the most important thing that you can do for extended range. I built a filter designs 1/4 wave gound plane using a UHF connector and 5 lengths These designs are basically from the charts in the ARRL of copper plated brazing rod (found at the local welding shop) . handbook . Works great and only cost about 3 bucks to make. Remember, a good antenna will improve your range much This is a 7 element Chebyshev filter. I run at 88.1 MHz so my further than a good amp driving a bad antenna. So this should first harmonic is at 176.2 MHz. This filter seem ideal. Inputs be you first project to increase your range . Use the formulas and outputs are at 500hms. Fe = 85.8Mhz, 3db = 95.9Mhz, out of your FM-10 manual. 20db = 116MHz, and 40db = 148Mhz. 234/freq . -length of rod .132uH .150uH .132uH example: 234/88MHz = 2.66 feet * 12 in/foot = 31.0" 234/1 08MHz = 2.17 feet * 12 in/foot = 26" in Insert the 4 ground plane rods in the 4 holes of the UHF connector. Stick them through about a quarter inch and solder into place . Solder th radiator in the top of the UHF connector (you may have to grind it a bit to make it fit) then bend the ground plane rods downward to a 45 degree angle to the radiator . There you have it. Just connect it with a 50 ohm CB antenna cable to your amplified Ramsey, stick the antenna in GND a tree or in another high place and you should have about a mile of solid coverage (when using the above amp) . Also, if you have an SWR meter you can cut the rods a little longer This next filter is a 5 element Chebyshev design . While it and start clipping the ends off until you get the best SWR does work it is not as effective as the one above as evidenced reading. by frequency values at certain decibel readings. Fe That is one 81.8Mhz, 3db = 105MHz, 20db = 147Mhz, and 40db = radiator pointing 222Mhz. straight up and four ground plane radials . .128uH .128uH Sorry for the extreme desciption but in there has been some confusion . Be careful when you bend the brazing rod, don't break the connector. Grab the rod right below the connector with a pair of vice-grips (or the likes) and bend the brazing rod at that point. Try not to have anything metal near the radiator as this will affect the radiation pattern. The radiation pattern should look a lot like a doughnut surrounding the radiator , though deformed a bit. I have been told that you can shorten the radiator and make the ground GND radials longer to lower your radiation angle, but I haven;t tried this, nor do I know what this would do to the antenna impedance . The difficult part in the above is winding the coils. 3 turns of #12 wire 1/2 inch diamter should be about .12uH. 4 turns is on the road .17uH (but ugh, #12 wire is big stuff). You could just use Old magnetic mount CB antennas can make great mobile molded inductors, I have found these work well. Try to use antennas. just take all of the base load out of them and cut the fiked value caps, or fixed value with small 5pf trimmers. The radiator to 1/4 wave length . If you need a longer radiator than latter works well when you have a spectrum analyzer to tune the one that comes with the anenna use the above mentioned these babies. brazing rod. I've tried this antenna and it workds great! It is better than my di-pole at home and you can drive to a high I just pulled a program off of a BBS that tells you how to wind optimal location for your broadcasts. Also, with this setup you inductors . Give it the value and wire size you have and it will 10 Volume 1 Issue 1 - Spring 1998 THUD tell you how many turns and what size. Way cool! More on build your own , as wimpy or as studly as you want by running this later. resistors in parallel to create 50 ohms . IE two 100 ohm 1/4 watt resistor s will create a 1/2 watt 50 ohm load. Do not use Here is a very simple Chebyshev filter. It won't knock the 50 ohm wire wound resistors , they are not 50 ohms at radio harmonics down as much as frequencies . the other two designs but the .15uH good thing about this one is rf probe that it uses standard off the For those of you (like me) who are in constant starving sehlf parts . The inductor is student mode, and DON'T have a good scope, you can use a one of those molded jobbies good DMM for RF power calculations. All you need to do is that looks like a resistor so build an RF probe. Here's the schematic (yes, taken from the you can make this very 1989 ARRL handbook. small. You may stack these things to make a better filter. .01uF 4.7meg Each stage will knock the 1st harmonic down about 15db. probe tip • ~ center of 50 ohm coax GND Both C1 and C2 are of the to braid same value. Use the 01 following values for the range you operate at: 87-90Mhz use cliplead 62pF, 90-103MHz use 54pF, and for103-108Mhz use 50pF. for ground Also of interest is that the FM-10 puts out about 8-9mW and the 2nd harmonic is -25db off the fundamental frequency you Anyway, the diode (arrow points to ground) should ideally be are broadcasting on . The FM-4 kit by Ramsey puts out a Schottky diode (low rf capacitance) although a LN914 will 130mW and the 2nd harmonic is only -12db off the work . To use just hook up to your digital meter, set on DC fundamental, which means the 2nd harmonic of the FM-4 is voltage. You will get very close to RMS RF voltage. This about as powerful as the FM-10 itself . db is log10 so 3db is 2 probe was specified for a 10 megohm meter. To calculate times, 6db is 4 times, and 9 db is 8 times, etc... power into a KNOWN purely resistive load (a.k.a. a dummy load) use this formula : recommended test equipment (E"2)/R An SWR/power meter is a giant help, a CB to 2 meter one E is the RMS RF voltage and R is the resistance of the load will suffice. Power readings will not be accurate, but can be useful for peaking. The most important part is the SWR meter , This is also useful for checking inputs and ouputs of low this is very importatn when making an antenna . power RF units, since the inexpensive power meters don't seem to do real well below 1 watt . A note on power meters . I recommonded the above type power meters because they are inexpensive and most people paranoid? interested in hacking the FM-10 have very limited funds. I've been talking to a few people that are worried about their These are by no means accurate but they will give you some 'voice' being on the air, since they are afraid of being idea what is going on. If you can spend the money you can recognized . So, I dusted off old stacks of Radio-Electronics get an accurate power meter that is designed for this band , and found two articles that may be of interest. In the January but the cost is 10-15 times more. 1993 issue they have a "Build Your Own Digital Voice Changer" using a simple real time digital signal provessor . I An RF probe could also be used as a replacement for a think that this design is very similar to the voice changing powermeter . Construction plans follow. telephones . It basically raises or lowers your voive pitch. A place called LNS Technologies at 1-800-886-7150 sells the A 50 ohm NON inductive load is also very helpful. For low kits for $59. power applications a 500hm 1/4 or 1/2 watt carbon resistor works well. This can be used to tune up your kit and amp In their Septembet 1992 issue they have a "Buil dThis DSP without interferring with anyone. Also note that you can run as Voice Effects Board " using a little more complex, much power you want, legally, as long as it doesn 't radiate . programmable, real time digital signal processor. The software they include conta ins a harmonizer, echo, reverb , A VOM is also very helpful. I would put out the extra bucks and pitch . The kit is sold by American Distributors, Inc. for and buy one with a frequency counter (if you shop around, $105 at 1-800-877-0510. You can also wr ite your own about $6-$70). Buy one that covers audio to 20MHz (or software but the programmer is several hundered dollars . more). If you are serious about electronics you need one of these! DC Electron ics has a Robot Voice kit for $15. I don't know how well this works or what it sounds like, but it claims to be dummy loads adjustable for many different effects . Dummy loads are great for testing , without radiating a signal. In fact , you can run as much power as you want into one of Ramsey's address these things legally! Basically you want to create a non- If you're looking to purchase an FM-10 kit and can't find one inductive 500hm load. This can be done with regulare carbon locally, try Ramsey Electronics, Inc. 793 Canning Parkway , resistors, or by buying pre-built amateur or CB radio loads. Victor, New York 14564 . Phone (716) 924-4560 FAX (716) For low poer (less than 1/2 watt) an ethernet terminator works 924-4555. well (check temp when using, if it gets very hot lower input power, if it is still cool you may be able to go up 3/4 watt). sources Most CB loads use a 2-watt 500hm carbon resistor you can BA1404 's andot her FM Broadcaster kits can be found at D.C. THUD Volume 1 Issue 1 - Spring 1998 11 Electronics. Phone 1-800-467 -7736 & 1-800-423 -0070 . Fax Progressive Concepts sells plans for a 88MHz to 108MHz 1-602-994-1707. They sell BA1404s for $2 each, seems to be amp. The power curves show that 12mW in will yield 2.5 the best deal going . Also they sell 38KHz crystals fro $5.99, watts, but can be driven harder fro up to 12 watts . (I have not which is also a fair deal. The crystals are tiny ones like the seen these plans) Plans only in U.S., $16 (a bit spendy, digi-key ones, but a different brand and work without ouch!) Progressive Consepts 1313 N. Grand Ave #291 problems Walnut, CA 91789. 38Khz crystals can be obtained at Digi-Key at 1-800-DIGI- If you're looking to purchase an FM-10 kit (or a PA-1 kit) and KEY. 38.000KHz by Epson America, Digi-Key part no. is can't find one locally try Ramsey Electronics, Inc. 793 SE3314 (see notes on crystal mod using this crystal, also Canning Parkway, Victor, new York 14564. Phone 1-716-924- 4560 Fax 1-716-924 -4555. Should be $29. note that this is a cylinder type crystal and kinda delicate. You are probably better off getting the 38KHz crystals from D.C. The makers of the infamous BA-1404 : Rohm Corporation, Electronics.) Rohm Electronics Division , 3034 Owen Dr., Jackson Business Park, Antioch, TN 37013 . Phone 1-615-641-2020 Mouser Electronics 1-800-346-6873, fax 1-817-483-9384. (ask for someone who deals with the BA1404) Fax 1-615- Giant catalog! 239 pages of parts! Just about everything . No 641-2022 . Also available is P.O . Box 1399 Antioch, TN minimum order for North America. $100 minimum for 37011-1399. overseas. other raw info RF Parts 1320-16 Grand Ave. San Marcos, CA 92061 They The 2SC2570 is supposedly replaceable with an ECG10. have just about any RF transistor! Also I have used an MRF901 for a replacement, though tough to mount, try bottom of the pc board and connecting the whip antenna pad to ground plane. MPS901s seem to replace the Dalbani - 2733 Carrier Ave. Los Angeles, CA 90040 1-800- 2SC2570 directly , same case too, check the pinouts though. I 325-2264 in the US or 1-213-727-0054 for the rest of the have also been told that MPS918s work well also. world. Fax is 1-213-727-6032 . They have RF transistors and other semiconductors and more! 187 page catalog . $20 The MRF239 can be used as direct replacement for the minimum order. Ramsey 2 meter PA-1 kit. Cost is around $14 bucks. Panaxis Productions makes some very high quality FM Newark also has the 38KHz crystals fro $2.90 (I don't know transmitters. The last word in transmitt ing with tons of kits. Newark's address, this was sent to me in the mail, will try to Panaxis Productions P.O. Box 130 Paradise , CA 95967-0130 find it though.) Once more, if you have any info, I stress (right next to myoid place of study, Chico State!) Phone "ANY", about this subject please drop me a byte or two. Have 1-916-534-0416. Catalogs are $2 but well worth the price. A fun, your pal Mycal - mycal@netronix.com. must have item. 1)I~ll ) .. INI~ IF YOU WANT TO GET ANY OF THE FOLLOWING INTO OUR NEXT (SUMMER) ISSUE OF "THE HACKERS UNDERGROUND DIGEST" PLEA f SEND THE MATERIAL TO US BEFORE THE DEADLINE. WE'RE LOOKING FOR: IIA'/G/KA/AA'TWIIA'K PHIITIII/MPH./'II''IIVA''APIIA'/IFKAt'K/KGA'FUIFP/IFM. AA'T/t'/F./'11Kt'A8/FTIf IF/FPHIIK#; PIIWFIl Mil/it F/Ft'mIlK/t'J; PA'II.1Ft'J:( t'IIMPVIFA'J; FTt: YOU EED TO HA'il MA TE ~ LSENT TO US BY u e 1 h, 1998 (Volume 1, Issue 2 Summer 1998) ©@~1i' ®~ & ©W~®@Q:{]D1i' oooo@1i'& WD~ @~Q:{]@@~ &~@ fl,~&OO~ @@~~1i'Q:{]D~@ 12 Volume 1 Issue 1 - Spring 1998 THUD The United States Senate, or Upper House of Congress , is comprised of two senators from each state. Senators were origiganlly chosen by the legislative powers of each state but since 1913 when the 17th Amendment went into effect, they have been chosen by popular vote of the citizens of each state . The requirements to become a senator are simple and straightforwa rd. The candidate must be at least 30 years old, a citizen of the United States for at least 9 years, and a resident of the state for which they are to be a senator. The vice-president of the United States acts as the presiding officer of congress and only votes whent he senate is deadlocked in a tie. Senators gather in committees to handle the legislative powers granted them by the Constitution. Among the 16 or so committees are those on Appropriations, Foreign Relations, Armed Services, Banking and Currency, Finance, Judiciary, and even Public Works. The power of the senate, along with the House of Representatives, has the power, as outlined in Article 1, Section 8 of the Constitution, to collect taxes, regulate commerce between the states and with foreign nations, to coin money, raise and support armies, declare war, and make all laws necessary for the execution of it's own powers. However, the Senate has some specific duties as well, such as the confirmation of presidential appointments and the power to try impeachments. Impeachments, by the way, must be initiated by the House of Representatives. Following is a list of all the current senators of the United States, listed by state , their snail-mail address and voice telephone numbers. Also included are their email addresses as well as web sites concerning each senator . You can also call the Congressional switchboard at 1-202-225-3121 and ask to be switched to your Senator. Now you have the means of contacting your senator and either supporting or caomplaining about their work. The true power of America is meant to lie in the hands of it's citizens. Exercise that right and become involved in the politics of your nation. Don't be a shmuck and let someone else decide for you what is best for you. Decide for yourself!!! Alaska Hutchinson, Tim (R) Colorado Murkowski, Frank H. United States Senate Campbell , Ben N. (R) United States Senate 708 Hart Senate Office Building United States Senate 706 Hart Senate Office Building Washington, D.C. 20510 380 Russell Senate Office Building Washington, D.C. 20510 1-202-224-2353 1-202-228-3973 Washington, D.C. 20510 1-202-224-6665 1-202~224-5301 http://www .senate .gov/-hutchi 1-202-224-5852 1-202-224-1933 email@murkowski.senate.gov http://www .falcontech .com/nig http://www.senate .gov/-murkow http://www .state.ak .us/local/ Arizona Allard, Wayne (R) Kyl, Jon (R) United States Senate Stevens, Ted (R) United States Senate 716 Hart Senate Office Building United States Senate 702 Hart Senate Office Building Washington, D.C. 20510 522 Hart Senate Office Building Washington, D.C. 20510 1-202-224-5941 1-202-224-6471 Washington, D.C. 20510 1-202-224-4521 1-202-224-2207 http://www .senate.gov/senator 1-202-224-3004 1-202-224-2354 info@kyl.senate.gov Senator_Stevens@stevens.senate.gov http://www.house.gov/-kyl/ Connecticut http://www .senate.gov/-steven Dodd, Christopher J. (D) McCain, John (R) United States Senate Alabama United States Senate 444 Russell Senate Office Building Sessions, Jeff (R) 241 Russell Senate Office Building Washington, D.C. 20510 United States Senate Washington , D.C. 20510 1-202-224-2823 1-202-224-1083 34 Dirksen Senate Office Building 1-202-224-2235 1-202-228-2862 sen_dodd@dodd .senate.gov Washington, D.C. 20510 Senator_McCain@mccain.senate.gov http://www .senate.gov/-dodd/ 1-202-224-4124 1-202-224-3149 McCain, John (R) cont... sessions@wrtdnet.net http://aspin.asu.edu/-pctp/mc Lieberman, Joseph I. (D) http://www.senate.gov/senator United States Senate 316 Hart Senate Office Building Shelby, Richard C. (R) California Washington, D.C. 20510 United States Senate Boxer, Barbara (D) 1-202-224-4041 1-202-224-9750 110 Hart Senate Office Building United States Senate senatorJieberman@ Washington, D.C. 20510 112 Hart Senate Office Building lieberman .senate.gov 1-202-224-5744 1-202-224-3416 Washington, D.C. 20510 http://www.senate.gov/-Iieber senator@shelby.senate.gov 1-202-224-3553 1-415-956-6701 http://www.senate.gov/senator senator@boxer.senate.gov http://www.senate.gov/-boxer/ Delaware Arkansas Biden Jr., Joseph R. (D) Bumpers, Dale (D) Feinstein, Dianne (D) United States Senate United States Senate United States Senate 221 Russell Senate Office Building 229 Dirksen Senate Office Building 331 Hart Senate Office Building Washington, D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510 1-202-224-5042 1-202-224-0139 1-202-224-4843 1-202-224-6435 1-202-224-3841 1-202-228-3954 senator@biden.senate.gov senator@bumpers.senate.gov senator@feinstein.senate.gov http://www.senate.gov/-biden/ http://www .senate.gov/-bumper http://www.senate.gov/-feinst THUD Volume 1 Issue 1 - Spring 1998 13 Roth Jr. William V. (R) Kempthorne, Dirk (R) Landrieu, Mary (D) United States Senate United States Senate United States Senate 104 Hart Senate Office Building 367 Dirksen Senate Office Building 825 Hart Senate Office Building Washington, D.C. 20510 Washington , D.C. 20510 Washington, D.C. 20510 1-202-224-2441 1-202-228-0354 1-202-224-6142 1-202-224-5893 1-202-224-5824 1-202-224-2952 Roth Jr. William V. (R) cont... dirk_kempthorne@ mary96@worldnet.att.net http://www.senate.gov/-roth/ kempthorne. senate.gov http://www .senate.gov/senator http://www.senate.gov/-kempth Florida Illinois Massachusetts Graham, Robert (D) Moseley-Braun, Carol (D) Kennedy, Edward M. (D) United States Senate United States Senate United States Senate 524 Hart Senate Office Building 320 Hart Senate Office Building 315 Russell Senate Office Building Washington, D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510 1-202-224-3041 1-202-224-2237 1-202-224-2854 1-202-224-2626 1-202-224-4543 1-202-224-2417 bob_graham@graham.senate.gov 1-202-228-1318 senator@kennedy.senate.gov http://www.senate.gov/-graham senator@moseley-braun.senate.gov http://www .senate.gov/-kenned Moseley-Braun, Carol (D) cont... Mack, Connie (R) http://www.senate.gov/-mosele Kerry, John F. (D) United States Senate United States Senate 517 Hart Senate Office Building Durbin, Richard (D) 421 Russell Senate Office Building Washington, D.C. 20510 United States Senate Washington, D.C. 20510 1-202-224-5274 1-202-224-8022 267 Russell Senate Office Building 1-202-224-2742 1-202-224-8525 chairman_ mack@jec .senate.gov Washington, D.C. 20510 john_kerry@kerry.senate.gov connie@mack.senate.gov 1-202-224-2152 1-202-224-0868 http://www.senate.gov/-kerry/ http://www .senate.gov/-mackl http://www.senate.gov/senator Maryland Georgia Indiana Mikulski, Barbara A. (D) Cleland, Max (D) Coats, Daniel R. (R) United States Senate United States Senate United States Senate 709 Hart Senate Office Building 4633 Dirksen Senate Office Building 404 Russell Senate Office Building Washington, D.C. 20510 Washington , D.C. 20510 Washington, D.C. 20510 1-202-224-4654 1-202-224-8858 1-202-224-3521 1-202-224-0072 1-202-224-5623 1-202-228-4137 senator@mikulski .senate.gov http://www.senate.gov/-coats/ http://www.senate.gov/-mikuls Coverdell, Paul (R) United States Senate Lugar, Richard G. (R) Sarbanes, Paul S. (D) 200 Russell Senate Office Building United States Senate United States Senate Washington, D.C. 20510 306 Hart Senate Office Building 309 Hart Senate Office Building 1-202-224 -3643 1-202-228-3783 Washington , D.C. 20510 Washington, D.C. 20510 senator_coverdell@ 1-202-224-4814 1-202-228-3060 1-202-224-4524 1-202-224-1651 coverdell.senate.gov lugar@iquest.net senator@sarbanes.senate .gov http://www .senate.gov/-coverd http://www.iquest.netllugar/w http://www.senate .gov/-sarban Hawaii Maine Akaka, Daniel K. (D) Kansas Snowe, Olympia (R) United States Senate Brownback, Sam (R) United States Senate 720 Hart Senate Office Building United States Senate 495 Russell Senate Office Building Washington, D.C. 20510 141 Hart Senate Office Building Washington, D.C. 20510 1-202-224-6361 1-202-224-2126 Washington, D.C. 20510 1-202-224-5344 1-202-224-1946 http://www.senate.gov/senator 1-202-224-6521 1-202-224-8952 Olympia@snowe.senate.gov http://www .senate.gov/senator http://www.senate.gov/-snowe/ Inouye, Daniel K. (D) United States Senate Roberts , Pat (R) Collins, Susan (R) 722 Hart Senate Office Building United States Senate United States Senate Washington, D.C. 20510 116 Dirksen Senate Office Building 40-4 Dirksen Senate Office Building 1-202-224-3934 1-202-224-6747 Washington, D.C. 20510 Washington, D.C. 20510 senator@inouye.senate.gov 1-202-224-4774 1-202-224-3514 1-202-224-2523 1-202-224-2693 http://www.senate.gov/-inouye http://www.senate.gov/senator collins96@midcoast.com Iowa Kentucky Michigan Harkin, Thomas (D) Ford, Wendell H. (D) Levin, Carl (D) United States Senate United States Senate United States Senate 531 Hart Senate Office Building 173A Russell Senate Office Building 459 Russell Senate Office Building Washington, D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510 1-202-224-3254 1-202-224-9369 1-202-224-4343 1-202-224-0046 1-202-224-6221 1-202-224-1388 tom_harkin@harkin.senate.gov wendel'-ford@ford.senate.gov senator@levin.senate.gov http://www .senate.gov/-harkin http://www .senate.gov/-ford/ http://www.senate.gov/-Ievin/ Grassley , Charles E. (R) McConnell, Mitch (R) Abraham, Spencer (R) United States Senate United States Senate United States Senate 135 Hart Senate Office Building 361A Russell Senate Office Building 245 Dirksen Senate Office Building Washington , D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510 1-202-224-3744 1-202-224-6020 1-202-224-2541 1-202-224-2499 1-202-224-4822 1-202-224-8834 chuck_grassley@grassley.senate.gov senator@mcconnell.senate.gov michigan@abraham.senate.gov http://www.senate.gov/senator http://www.senrlte.gov/-mcconn http://www.senate.gov/-abraha Idaho Louisiana Minnesota Craig, Larry E. (R) Breaux, John B. (D) Wellstone, Paul (D) United States Senate United States Senate United States Senate 313 Hart Senate Office Building 516 Hart Senate Office Building 717 Hart Senate Office Building Washington, D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510 1-202-224-2752 1-202-228-1067 1-202-224-4623 1-202-224-4268 1-202-224-5641 1-202-224-8438 larry_craig@craig.senate.gov senator@breaux.senate.gov senator@wellstone.senate.gov http://www.senate.gov/-craig/ http://www.senate.gov/-breaux http://www .senate.gov/-wellst 14 Volume 1 Issue 1 - Spring 1998 THUD Grams. Rod (R) Dorgan , Byron L. (D) Nevada United States Senate United States Senate Bryan, Richard H. (D) 261 Dirksen Senate Office Building 713 Hart Senate Office Building United States Senate Washington, D.C. 20510 Washington, D.C. 20510 364 Russell Senate Office Building 1-202-224-3244 1-202-228-0956 1-202-224-2551 1-202-224-1193 Washington, D.C. 20510 mai'-grams@grams.gov senator@dorgan.senate.gov 1-202-224-6244 1-202-224-1867 http://www.senate.gov/-grams/ http://www .senate .gov/-dorgan senator@bryan.senate.gov Missouri http://www.senate.gov/-bryan/ Bond, Christopher S. (R) Nebraska United States Senate Hagel, Chuck (R) Reid, Harry (D) 293 Russell Senate Office Building United States Senate United States Senate Washington, D.C. 20510 40-3 Dirksen Senate Office Building 324 Hart Senate Office Building 1-202-224-5721 1-202-224-8149 Washington, D.C. 20510 Washington, D.C. 20510 kit_bond@bond.senate.gov 1-202-224-4224 1-202-224-5213 1-202-224-3542 1-202-224-7327 http://www .senate.gov/-bond/ email@hageI96.com senator_reid@reid .senate .gov http://www .senate .gov/senator http://www .senate.gov/-reid/ Ashcroft , John (R) New York United States Senate Kerrey, Bob (D) Moynihan, Daniel P. (0) 170 Russell Senate Office Building United States Senate United States Senate Washington, D.C. 20510 303 Hart Senate Office Building 464 Russell Senate Office Building 1-202-224-6154 1-202-228-0998 Washington, D.C. 20510 Washington, D.C. 20510 john_ ashcroft@ashcroft.senate .gov 1-202-224-6551 1-202-224-7645 1-202-224-4451 1-202-228-0406 http://www .senate.gov/-ashcro bob@kerrey .senate.gov senator@dpm .senate.gov http://www .senate .gov/-kerrey http://www.senate.gov/-moynih Mississippi Cochran, Thad (R) New Hampshire D'Amato, Alfonse M. (R) United States Senate Gregg, Judd (R) United States Senate 326 Russell Senate Office Building United States Senate 520 Hart Senate Office Building Washington, D.C. 20510 393 Russell Senate Office Building Washington, D.C. 20510 1-202-224-5054 1-202-224-9450 Washington, D.C. 20510 1-202-224-6542 1-202-224-5871 senator@cochran.senate.gov 1-202-224-3324 1-202-224-4952 senator_al@damato .senate.gov http://www.senate.gov/-cochra mailbox@gregg.senate.gov http://www.senate.gov/-damato http://www.senate.gov/-gregg/ Lott, Trent (R) Ohio United States Senate Smith, Robert (R) Glenn, John (D) 487 Russell Senate Office Building United States Senate United States Senate503 Hart Senate Washington, D.C. 20510 332 Dirksen Senate Office Building Office Building 1-202-224-6253 1-202-224-2262 Washington, D.C. 20510 Washington, D.C. 20510 http://www .senate.gov/senator 1-202-224 -2841 1-202-224-1353 1-202-224-3353 1-202-224-7983 Montana opinion@smith.senate.gov senator_glenn@glenn .senate .gov Baucus, Max (D) http://www.senate.gov/-smith/ http://little.nhlink.neUjohn United States Senate 511 Hart Senate Office Building New Jersey DeWine, Michael (R) Washington, D.C. 20510 Torricelli, Robert (D) United States Senate 1-202-224-2651 1-202-224-1974 United States Senate 140 Russell Senate Office Building max@baucus.senate.gov 728 Hart Senate Office Building Washington, D.C. 20510 http://www .senate.gov/-baucus Washington, D.C. 20510 1-202-224-2315 1-202-224-6519 1-202-224-3224 1-202-224-8567 senator_dewine@dewine.senate.gov Burns, Conrad R. (R) tprroce@torricelli .com http://www.senate.gov/-dewine United States Senate http://www.senate.gov/senator Oklahoma 187 Dirksen Senate Office Building Inhofe, James (R) Washington, D.C. 20510 Lautenberg, Frank R. (D) United States Senate 1-202-224-2644 1-202-224-8594 United States Senate 453 Russell Senate Office Building conrad_burns@burns.senate.gov 506 Hart Senate Office Building Washington, D.C. 20510 http://www.senate.gov/-burns/ Washington, D.C. 20510 1-202-224-4721 1-202-228-0380 North Carolina 1-202-224-4744 1-202-224-9707 http://www.senate.gov/-inhofe Faircloth, D. M. (R) Lautenberg, Frank R. (D) cont ... United States Senate frank_Iautenberg@ Nickles , Donald (R) 317 Hart Senate Office Building lautenberg .senate.gov United States Senate Washington, D.C. 20510 http://www.senate.gov/-Iauten 133 Hart Senate Office Building 1-202-224-3154 1-202-224-7406 Washington, D.C. 20510 senator@faircloth.senate.gov New Mexico 1-202-224-5754 1-202-224-6008 http://www.senate .gov/-faircl Bingaman, Jeff (D) senator@nickles.senate .gov United States Senate http://www .senate .gov/-nickle Helms, Jesse (R) 703 Hart Senate Office Building United States Senate Washington, D.C. 20510 Oregon 403 Dirksen Senate Office Building 1-202-224-5521 1-202-224-2852 Smith , Gordon (R) Washington, D.C. 20510 Senator_Bingaman@ United States Senate 1-202-224-6342 1-202-224-7588 bingaman.senate.gov 40-2 Dirksen Senate Office Building jesse_helms@helms.senate.gov http://www.senate.gov/-bingam Washington, D.C. 20510 http://www.senate.gov/-helms/ 1-202-224-3753 1-202-224-0276 North Dakota Domenici , Pete V. (R) Conrad, Kent (D) United States Senate Wyden , Ron (D) United States Senate 328 Hart Senate Office Building United States Senate 724 Hart Senate Office Building Washington, D.C. 20510 259 Russell Senate Office Build ing Washington, D.C. 20510 1-202-224-6621 1-202-224-7371 Washington, D.C. 20510 1-202-224-2043 1-202-224-7776 senator_domenici@ 1-202-224-5244 1-202-228-2717 senator@conrad.senate.gov domenici .senate.gov senator@wyden.senate.gov http://www.senate.gov/-conrad http://www.senate.gov/-domeni http://www.senate.gov/-wyden/ THUD Volume 1 Issue 1 • Spring 1998 15 Pennsylvania Frist, Bill (R) Washington Santorum, Rick (R) United States Senate Murray, Patty (D) United States Senate 565 Dirksen Senate Office Building United States Senate 120 Russell Senate Office Building Washington, D.C. 20510 111 Russell Senate Office Building Washington, D.C. 20510 1-202-224-3344 1-202-228-1264 Washington, D.C. 20510 1-202-224-6324 1-202-228-0604 senator_frist@frist.senate.gov 1-202-224-2621 1-202-224-0238 senator@santorum.senate .gov http://www.senate.gov/-frisU senator_murray@murray.senate.gov http://www.senate.gov/-santor http://www.surgery.mc.vanderb http://www .senate.gov/-murray Specter, Arlen (R) Texas United States Senate Hutchison, Kay Bailey (R) Gorton, Slade (R) 530 Hart Senate Office Building United States Senate United States Senate Washington, D.C. 20510 283 Russell Senate Office Building 730 Hart Senate Office Building 1-202-224-4254 1-202-224-1893 Washington, D.C. 20510 Washington, D.C. 20510 senator_specter@specter.senate.gov 1-202-224-5922 1-202-224-0776 1-202-224-3441 1-202-224-9393 http://www.senate.gov/-specte senator@hutchison.senate.gov Senator_Gorton@gorton .senate .gov http://www.senate.gov/-hutchi http://www .senate.gov/-gorton Rhode Island Reed, Jack (D) Gramm , Phil (R) Wisconsin United States Senate United States Senate Feingold, Russell (D) 339 Russell Senate Office Building 370 Russell Senate Office Building United States Senate Washington, D.C. 20510 Washington, D.C. 20510 502 Hart Senate Office Building 1-202-224-4642 1-202-224-4680 1-202-224-2934 1-202-228-2856 Washington, D.C. 20510 reed@collegehill.com http://www.senate.gov/senator 1-202-224-5323 1-202-224-2725 http://www .senate.gov/senator russeILfeingold@feingold.senate.gov Utah http://www.senate.gov/-feingo Chafee, John H. (R) Bennett, Robert (R) United States Senate United States Senate Kohl, Herbert H. (D) 505 Dirksen Senate Office Building 431 Dirksen Senate Office Building United States Senate Washington, D.C. 20510 Washington, D.C. 20510 330 Hart Senate Office Building 1-202-224-2921 1-202-228-2853 1-202-224-5444 1-202-224-4908 Washington, D.C. 20510 senator_chafee@chafee.senate.gov senator@bennett.senate.gov 1-202-224-5653 1-202-224-9787 http://www.senate.gov/senator http://www.senate.gov/-bennet senator_kohl@kohl.senate.gov http://www.senate.gov/-kohl/ South Carolina Hatch, Orrin G. (R) Hollings , Ernest F. (D) United States Senate West Virginia United States Senate 131 Russell Senate Office Building Byrd, Robert C. (D) 125 Russell Senate Office Building Washington, D.C. 20510 United States Senate Washington, D.C. 20510 1-202-224-5251 1-202-224-6331 311 Hart Senate Office Building 1-202-224-6121 1-202-224-4293 senator_hatch@hatch.senate.gov Washington, D.C. 20510 senator@hollings.senate.gov http://www.house.gov/-hatch/ 1-202-224-3954 1-202-228-0002 http://www.senate.gov/-hollin senator_byrd@byrd.senate.gov http://www .senate.gov/senator Thurmond, Strom (R) Virginia United States Senate Robb, Charles S. (D) Rockefeller , John D. (D) 217 Russell Senate Office Building United States Senate United States Senate Washington, D.C. 20510 154 Russell Senate Office Building 109 Hart Senate Office Building 1-202-224-5972 1-202-224-1300 Washington, D.C. 20510 Washington, D.C. 20510 senator@thurmond .senate .gov 1-202-224-4024 1-202-224-8689 1-202-224-6472 1-202-228-7665 http://www.senate.gov/-thurmo Senator_Robb@robb.senate.gov senator@rockefeller.senate.gov vascr@CapAccess .org http://www.senate.gov/-rockef http://www .senate .gov/-robb/ South Dakota Wyoming Daschle, Thomas A. (D) Warner, John W. (R) Enzi, Michael (R) United States Senate United States Senate United States Senate 509 Hart Senate Office Building 225 Russell Senate Office Building 116 Dirksen Senate Office Building Wash ington, D.C. 20510 Washington , D.C. 20510 Washington, D.C. 20510 1-202-224-2321 1-202-224-2047 1-202-224-2023 1-202-224-6079 1-202-224-3424 1-202-228-0350 tom_daschle@daschle.senate.gov senator@warner.senate .gov senator@enzi .senate.gov . http://www.senate.gov/-daschl http://www.senate .gov/-warner http://www.senate.gov/-enzi/ Johnson, Tim (D) Thomas, Craig (R) United States Senate Vermont United States Senate 528 Hart Senate Office Building Leahy, Patrick J. (D) 302 Hart Senate Office Building Washington, D.C. 20510 United States Senate Washington, D.C. 20510 1-202-224-5842 1-202-228-0368 433 Russell Senate Office Building 1-202-224-6441 1-202-224-1724 tim@win .dakota.net Washington, D.C. 20510 craig@thomas.senate.gov http://www .senate.gov/johnson 1-202-224-4242 1-202-224-3595 senator_leahy@leahy.senate.gov Tennessee http://www .senate .gov/-Ieahy/ Thompson , Fred (R) United States Senate Jeffords, James M. (R) 523 Dirksen Senate Office Building United States Senate Washington, D.C. 20510 513 Hart Senate Office Building 1-202-224-4944 1-202-228-3679 Washington, D.C. 20510 senator_thompson@thompson.senate.g 1-202-224-5141 na ov vermont@jeffords.senate.gov http://www.senate.gov/-thomps http://www .senate.gov/-jeffor 16 Volume 1 Issue 1 - Spring 1998 THUD RC DR AMES Sales - Parts - Service - Custom If you're looking for one of those hard to find arcade games, this is the place to call. We have one of the largest selections of hard to find classic arcade games and pinballs. If you're looking for a part or you just want an arcade game for your business site or for home use, give us a call. Be sure to mention you saw the ad here in Blacklisted! 411. THUD Volume 1 Issue 1 - Spring 1998 17 .t4ALU6.EAL.EKT .P~.B.IiC .E'.B.E,s U.EKeI.E6 by: Dr. Whip ALRIGHTY THEN, I'm sure there's quite a few of us out Connecticut 154.625 154.740 there who have spent a few dollars on at least a simple Lake Compounce Festival 155.370 157.740 scanner. I also know there's some people who should be Park 158.100 158.460 locked up for their obsession with scanning. Instead of a 464.425 464.475 171.025 173.225 469.425 469.475 173.275 173.325 microwave oven they buy microwave receivers . Well, Quassy Amusement Park 173.375 184.400 whatever level of scanner enthusiast you are I'm sure 154.57 199.400 204.600 every once in a while we've gone to the local amusement Florida 204.850 206.000 park with friends or family. Some of us even live n~ar Busch Gardens Tampa 206.300 206.625 them. Surely we've all noticed lotsa people walking 461.7125 462.0875 206.975 207.350 around with walkie-talkies or other radio equipment while 467.1125 207.600 207.750 visiting and having a jolly 01' good time (NOT!) or even Cypress Gardens 208.175 208.625 seen the odd utility cart with a radio on it. Now, for you're 464.425 208.950 209.100 listening pleasure for those who just can't get away fr~m Lion Country Safari 209.425 209 .600 a receiver while entertaining the kiddies we have a fairly 464.375 469.375 210.125 211.850 comprehensive list of scanner frequencies. It's broken Miracle Strip Amusement 212.475 442.000 Park 443.400 448.400 down by state so it shouldn't be too hard for you to find 462.1 450 .0625 450.1875 what you're looking for. Sea World of Florida 450 .3125 450.4375 151.775 151.805 451.500 452 .700 Arkansas 467.875 467.9 154.515 154.54 453.475 453.875 Magic Springs Family Theme 467.925 490.1625 154.6 461.0125 453.925 452.650 Park 490.2625 493.1625 461 .0375 461 .1 453.825 453.875 154.515 154.54 493.2625 461.1625 461.2625 453.925 461 .300 California Raging Waters 461.2875 461 .5875 461.3375 461 .600 Belmont Park 462 .6 463.9875 461.675 461.7375 461 .700 461 .9125 464.8875 469.8875 464.1375 464.9875 461.775 461.85 462.475 462.550 Disneyland Santa Cruz Beach Boardwalk 462.0 463 .325 462.575 462.625 154.625 461 .85 461.0625 461.0875 463.3875 463.5625 462 .650 462.675 464.5375 464.6375 462 .0625 462 .1625 463.675 463 .825 462.775 462 .850 464.4125 464 .575 463.925 466.0625 463.9125 463.95 463.750 463 .975 464.7625 464.5125 466.0875 467.0625 464.0375 464.0875 464.0625 464.125 464.7125 464.1625 467 .1625 468.925 464.1 464.2125 464.200 464 .200 464.1125 464 .9875 Sea World of California 464.2875 464.3375 464.400 464 .500 464.8875 938.3875 42.96 154.515 464.3875 464.4375 464 .525 464.600 938.40 938.4125 154.54 460.8875 464.4875 464.525 464.625 464.800 938.425 938.4375 461.0875 461.1625 464.6625 464.725 464.9375 467.250 938.45 938.4625 461 .3875 461.4875 464.775 464 .825 467.575 468.8125 938.475 938.4875 461.5375 461.5875 464.875 464 .975 469.3375 483.000 938.50 461.6625 461 .6875 465.0 466.0125 484.175 484.325 Hecker Pass: A Family 461 .7625 461.7875 466.0375 466 .1 484.350 484.375 Adventure 462.06-25 462.0875 466.1625 466.2625 806.000 851.3125 460.8875 461 .8875 462.85 462.8875 466.2875 466 .5875 851.5625 851.8875 462 .8875 463.8875 463.6625 463.6875 466.675 466.7375 852.1875 852.2375 464 .8875 465.8875 463.7125 464 .05 466.775 466.85 852.3625 852.4125 Knotts Berry Farm 464.1875 464.2125 467.0 467 .1375 852.5625 852.7375 151.625 151.655 464.4375 464.4625 467.8375 468.325 852.8125 853.4625 151.685 151.745 464.9125 465.8875 468.675 468.825 53.4875 853.7125 154.54 154.57 466.0875 466.1625 468.95 469.1 854.3375 855.1875 154.6 158.46 466.3875 466.4875 469.2125 469 .2375 855.6875 855.7875 461.1875 461 .7875 466.5375 466.5875 469.2625 469.2875 855.8125 855.8875 462.0375 462 .0625 466.6625 466.6875 469 .3125 469 .3875 855.9875 856.7875 462.1125 462 .1375 466 .7625 466.7875 469.6625 469 .725 856.8125 856.9125 463.5875 464.6625 467 .0625 467.0875 469.825 896.6875 857.1625 857.1875 464.8625 466 .1875 467 .8875 468.6625 897.1875 898.1875 857.7875 857.8125 466.3625 466.3875 468.6875 468 .7125 899.1875 899.7125 858.0375 858.7875 466 .6875 466 .7875 469.05 469.1875 935.6875 936.1875 858.8125 859.7875 467.0375 467.0625 469 .2125 469.4375 937.1875 938.1875 859.8125 860.7875 467.1125 467 .1375 469.4625 469.9125 938.7125 957.05 915.000 468.5875 469.2625 Six Flags Magic Mountain 957.65 959.35 Georgia 469.6375 469.6625 151.685 151.715 Shipwreck Island Six Flags Over Georgia 469.7125 469 .8625 151.745 151.775 462.15 462.05 462.1 Marine World-Africa USA 151.805 151.895 Wet'N Wild 464.575 464 .675 151.925 151.955 151.995 151.515 154.6 464 .975 467 .1 461 .7375 464.6875 154.54 154.57 Universal Studios Florida 467.875 469.575 469.6875 468.8125 463.225 928.1625 469.675 469 .975 Paramount's Great America Universal Studios Hollywood 952.1625 Hawaii 157.74 457.525 151.745 151.83 Walt Disney World Waimea Falls Park 457.55 457 .575 Colorado 123.050 127.750 151.745 151.865 457 .6 465.9 Elitch Gardens 147.300 147.900 151.925 465.975 466.05 466.3625 469.5125 148.100 151.200 Idaho 466.125 466 .2 469.5375 469.5625 151.655 151.625 Silverwood Theme Park 466.275 466.35 Lakeside Park 151.745 151.775 122.85 154.6 466.425 467.75 457.575 151.865 151.925 157.56 160.845 467 .775 467 .8 Santa's Workshop 151.895 154.430 464.425 469 .375 467.825 467.85 461.5 461 .675 154.4787 154.47875 469.425 18 Volume 1 Issue 1 - Spring 1998 THUD Illinois 461.7625 463.425 463.675 464.0375 462.1125 462.8625 Knight's Action Park 464.175 464.275 464.4375 466.1625 462 .8875 462.9 151.925 151.955 468.425 469 .175 466.325 466.4875 463.2125 463.2375 Six Flags Great America 469.275 469.55 467 .1375 467.7625 463.3875 463.7 457.525 457 .55 Nebraska 467.8125 467 .8625 463.7375 464.85 457.575 457.6 Peony Park 468.2625 468.5125 466.1 466.125 460.6125 463.3625 464.425 468.6625 468.675 466.4375 466.7875 463.6 464.375 Nevada 469 .0375 469.4375 467 .1125 468.7 464.475 464.675 Wet'NWild Sea World of Ohio 468 .7375 469.85 464.775 464.875 461.3 461 .975 154.54 154.6 Sea World of Texas 465 .9 465.975 464.0 464.375 462.025 463.2125 461.15 461 .35 466.05 466.125 466.3 463.2625 463.3125 461.65 461.6875 466.2 466.275 New Jersey 463.4625 463.5125 462.0625 462.0875 466.35 466.425 Action Park 464.025 464.825 462 .1625 463.45 467.75 467.775 154.57 154.6 464.875 467.025 464.0875 464.1875 467.8 467.825 Mariner's Landing 468.2125 468.2625 464 .2125 464.325 467.85 467.875 151.895 151.985 468 .3125 468.4625 464.4625 464.5125 467.9 467.925 Six Flags Great Adventure 468 .5125 469.875 464.675 465.0 468.6 469.375 154.54 154.6 Wyandot lake 466.15 466.35 469.475 469.675 461 .775 464.325 151.655 466.65 466.6875 469.775 469.875 464.425 464.625 Oklahoma 467.0625 467.0875 Indiana 464.675 464.825 Bells Amusement Park 467 .1625 468.45 Indiana Beach 464.975 466.775 461.25 466.25 469.0875 469.1875 151.865 155.22 469.325 469.425 Frontier City 469.2125 469.325 Old Indiana Fun Park 469.675 469.825 464 .775 464.975 469.4625 469.5125 151.745 469.975 Pennsylvania 469.675 Iowa Storybook Land Bland's Park Six Flags Over Texas Arnolds Park 464.925 464.2125 464.5125 457.55 461.3125 461.975 New Mexico 464 .7125 462 .1125 462 .9125 Kansas Cliffs Amusement Park Dorney Park 463.8125 464 .2125 Joyland 463.225 467.8 151.835 151.865 464 .3875 464.425 154.6 468.225 151.895 151.925 464.5125 464.7375 Kentucky New York Dutch Wonderland 466.575 466.6625 Kentucky Kingdon Darien Lake 151.715 151.745 468.5125 469.3875 463.425 468.425 151.655 151.715 Hersheypark 469.425 Maine 151.745 . 151.775 461 .325 464.375 Western Playland Palace Playland 151.805 154.515 464.425 464 .575 154.515 151.655 Fantasy Island Idlewild Park Wet'N Wild York's Wild Kingdom Zoo and 464.525 151.685 154.515 461 .0875 461.2125 Amusement Park North Carolina Kennywood 461 .7375 154.6 151.655 151.755 Emerald Point 151.865 Wonderland Park 151.805 151.835 151.745 154.54 Sandcastle 154.57 Massachusetts Paramount's Carowinds 151.745 466 .3625 Utah Riverside Park 461.375 461 .6 Sesame Place 49th Street Galleria 154.625 464.525 461.875 461.975 151.685 151.715 464 .575 464.5625 464.825 462.025 462.8 151.805 151.895 Lagoon 464.925 464 .65 151.955 154.515 154.515 154.54 Whalom Park Santa's Land Waldameer 158.46 461.0125 154.515 154.57 151.685 154.54 Raging Waters Michigan Tweetsie Railroad Rhode Island 461.3 462.0125 Michigan's Adventure 464.475 468.4 Rocky Point Park 466 .3 464.975 Amusement Park 468 .8875 468.9 464.825 464.925 Virginia 154.54 Ohio South Dakota Busch Gardens Williamsburg Minnesota Beach Waterpark Flintstones Bedrock City 334.4 463.225 Valleyfair! 463.9 468.9 151.805 464.175 468.225 463.4625 463.5125 Cedar Point Tennessee 469.175 806.0 463.8625 463.9125 151.685 154.515 Dollywood Paramount's Kings Dominion 463.9375 463.9625 461.3 463.6125 463 .525 463.575 461.4125 461 .975 463.9875 464.0375 463 .8625 464.2125 463 .8 463 .825 464.175 464.35 464 .9875 469 .0375 464.3125 464.375 463.925 464.025 464.475 464.925 Missouri 464.4125 464.5125 464.05 464.1 466.975 469.175 Ocean's of Fun 464.575 464 .6125 464 .675 464.7 469 .35 469.475 463.775 468 .75 466.3 468.8625 464.725 468.525 469.925 468.775 469.2125 469.3125 468 .575 468.8 Water Country USA Silver Dollar City 469.4125 469.5125 468.925 469.025 464.525 151.685 151.835 469 .6125 469.05 Washington 151.865 152.3 Coney Island Libertyland Fun Forest 157.56 157.62 151.925 154.515 464 .775 464.825 461 .6625 463 .8125 465.0 154.54 154.57 464.925 Wisconsin 468 .8125 154.6 Texas Circle M Corral Family Fun Six Flags Over Mid-America Geauga Lake AstroWorld Park 461.2125 462.1375 154.515 154.57 462 .1625 462 .1825 461.95 466.95 463.2125 464 .2625 Paramount's Kings Island 467.1625 467.1825 Circus World Museum 464.325 464.3875 154.54 154.57 462 .7 467.7 461.325 464.325 464.4125 464 .5125 154.6 461.1625 462.7875 461.4375 469.325 464 .6875 469.325 461.325 462.1375 463.4375 462.8125 Noah's Ark Waterpark WhiteWater 462.7625 462 .8125 Fiesta Texas 154.57 461.0375 462 .8625 463.2625 461.1 461. 125 Thumb Fun Park Worlds of Fun 463.5125 463.6625 461 .6125 461 .7625 151.715 THUD Volume 1 Issue 1 - Spring 1998 19 I H.9.ck E~-::ch.9.n'21e I Are you looking for those difficult to find parts? Or maybe just a simple novelty item for your entertainment? Or do you have a product or information you'd like to sell? The Hack Exchange is your buy/sellitrade resource . If you would like to place an ad in Hack Exchange .... Right now, all classified advertisments are FREE of charge. We must limit each person/company to two ads not more than 20 lines combined . Stay tuned for advertising rates in the future. To place an ad, send copy to the following address: THUD Magazine Advertising P.O. Box 2521 Cypress, CA 90630 EPROMS COPIED We have an EPROM duplication service. AUCTIONS! You hear about them all the time, but you've Give us your original and we can make as many copies as never been to one? You gotta GO to one. You can buy just you'd like. We Specialize in older 2516, 2532, 2716, 2732, about anything for pennies on the dollar! Cars, trucks , boats, 2764, 27128, 27562 and 27512 EPROMs. We also do houses, electronic equipment, furniture , etc. Forget that "cars Bi-Polar PROMs, as well. $6 per copy includes the copy for $100" crap. That's a load! But, you can get some pretty service, the material (any of the part numbers mentioned awesome deals for small amounts of cash .. Our favorite above) and return shipping. Bi-Polar PROMs may be slightly auctions (and many of the BL411 staff) include the arcade more or less in cost. 15% discount on 10+ copies . 20% auctions and the car auctions. Remember those arcade discount on 25+ copies . Send prepaid orders (with master games you played as a kid in the 80's? Man, you can get copy) or inquiries to: TCE Information Systems , P.O. Box some bitchen deals on those! This is only the tip of the 5142, Los Alamitos, CA 90721 iceberg. There's SO MANY things you can get for a small THUD MONTHLY MEETINGS We don't have any meetings fraction of their worth. Send $6 and we'll send you a booklet for the magazine yet. If you're interested in setting one up in loaded with names, numbers and places to go...You NEED to YOUR area, please contact us. For now , we suggest you do this! You'll find out how you can attend the non-advertised hang out at the Blacklisted! 411 meetings until we can come auctions, which will mean better deals for you. Don't miss out up with our own. THUD Magazine, P.O. Box 2521 , Cypress, on all the great deals! Send $5 right NOW: TCE Information CA 90630 "Come one, come all, just don't be a FED" Systems, P.O. Box 5142, Los Alamitos, CA 90721. BLACKLISTED! 411 Magazine From the same people who LOOKING FOR A BLACKLISTED! 411 MEETING IN YOUR produce THUD is another magazine dedicated to hackers . If AREA? The Official Hackers Magazine is looking for a few you like this magazine you will like Blacklisted! 411 . $5 good men to host meetings in your area! Would you like to sample copy. Blacklisted! 411 Magazine, P.O. Box 2506, host one? It's easy. Tell us where you want it held and give Cypress, CA 90630 us a contact name and number or email address. If you want COIN-oP VIDEO ARCADE GAMES . Repairs, parts, boards , your free subscription, you'll need to provide an address, of accessories, and empty cabinets available for all your video course. Think about starting a meeting yourself. Blacklisted! game and pinball needs. Largest selection available in the 411 Magazine, P.O. Box 2506, Cypress, CA 90630 United States. Eldorado Games 911 S. East St. Anaheim, CA 6.500MHz or 6.5536MHz CRYSTALS Your choice. $4 each. 92805 or call (714) 535-3300 FAX (714) 535-3396 No shipping charges. Send to TCE Information Systems, WEB SITES We have a list of hundreds of interesting and P.O. Box 5142, Los Alamitos, CA 90721 unusal web sites. Some of the sites are related to this ADVERTISE IN BLACKLISTED! 411 Reach thousands of magazine and some are not. Hacking , phreaking , breaking readers in the US, Canada, Japan , the UK, Australia, and the law, sovereign citizenship, lasers , electonics, surplus , elsewhere. Join our long list of satisfied clients who have credit, etc.. You have to check this out! Save hundreds of made Blacklisted.411 their vehicle for reaching customers. hours of time by getting our list. We will provide the list on Call 714-899-8853 and request our rate card information. 3-1/2" disk and you can load it directly into your web browser Blacklisted! 411 Magazine, P.O. Box 2506, Cypress. CA and click on the links OR we can provide the list on paper - 90630 whichever you prefer. Send $5 to TCE Information Systems , ADULT VIDEOS. We have all the newest releases for $25.99 P.O. Box 5142, Los Alamitos, CA 90721 plus s/h or LESS. Get the latest titles, hottest names; Raquel "TAKE BACK YOUR PRIVACY" Author and Speaker Bill Darian, Mrylin Star, Nikki Dial, Janine, etc. Amateur, all girls, Hayes shows you how to stay cyber, yet stay private. Real etc. New titles every week. For latest prices, send SASE to: world tips and examples to keep prying eyes and electrons E&M Adult Videos, P.O. Box 1471, Los Alamitos, CA 90720. out of your life. Send $18.00 (I won't keep any records on you, "I'VE BEEN BLACKLISTED!" T-shirts now available. your cash, address, or checking account) plus $2.50 SH to: Endorsed by the Blacklisted! 411 crew. Get yours now. Bill Hayes, 12289 Pembroke Road, Suite 151, Hollywood, FL White lettering on black shirt. Available in large and extra 33025 or leave a message at (954) 537-3792. The privacy large sizes. $14.95 each shipped. Send to TCE Information you preserve will be your own . .. Systems, P.O. Box 5142, Los Alamitos, CA 90721 . "I LOVE TOXIC WASTE" T-SHIRTS Now available .Red on THUD MAGAZINE WANTS YOU! We're still really new, so white. Available in Large and Extra Large . $16.95 each. TCE we're looking for a few things . If you're a hacker, artist, writer Information Systems, P.O. Box 5142 , Los Alamitos, CA 90721 or all around freak, send us what ya got! We can offer free ADVERTISE IN BLACKLISTED! 411 Reach thousands of subscriptions in exchange for articles or artwork we end up hackers in the US, Canada, Japan, the UK, Australia , and printing. So, get off your butt and send us some good stuff to elsewhere. Join our long list of satisfied clients who have print in the magazine . THUD Magazine, P.O. Box 2521, made Blacklisted.411 their vehicle for reaching customers. Cypress, CA 90630 . Blacklisted! 411 Advertis ing, P.O. Box 2506, Cypress, CA RUGA? If you know what this is, I have one thing to say: 90630 . Call 714-899-8853 and request our rate card Pobleet '87. WAX ANDERSON SHOKE MAYONASAL IT'S information. ONLY RUBBER DUDE RAUL OBI WAN CENTOBI AJBV87 Volume 1 Issue 1 - Spring 1998 THUD POLice CODes Ten Codes: Horse; U)Pickup Animal 405-Citizens Holding Prisoner 1-Receving Poorly 97-Arrived at Scene 406-0fficer Needs Emergency Help 2-Receiving OK 98-Finished Last Assignment 407-Prisoner Transport 4-0K 408-Ambulance 5-Relay Eleven Codes: 409-Tow-Truck 7-Out of Service 24-Abandoned Vehicle 410-ResquestedAssistance Responding 8-1n Service 26-Abandoned Bicycle 415-Noise Complaint 9-Repeat 27-DOL Information 416-Citizen Standby 10-0ut of Service on Radio 28-Registration Information 417-Person Ringing Doorbells 12-Visitor/Officer Present 44-Coroner's Case 418-Fight or Dispute (No Weapons) 13-Weather/Road Conditions 54-Suspicious Vehicle 419-Fight or Disput (Weapons) 14-Escort 79-Accident Ambulance Enroute 420-Juvenile Disturbance 15-Station with Prisoner 80-Accident Injury 459-Burglary 16-Pickup 82-Accident Property Damage 470-Fraud 18-Equipment Check 83-Accident No Detail 476a-Fictitious Document 19-Return/Arrive at City Hall; (a)Pound; 84-Traffic Control 484-Petty Theft (b)Corp Yard; (c)Park 85-Tow Car Needed 488-Petty Theft Hdqtrs;(d)Airport 96a-Out for Investigation 496-Stolen Property Receiving 20-Location 98-Meet Officer 518-Vehicle Accident (No Injury) 21-Telephone Call 519-Vehicle Accident (Injury) 22-Cancel Codes: 520-Aided Case 23-Standby 1-Acknowledge Call 527-Bonfire 24-File Check PermiURecord 2-Urgent No Siren 528-Fire 25-00 You Have Contact 3-Emergency Siren 529-Explosion 27-DOL Information 4-No Added Support Needed 530-Bomb Threat 28-Registration 5-Stakeout 531-Suspected Explosive Device Found 29-Check for Wants 6-Want 585-Traffic Stop 30-Normal Radio Traffice 7-Out of Service 594-Malicious Mischief (Vandalism) 32-Drowning 10-Bomb Threat 595-Malicious Mischief (Grafitti) 33-Alarm Sounding 20-Assist Officer 596-Abandoned Vehicle 34-0pen Door 30-Emergency Traffic 600-Road block 35-Scramble Transmission 33-Clear Channel for Emergency 601-Tresspassers 36-Correct Time 602-Person Breaking In 37-Restricted Vehicle Code: 603-Prowler 39-Message Delivered 10851-Stolen Vehicle 647b-Prostitution 40-Available for Phone Call 10852-Tampering With Car 647f-Drunk 45-Ambulance Needed 10853-Malicious Mischief Vehicle 650-Threats 49-Proceed To 20001-Hit and Run (Felony) 799-Senile Person 50-Obtain Report 20002-Hit and Run (Misdemeanor) 800-Mentally Disturbed Person 53-Man Down 20007-Hit and Run (Parked Vehicle) 801-Person Attempting Suicide 54-Possible Dead Body 22500-lllegal Parking 802-Coroner's Case 56-Suicide 23101-Drunk Driver (Felony) 806-Juvenile Beyond Parental Control 57-Firearms Discharged 23102-Drunk Driver (Misdemeanor) 807-Missing Juvenile 60-Check Parking Meter 23103-Reckless Driver 809-Missing Person 62-Meet the Citizen 23109-Speed Contest 811-lntoxicated Person 65-Missing Person 23110-Throwing at Vehicle 819-Reolling of Intoxicated Person 66-Suspicious Persons 851-Stolen Vehicle 67-Person Called for Help Penal Code: 852-Auto BoosUStrip 68-Tree/Limb Down 148-Reisting Arrest 853-Recovered Stolen Vehicle 69-Wire Down 152-Drunk Driving 901-Call Station (or other location) 70-Prowler 187-Homicide 902-Return to Station 73-How do You Receive 207-Kidnapping 904-Meet with Officer 74-Check Road Conditions 211-Robbery 904-Fire 75-Check Hole in Road 212-Strongarm Robbery 905-Meet with City Employee 77-Check Barricade 213-Purse Snatch 909-Citizen Requests Interview 78-Check Water Condition 216-Shots Fired 910-Check on Well Being 79-Plugged Sewer 217-Shooting 911-Broken Window 80-Explosion 219-Stabbing 912-Person Dumping Rubbish 81-Broken Water Main 221-Person With Gun 913-Complaint Unknown 82-Leaking Hydrant 222-Person With Knife 914-Person Down 83-Signal Light Out or Malfunction 240-Assault and Battery 916-Suspicious Person in Vehicle 84-Street Light Out 245-Aggravated AssaultlADW 917-Suspicious Person 85-Make Inspection 261-Sexual AssaultlRape 918-Person Screaming for Help 86-Any Traffic 288-Lewd and Lascivious Conduct 980-Radioactive Support 91-Stray Animal; (a)Vicious Animal; 311-lndescent Exposure 5150-lnsane Person (b)Noisy Animal; (c)lnjured Animal; 314-1ndescent Exposure (d)Dead Animal;(e)Animal Bite;(f)Sick 400-Demonstration/Pickets Animal;(g)Pickup Animal; (h)Stray 404-Riot All power corrupts, but ~e nee~ electr~city. I, THUD Volume 1 Issue 1 • Spring 1998 21 CIIL EDIT II a software review by: Solar Prophet ~~~~~~~~~~~~~~~~~~~~~~~~~x A" rig~ a" you phreakeffi, and anyone e~e ~ars interested in generating tones. Cool Edit 96 is a great little software package or the IBM PC that runs under Windows 95 or NT. It's basically a very sophisticated WAY file editor, with some extra perks. There is a shareware version available which does disable the use of a" functions simultaneously. If you haven't registered it, a" functions are available but when you launch the program you will be shown a list of function sets and you are prompted to choose two of them to work with. I found Cool Edit 96 on www.slaughterhouse.com and they gave it a maximum "five skull" rating. I think it really deserves it. Loading files is easy and accepts many formats. The common file name extensions being .VOX, .VOC, .WAV, and .PCM. Cool Edit can also save to these formats as well. Cool Edit has many capabilities. It allows you to load In this picture you can see the main interface screen of Cool Edit 96. WAY files and perform various functions on them. A" Here I have a 3 minute 16bit 44 .1KHz stereo WAY file of a song me WAY file bitrates are supported. It also handles and a friend composed. As you can see from the icon bar there are mono and stereo. You can easily perform cut/pastel tons of functions right at your fingertips (or is it mousetip?) that will trim functions just like you'd do to a picture using allow you to do just about anything you want to the sample. If you want Photoshop. You can even stretch the wavefroms, any more sophistication you might as we" get yourself a futl fledged adjust their amplitude, change the sampling rates, digital studio package, but I find this software sufficient for my needs, add delay, flanging, echo, reverb and even reverse even with the needs of a startup band. I have used Cool Edit as a first capability. You can even add distortion. Great for "step - in preparing to convert my music to mp3 format. --1 turning Bach into Metallica. ~~~~~~~~~~~~~~~~~~~~~~~~~One~~emoreadvanc~functions~~ea~Ry~ do a spectrum analysis on a waveform. This is great for seeing what fundamental and harmonics there are in a waveform. This can easily allow a user to identify the important characteristics of a sound sample and use that data to re-create the sound diqitally using the built in tone generator. The tone generator is the real beauty of this program. It allows you to create tones in various wave shapes. There's the customary sine, cosine, sawtooth, triangle, and square wave patterns as we" as a few more exotic variations on these forms. One can take a fundamental and up to four harmonics. The tones can be swept across the spectrum in a controlled linear fashion or can be made to modulate to a lower rate. It's real easy to create red box tones using this program. 1~~~~~~~~~~~~~~~~~~~~~~~~~ A~ng Here is a zoom into a portion of the WAY file. It's possible to zoom in to utility, awRh~e ~ne genern~r ~ ano~er DTMF tone generator. You won't have painstakingly generate each number and space them by hand. Using the DTMF generator you handy to the point that individual samples show up as dots with an interpolated simply enter the number string to be created and set waveform drawn inbetween. Clicking and draging on a sample allows a few parameters such as tone length, spacing, and you to move it giving you the flexibility to edit bad samples to eliminate pause times. Press a button and voila, perfect DTMF clipping from overdriving the input or to clean up pops and clicks. tones without even trying. If you want to genereate ~~~~~~~~~~~~~~~~~~~~~~~~--IDTMF~nM b~ n~~~e ~a~a~ ~~~ndM used by telephones, there are even boxes to allow you to change the frequncies of each row or column on the keypad. Quite versatile. The program is easy enough that in only 15 minutes I was able to create a small WAY file that had a dial tone, a few coins being dropped, a phone number being dialed and then a 2600Hz tone. Playback via a Sound Blaster or similar card and hooked up to the right recording equipment would lead to endless possibilies. All in all Cool Edit 96 is a very easy program to use. The interface is standard Windows style and very intuitive; very easy to learn . A definate must get for anyone who needs to manipulate WAY files and generate tones . 22 Volume 1 Issue 1 - Spring 1998 THUD Here's a shot of the Tone Generator window. You set the base frequency or fundamental first. If you want harmonics (up to five) you set their amplitude and value with the frequency component settings. In this example I have two components selected, one This is the spectral analysis of the waveform. The image is actually in 3.3 times and the other 4.4 times the fundamental of a visually pleasing color gradient. Time is reperesented on the X axis 100 hertz. That means the generated tone will be a from left to right. Frequency is represented on the Y axis with 0 hertz composite of 330 and 440 hertz. Other parameters on the bottom and 22050 hertz at the top of each section. The top is the allow you to change the modulating rate and left channel. The gradient represents the level of that freqency at that amplitude of the tone. You may also control phasing moment in time. It's kinda like the spectrum analyzer on your stereo or which leads to a pleasing stereo effect. Under equalizer, except that it adds the dimension of time to create a graph of "general " you may select the type of waveform to the selected space. It's also much more accurate . You can change how use. Also note that there are two tabs, one for initial detailed the analysis is and several other factors by changing the setting and one for final settings. This allows to to setting under Options. To change between waveform and spectral view specify the start and end parameters of the tones simply select the function under View in the main window menu bar. you are generating . The computer will linearly ~ ~~~~~~~~~~~~~~~~~~~~~~~~~ l time sweePspan fromspecified fue ~m~in~thefueduration fin~ sett~gs ovffi fueis box. There also a section to program preset patterns, there are fou r that come with the program. This is the DTMF signal generating window. As can be seen I have selected a famous number to call. There are setting to allow you to control the length of each DTMF tone, the spacing inbetween, and the pause time . All standard DTMF numbers can be generated (1234567890*#abcd,). I have selected custom simply to allow you to see the boxes for changing the base frequencies used to generate the tones . This will allow you to generate tones for non- standard DTMF devices, such as security boxes, etc. You may also specify presets of numbers in case you do lots of tone generating. (Listed in MHz) Frequency Channel Frequency Channel Frequency Channel Frequency Channel 35.20 P3-1 43.30 P4-5 931.0875 P9-4 931.5625 P9-23 35.22 P1 43.34 P4-6 931.1125 P9-5 931.5875 P9-24 35.24 P3-3 43.38 P4-7 931.1375 P9-6 931.6125 P9-25 35.30 P3-5 43.42 P4-8 931.1625 P9-7 931.6375 P9-26 35.34 P3-6 43.46 P4-9 931.1875 P9-8 931.6625 P9-27 35.38 P3-7 43.50 P4-10 931.2125 P9-9 931.6875 P9-28 35.42 P3-8 43.54 P4-11 931.2375 P9-10 931.7125 P9-29 35.46 P3-9 43.56 P4-12 931.2625 P9-11 931.7375 P9-30 35.50 P3-10 43.58 P4 931.2875 P9-12 931.7625 P9-31 35.54 P3-11 43.60 P4-14 931.3125 P9-13 931.7875 P9-32 35.56 P3-12 43.62 P4-15 931.3375 P9-14 931.8125 P9-33 35.58 P2 43.66 P4-16 931.3625 P9-15 931.8375 P9-34 35.60 P3-14 152.2 P5 931.3875 P9-16 931.8625 P9-35 35.62 P3-15 152.8 P1-2 931.4125 P9-17 931.8875 P9-36 35.66 P3-16 158.10 P1-3 931.4375 P9-18 931.9125 P9-37 43.20 P4-1 158.70 P6 931.4625 P9-19 931.9375 P9-38 43.22 P3 931.0125 P9-1 931.4875 P9-20 931.9625 P9-39 43.24 P4-3 931.0375 P9-2 931.5125 P9-21 931..9875 P9-40 43.26 P4-4 931.0625 P9-3 931.5375 P9-22 THUD Volume 1 Issue 1 - Spring 1998 23 STOPflING 'OWER METERS Review by: Shiva The Book: Stopping Power Meters is a small booklet written by John J. Williams and El Guapo. Don't let it's small size fool you however. I found the booklet to contain a great deal of information on your typical power meter. I'm sure I'm not the only one who wondered how they work ed and how they could be 'adjusted'. As it turn s out, there's actually a multitude of designs, each working on a variation of the same principle, all known as watthour meters, or more commonly, kilo-watthour mete rs. The booklet starts out by first explaining exactly what the meter does and how it works . "There is nothing magical, sacred or miraculous about watthour meters." Even different manufactures of meters are discu ssed with explanations of their differences . After the theoretical background the booklet goes on to describe what it takes to calibrate a power meter, going on to mention that even with slight miscalibration the meter can cause over or undercharging of the customer. It is also noted the possible outcomes of a customer complaining about an inaccurate meter. There is some discussion about how the power company can track down discrepancies in usage over time , Stopping Power Meters - The newest and how they usually find these to be addition to a huge line up of in the ir favor (what else did you educational hackers material expect?) and how much it could cost available from Consumertronics, a YOU to have the 'problem' fixed. But vete ran in the hacker community. not to worry folks, some example ' - - - - -- - - - -- - -- - - - - ' '-- ---' excuses are provided for your education. Following up adjustments is the inaccuracy department. It's amazing just how inaccurate these things can be! It also appears that they become more unreliable as time goes by. Think about it, how old is the house you live in? I bet it still has it's original power meter from way back then and has NEVER been calibrated to insure accuracy. Of course, these errors are almost always in the favor of the power company. It's almost as if it were by design that the meter fails over time . The booklet doesn't just spout off that the meters are in error, it backs up these claims by explaining the causes of these inaccuracies. Meters , like any other scientific instrument, need constant care in order to provide accurate information. Explained are are several sources or conditions that over time will cause the meter to slowly fail. It's quite detailed in some respects. Now for the good part. The last half of the booklet discusses how to slow down, John Williams narrates the video, seen or even stop a power meter from registering. Now, it should be noted that here holding the meter used for tampering with a power meter is illegal. The demonstration. booklet talks about this for several pages '---- - - -- - - - - - - - - - - ' explaining how the utility suspects and determines if the meter has been messed with. But like anything else in this world , such tampering can be made very difficult to detect. As for the actual methods of tampering, there's a lot more described between the covers than I suspected. These methods are described in detail, even providing actual schematics of the devices used. What more could you ----,----------.....,..--., want? Well, there's a little sections describing some of the terminology used for the parts you'll need. And speaking of parts, there's even a section listing several electronics suppliers that are good places to start looking for the necessary components. Some books are also listed for those wishing to learn more about domestic electrical wiring. The Video: Also available is Stopping Power Meters : The Video . This 20 minute video, narrated by John J. Will iams himself, highlights the most Front of the meter showing braking important basics that are discussed in the magnets. One of the adjustment screws booklet. Covered are the internal mechan isms is being pointed out. 24 Volume 1 Issue 1 • Spring 1998 THUD of meters , how the meter actually measures the power used, and how they are accessed. The video then goes on to demonstrate a power meter in action. The meter is hooked up to a series of high powered light bulbs to provide a load. Shown is the speed at which the meter runs. Hooked up to the test bed is another product available from Consumertronics, the Stopping Power Meters '--- ----' Educational Module. This is a device built along one of the principles described in detail in the booklet. The meter is shown both with the SPMEM on and off so one can readily see the effect of the module on the registration of the meter. It's quite a dramatic effect. Also demonstrated is a method of slowing down the meter through the use of ordinary kitchen mag nets. It is also demonstrated that the same magnets can also speed up the meter and how it is important to use them correctly. The video, combined with the booklet, provide an excellent educational tour on the functionings of utility power meters found in most homes and small business. You will also learn of their shortcomings and methods of fouling their abiiity to register correctly . About Consumertronics: Consumertronics is the company who puts out Stopping Power Meters . They offer "hundreds of books, manuals, software , hardware, and services that primarily relate to computers, electronics, phones , energy, security, medical, and I-----------------~~ financial." The author, John Williams, was even interviewed on the CBS show 60 Closeup of the Stopping Power Meters Minutes. For more information, look for the full page Consumertronics Educational Module (S.P.M .E.M.) advertisement in this magazine. demonstrated in the video. Note: This article appears in our sister publication, Blacklisted! 411 - Volume 5, Issue 1. For more information, contact Blacklisted! 411 at P.O. Box 2506, Cypress, CA 90630. THUD Volume 1 Issue 1 • Spring 1998 25 rr" r" r"" '("""r" -f!"" "r""1"1"1"1"1"1"-(" " " " " " " " r"': '. "1"1" £'" ", 1'"",1'" r",. r""r"'; r"" r"('"r" 1"'-1'" 1'" Pyrotechnic 1'" ('" ChulTlicals (" [" [" (" r' r' (" t" (" (" (" (" (" (" (" (" (" (" r r' (" [" r' (" (" r' (" (" r' Within this booklet you will find descriptions of almost 150 of saft explosives. chemicals that are used in fireworks, explosives, rocket fuels or are explosive in themselves. This list is not complete and is Ammonium Perchlorate not intended to be complete. All of the uses are not given and This chemical can be made to explode by either heat or only the related purposes of each are stated. shock. Besides exploding in itself, it is used to manufacture other explosives. Whenever possible we explain which grades are thought to be best, the chemical formula, melting temperature, Ammonium Permanganate decomposition temperature, form (liquid, powder, crystal, A moderate explosive which can be detonated by either heat etc.), if it will explode, if it is poisonous and its usage. Some of or shock. these chemicals cannot be purchased and are offered as a guide for information purposes only. Ammonium Picrate These bright orange crystals are used in armor piercing shells Chemicals have a certain purpose to perform in fireworks and and fireworks. If heated to 300 degrees it will explode or it can can be classified into four groups. be set off by shock. If you do any work with this chemical, it is advisable to keep it wet. GROUP I These chemicals are the chemicals which produce the Aniline Dyes oxygen and are called oxidizers. These are used in smoke powder formulas. They are organic coal tar derivatives. Available in many different colors. GROUP II Those which combine with the oxidizers are called reducers. Aniline Green Also known as Malachite Green. One of the many aniline GROUP III dyes. The green crystals are used in smoke formulas. These are the chemicals which regulate the rate of burning and help to produce the desired effect. Anthracene A coal tar derivative used as a source of dyestuff and for GROUP IV colored smokes. Available as colorless crystals which melt at This group of chemicals are those which impart color to the 217 degrees. flame. Antimony We believe that the information contained here-in is true and Another name for this metal element is Antimony Regulus. correct, however it is offered only as a guide and not to be Purchase the black powder in a 99% purity. Not the yellow used as a guarantee. We cannot assume responsibility nor variety. It is used in pyrotechnics . liability for the use or misuse of the information contained here-in. Antimony Fulminate One of a group of unstable, explosive compounds related to PLEASE NOTE: ALL REFERENCES TO TEMPERATURE Mercury Fulminate. ARE IN DEGREES FAHRENHEIT . Antimony Potassium Tartrate Aluminum Also known under the name of tartar Emetic. These An element used for brilliancy in the fine powder form. It can poisonous, transparent, odorless crystals (or white powder) be purchased as a fine silvery or gray powder. All grades from are used to make Antimony Fulminate. The moisture that is technical to superpure (99.9%) can be used. The danger is present can be driven off by heating to 100 degrees. Do not from inhaling the dust and explosive room condition if too exceed this temperature or the chemical will decompose. much dust goes into the air. Antimony Sulfide Aluminum Chloride This has a usefulness in sharpening the report of firecrackers, This chemical must not come in contact with the skin, as salutes, etc. or to add color to a fire. The technical, black severe burns can result. The yellowish-white crystals or powder is suitable. Avoid contact with the skin, dermatitis or powder have a strong attraction for water. Purchase only in worse will be the result. the anhydrous grade. Aqua Regia Amber A strong acid containing 1 part concentrated Nitric Acid and 3 This is a fossil resin of vegetable origin and is yellowish-brown parts concentrated Hydrochloric Acid. Store in a well closed in color. It is used in fireworks to a small extent. glass bottle in a dark place. This acid will attack all metals, including gold and platinum. It is used in making some Ammonium Bichromate & Dichromate explosives. A mild poison used in the manufacture of tabletop volcanoes (sometimes called Vesuvius Fire). It is available as orange Arsenic Sulfide, Red crystals in a technical grade. Also used in smoke formulas . The common name is Realgar and it is also known as Red Arsenic. Purchase the technical grade, which is available as a Ammonium Chloride poisonous orange-red powder. It is used in fireworks to impart The common name is Sal Ammoniac. Comes as colorless color to the flame. crystals or a white powder. The technical grade is used to manufacture safety explosives and smokes. Arsenic Sulfide, Yellow This chemical is just as poisonous as its red brother and is Ammonium Oxalate also used in fireworks, somewhat. The common name is This compound takes the form of colorless , poisonous, Kings Gold. crystals. The technical grade is suitable for the manufacture 26 Volume 1 Issue 1 - Spring 1998 THUD Arsenious Oxide Chrysoidine A white, highly poisonous powder used in fireworks . It is also An organic dye available as a red-brown powder. It is used in known as Arsenious Trioxide, Arsenic Oxide and Arsenous smoke formulas. Acid. Its uses are very similar to Paris Green. Clay Asphaltum This can be purchased in the powdered form. It is used dry for A black bituminous substance , best described as powdered chokes , nozzles and sealing firework cases . You can mix it tar. with water to form a paste if so desired . Auramine Hydrochloride Confectioners Sugar Also known as Auramine. It is used in smoke formulas. Commonly called Powdered Sugar, it can be purchased as Available as yellow flakes or powder, which readily dissolve in your local food store. The fineness is graded by the symbol alcohol. XXXX. It is used in explosives. Auramine Copper A certified Biological stain used in smoke cartridges. As any pure metal used in fireworks, this must also be in a powdered state. It is reddish in color, in fact, it is the only Barium Carbonate element to be found in nature having that color . This is a poisonous salt of Barium, which decomposes at a fairly high temperature, 1300 degrees . It is available as a fine Copper Acetoarsenite white powder in the technical grade. It is used in fireworks as The popular name for this is Paris Green. It is also called a color imparter. Kings Green or Vienna Green . It is readily available as an insecticide or as a technical grade, poisonous, emerald green Barium Chlorate powder. It is used in fireworks to add color . Available as white powder. It is poisonous , as are all Barium salts . It is used in fireworks , both as an oxidizer and color Copper Arsenite imparter. It is as powerful as Potassium Chlorate and should A fine, light green, poisonous powder. It is used in the be handled with the same care. Melting point is 414 degrees. technical grade for fireworks . Barium Nitrate Copper Carbonate The uses and precautions are the same as above with a Also known as Cupric Carbonate or Artificial Malachite. It is a comparison equal to Potassium Nitrate instead of the green powder used in fireworks. Chlorate. It melts at 500 degrees. Copper Chlorate Bismuth Fulminate Or, technically Cupric Chlorate. A poison used in fireworks as One of a group of unstable, explosive compounds derived an oxidizer and to add color. from Fulmin ic Acid . Copper Chloride Brass An oxidizer and color imparter used in fireworks . Purchase This is an alloy of Copper and Zinc. Some also contain a the brownish-yellow technical grade. This is a poisonous small percentage of Tin. The commercial grade is suitable in compound. a powdered form . It is used in some firework formulas. Copper Nitrate Calcium Carbide Or Cupric Nitrate, Cupric and Cuprous are many times These grayish, irregular lumps are normally packed in interchangeable with the word Copper. These blue crystals waterproof and airtight metal containers . It is used in toy absorb water, as you can see from the formula . It is used in cannons . Mixed with water it forms Acetylene Gas . fireworks . (EXPLOSIVE) Copper Oxide Calcium Carbonate When ordering be sure to specify the black powder . It is also This occurs as the mineral Calcite . It is used for Phosphorus available in Red. The technical grade will serve the purpose Torpedoes, but does not have any dangerous properties in for fireworks . itself. Also as an acid absorber in fireworks. Copper Oxychloride Calcium Fluoride A green powder used to impart oxygen and color especially to This finds its use in a smokeless firework mixture and is not blue star formulas. It is a poison and the dust should not be used elsewhere. It is a white powder, also known as inhaled. Fluorspar. Copper Sulfate Calcium Phosphide Known as Blue Vitroil, this poisonous compound is available This compound , which comes as gray lumps, must be kept as blue crystals or blue powder. It can be purchased in some dry. Upon contact with water it will form the flammable gas, drugstores. Used in fireworks for blue stars. Phosphine. It is used in signal fires . Copper Sulfide Camphor As are the other Copper salts, this is also used in fireworks to A ketone found in the wood of the Camphor tree, native to add color. The technical grade is suitable and is black in color. Formosa and a few of our States. For the best results, buy the You can make your own, by passing Hydrogen Sulfide into a granulated , technical grade. Used in explosives and Copper salt. fireworks. Decaborane Castor Oil This chemical is classed as a flammable solid and is used for The common drug store variety is used in some powders to rocket fuels . It will remain stable indefinitely at room reduce the sensitiveness and to waterproof the mixture. temperature. Charcoal Dextrin A form of the element, Carbon, it is used in fireworks and This can be purchased as a white or yellow powder. It is a explosives as a reducing agent. It can be purchased as a dust good cheap glue for binding cases and stars in fireworks . on up to a coarse powder . The softwood variety is best and it should be black, not brown. THUD Volume 1 Issue 1 - Spring 1998 27 Diazoacetic Ester Glycerol A very severe explosive in the form of a yellow oil. It will Commonly known as Glycer in. It is obtained from oils and fats explode on contact with Sulfuric Acid or when heated . Very as a by-product when making soaps. It is a sweet warm volatile and explosive. tasting syrupy liquid which is used in several explosives. Contact with Chromium Trionide or Potassium Permanganate Diazoaminobenzene may cause an explosion. These golden yellow crystals will explode when heated to 150 degrees. Gold Explosive A dark brown powder which explodes when heated or rubbed. P-Diazobenzeneslfonic Acid Upon exploding, it yields Gold, Nitrogen and Ammonia. The Another severe explosive. It can be exploded by rubbing the exact composition is unknown because it is too explosive to white paste or powder, or by heating. be dried. Diazodimitrophenol Guanidine Nitrate An organic explosive in the same group as the above Guanidine is found in turnip juice, rice hulls and earthworms . compound . Also very sensitive to shock or heat. It is used in the preparation of this chemical. Or, it can be made from Ammonium Nitrate and Dicyanodiamide. To be of Diazomethane any value, it should be 95% pure. Guanidine Nitrate is not Also known as Azimethylene. This yellow gas is also in the explosive itself, but is used in the manufacture of explosives. same group as above and can be exploded by heat or shock . It is a white powder which melts at 210 degrees . Dinitrotoluene Gum Arabic Known as DNT for short. These yellow crystals are used in A dried, gummy , exudate from tropical trees . It is available as the manufacture of other explosives. flakes, fragments and powder. It is used as a binder in firework formulas . Ethyl Alcohol This alcohol is the only one that is useful for fireworks . It Hexachloroethane should be about 95% pure. It is poisonous because of the Also known as Carbon Hexachloride , this chemica l is used in impurities. It is clear, like wate r and also a very flammable smoke formulas . It can be obtained in either powder or liquid. crysta ls. Fluorine Perchlorate Indigo A very sensitive colorless gas which will explode on the A dark blue crystalline powder which is a commercial dye. slightest contact with a rough surface. It can also be You can purchase either the technical or pure grade for detonated by heating to 168 degrees. Avoid all contact with smokes . this gas , even a trace of it will attack the lungs. Iodine Gallic Acid Heavy grayish metallic looking crystals or flakes . Poisonous. A white or pale fawn colored powder used in fireworks to Purchase the U.S.P. grade . It is being used in making make whistles. When mixed with some Chlorates, explosives . Permanganates or Silver salts, it may explode. We've got both 6.500Mhz and 6.5536Mhz crystals. We know you may want one or the other Opens up all Nintendo game units and cartridges! depending on yo ur part ic ul ar project. 3.8mm typically fits the cartridges. 4.5mm typically fits the game units . $4 each including shipping. We sell just about any screwdriver bit you're looking fo r. We have the hard to find bi ts like security Torx (also known as tamper Torx), Scrulox (security Scrulox), Spanner, Internal and External Line Head (like the Nintendo bits above), Tri-wing, Security Hex, Spline and Pozi Drive. Most bits are $12-$15 each . Our best selling 30 piece screwdriver bit set is now available lor ~40 including shipping to anpthere in the U.S. The setincludes 9 security Torx bits hom 1T7 through TT40, 1 security Hex bits hom 5164" through 1/4", 4 security Scrulox bits from S-o through S-3,8 standard pieces, covered ~astic case wI a nice handle lor all of the bits. This is an extremely handy toolsetl 6.50Mhz Crystals EPROM Programming Unusal web site listing Tool bits(includingsecurity) 6.5536Mhz Crystals Auction Booklet T-shirts other interesting stuff.... rtJ FIIID OUT MORE ABOUT AllY S1IECIFIC nlODUCT WE IM~ PLEASE CHECK OUT 01/1 ADS III THE ClASSIFIED SECTION OFTHIS MAGAZINE. TCE Information Systems P.O. Box 5142 Los Alamitos, CA 90720 28 Volume 1 Issue 1 - Spring 1998 THUD Iron Mercuric Oxcyanide The granular powder (at least 99% pure) is needed for several In the pure state it is a violent poison which will explode when firework pieces. It is not a dangerous element, but will rust touched by flame or friction. very easily , making it useless. Mercuric Thiocyanate Iron Oxide A poisonous, white odorless powder used in the making of These black crystals are used in thermite mixtures. When Pharoah's Serpents. Use the technical grade . ordering, it may be listed as Ferrous Oxide. Black . Mercurous Chloride Kieselguhr Also known as Calomel or Mercury Monochloride. This white, This is a whitish powder used in dynamites. It is a siliceous non-poisonous powder will brighten an otherwise dull colored earth, consisting mainly of diatoms. A good grade will absorb mixture. Sometimes it is replaced by PVC or about four times its own weight. Hexachlorobenzene and even Antimony Sulfide, for the same purpose . Note that it is non-poisonous only when it is 100% Lactose PUR E. Never confuse this chemical with Mercuric Chloride, Also called milk sugar . This white powder has a sweet taste. which is poisonous in any form . The crude grade will do for smoke formulas. Mercury Fulminate Lampblack A crystalline compound used in primers, percussion caps , This is another form of the element, carbon. It is a finely blasting caps and other detonators. Explodes very easily from powdered black dust, resulting from the burning of crude oils . heat or shock . It is used for special effects in fireworks . Methylene Blue Lead Azide This dark green powder is used for smokes in the technical This is a poisonous white powder which explodes by heating grade. Also called Methylth ionine Chloride. to 350 degrees or by concussion. The main usage is in primers . It can be made from Sodium Azide and Lead Nitrate. Mineral Jelly Also known as Vaseline, Petrolatum or Petroleum-Jelly. This Lead Bromate acts as a stabili- zer in fireworks and explosives . Poisonous, colorless crystals . Pure Lead Bromate is not explosive unless it is made from precipitated Lead Acetate Naphthalene with an alkali bromate . Made in this manner, it can be This is a tar product that you may know better as Moth Flakes. exploded by rubbing or striking . Only the 100% PURE form should be used in making smoke powders . The melt ing point is 100 degrees . Lead Chloride It is available as a wh ite crystalline, poisonous powder which Nitric Acid melts at 501 degrees. It is used in fireworks . Also known as Aqua Fortis. It is a clear, colorless, corrosive liquid, which fumes in moist air. It can react violently with Lead Dioxide organic matter such as: Charcoal, Alcohol or Turpentine and Also known as Brown Lead Oxide, this dark brown powder is consequently must be handled very carefully. It is available in used as an oxidizor in matches and fireworks . Poisonous . three forms : White Fuming , Red Fuming and Concentrated (70 to 71%). The latter, with a specific gravity of 1.42, is the Lead Nitrate proper grade to buy. Whatever grade, avoid contact with the Available as white or colorless crystals is the technical grade . fumes or the liquid . Contact with the skin will cause it to burn The uses include matches and explos ives. Poisonous . and turn yellow . It is used to manufacture many explosives . Lead Oxide Nitroglycerin Also known as Red Lead or Lead Totraoxide . A 95% purity is A liquid with a sweet burning taste but do not taste it or it will desired for matches . Also poisonous . produce a violent headache or acute poisoning. It can be made to explode by rapid heating of percussion. It is used as Linseed Oil an explosive and also to make other explosives . Available in many forms: Brown , boiled, raw and refined. All are made from the seed of the flax plant. The cheapest form Nitroguanidine is suitable for fireworks. Purchase from a paint store . A yellow solid make by dissolving Fuanidine in concentrated Sulfuric Acid and then diluting with water. Dangerous Lithium Chloride Explosive. The technical grade is sometimes used to add color to fireworks compositions. Available as a white powder. Nitromethane An oily, poisonous liquid, which is used as rocket fuel. Manganese Dioxide Used in pyrotechnic mixtures, matches and match box friction Oil of Spike surfaces. Available as a technical grade, black powder. This This is a volatile oil obtained from the leaves of certain trees. oxidizer decomposes at 535 degrees . Keep this colorless (or pale yellow) liquid well closed and away from light. It is used in some fireworks. • Magnesium This metal is used in a powdered state for brilliancy in flares Paraffin and will even burn vigorously underwater. This is a white or transparent wax. It is normally sold in a solid block. You can use a file to make the required powder. Mercuric Chloride A white, poisonous powder. Also known as Corrosive Paranitroaniline Red Sublimate. It can be made by subliming Mercuric Sulfate with A dye used in smoke formulas. It dissolves in alcohol and will ordinary table salt and then purified by recrystallization. The melt at 139 degrees. It is also known as p-Aminophenyl. U.S.P. grade is used for some firework compositions. Mercuric Oxide Pentaerythrityl Tetranitrate Available in two forms- red and yellow. Both forms give the A high explosive known at PRTN. Besides being an explosive same oxidizing effects in fireworks. The technical grade is itself it is used in a detonating fuse called Irimacord. suitable. All forms are Poisonous. THUD Volume 1 Issue 1 - Spring 1998 29 Perchloryl Fluoride Potassium Ferrocyanide A gas under normal air pressure. When brought in contact Lemon yellow crystals or powder which will decompose at with alcohol, explosions have resulted. high temperatures . It is used in the manufacture of explosives. Phosphorus This element comes in three forms, with three different ways Potassium Nitrate of reacting . They resemble each other in name only . Red Commonly called Saltpeter; this chemical is an oxidizer which Phosphorus is the only suitable form for fireworks and decomposes at 400 degrees . It is well known as a component matches . It is a non- poisonous violet-red powder. It will ignite of gunpowder and is also used in other firework pieces. at 260 degrees. When making a formula containing Available as a white powder. Phosphorus, be sure to work with it in a wet state. This is a most dangerous chemical to work with and should be handled Potassium Perchlorate by the most experienced . Oxidizers have been known to Much more stable than its Chlorate brother, this chemical is a detonate violently without warning when mixed with Red white or slightly pink powder . It can often substitute for Phosphorus. Potassium Chlorate to make the formula safer. It will not yield its oxygen as easily, but to make up for this, it gives off more Phosphorus Pentasulfide oxygen . It is also poisonous . Also known as Phosphoric Sulfide. These light yellow crystals are used in matches . Potassium Picrate A salt of Picric Acid, this chemical comes in yellow, reddish or Phosphorus Trisulfide greenish crystals. It will explode when struck or heated. It is This chemical can catch fire from the moisture that is present used in fireworks. in air, therefore the container should be kept tightly capped . The technical grade, purchased as grayish-yellow masses, is Potassium Thiocyanate used in making matches. Colorless or white crystals which are used to make the Pharaoh's Serpent. The commercial grade or pure grade is Picric Acid suitable. This is used to bring out and improve the tone of colors in various fireworks. It is also used to make other chemicals that n-Propyl Nitrite are used in fireworks and explosives. Picric Acid can explode Prepared from Silver Nitrate and n-Propyl Bromide and is from heat or shock. It is interesting to note what it is called in used as a jet propellant. other countries. Britain : Lyddite; France: Melinite ; Japan: Shimo- Red Gum se. Rosin similar to Shellac and can often replace it in many fireworks formulas. Red Gum is obtained from the barks of Plaster of Paris trees. This is a white powder, composed mostly of Calcium Sulfate. It is used, by mixing with water , for end plugs in fireworks and Rhodamine B also in some of the formulas. A basic red fluo rescent or ganic pigment also known as Rhodamine Red. Available in green or red crystals or powder. Potassium It is used in smoke formulas. A soft silvery metal element. It will react vigorously with water and several acids . It is not used directly except for some Shellac experiments. An organic rosin made from the secretion of insects which live in India. The exact effect it produces in fireworks is not Potassium Chlorate obtainable from other gums. The common mixture os Shellac This, perhaps, is the most widely used chemical in fireworks . and Alcohol sold in hardware stores should be avoided . Before it was known, mixtures were never spectacular in Purchase the powdered variety, which is orange in color. performance. It opened the door to what fireworks are today. It is a poisonous, white powder that is used as an oxidizer . Silver Fulminate Never ram a mixture containing Potassium Chlorate . Do not A crystalline salt simila r to Mercury Fulm inate but more store mixtures which contain this chemical for any great sensitive. In fact, too sensitive for commercial blasting. It is length of time, as they may explode spontaneously. used for toy torpedoes and poppers . Silver Oxide Potassium Dichromate Dark brown, odorless powder . It is potentially explosive and Also known as Potassium Bichromate . The commercial grade becomes increasingly more so with time. Keep away from is used in fireworks and matches . The bright orange crystals Ammonia and combustible solvents . The technical grade , are poisonous . Also used in smokes. which is about 92% Silver, is suitable. 30 Volume 1 Issue 1 - Spring 1998 THUD Sodium Aluminum Floride Strontium Chloride Also known as the mineral, Cryolite . It is used in fireworks in A colorless or white granulated chemical used in the white powdered form. pyrotechnics. It will absorb water and is not used often. Sodium Bicarbonate Strontium Nitrate When a formula calls for this chemical, you can use Baking By far the most common chemica l used to produce red in Soda (NOT Baking Powder). It is a white, non poisonous flares , stars and fires. Available in the technical powder powder . grade. An oxidizer with 45% oxygen and absorbs H20. Sodium Carbonate Strontium Sulfate This white powder is used in fireworks, but not to any great This does not absorb water as quick as nitrate and is used extent. The anhydrous grade is best. when storage is necessary. In its natural state it is known as Celestine, which compares to grades used in fireworks. Sodium Chlorate An oxidizer similar to Potassium Chlorate, although not as Sulfur powerful and also with the disadvantage of absorbing water. For an example type II burns as 250 degrees giving off Decomposes at 325 deqrees. chok ing fumes. Purchase good pyro grades low in acid. Used in many types of fireworks and explosives. Sodium Chloride This is used in fireworks . You can use the common form, Sulfuric Acid table salt (or rock salt if made into a powder) . Also called oil of Vitriol, it is a clear liquid with the consistency of thin syrup. Bottles should be kept tightly closed as it is a Sodium Nitrate very corrosive and dangerous chemical. It has a great affinity Also known as Chile Saltpeter; very similar to Saltpeter for water and will absorb it from any source. The effect can be (Potassium Nitrate). a charred surface or fire . The grade used in explosives is It is used where large amounts of powder are needed in 93-98% . fireworks and explosives. It will absorb water as do other sodium salts. Sulfur Trioxide This powder will combine with water with explosive violence Sodium Oxalate to form Sulfuric Acid. If brought in contact with wood flour and This is not a strong poison but is poisonous, and you should a drop of water is added, a fire willstart . It is used to make not come in contact with it or breathe the dust for any some explosives. prolonged period. The technical grade is best for making yellow fires. Trinitrotoluene Commonly known as TNT . The poisonous crystals are colorless in the pure state . It is more powerful and expensive Sodium Perchlorate than Dynamite. If not confined it will burn like dynamite. Used This chemical is used in fireworks and explosives . It is very as a high explosive and to make others . similar to Potassium Perchlorate with the exception that it will absorb water. Wood Flour This is merely another name for Sawdust or Wood Meal. It is Sodium Peroxide used in fireworks and explosives. A yellowish-white powder. It can explode or ignite in contact with organic substances . Zinc Of all the forms, only the dust is suitab le in the technical or Sodium Picrate high purity grade. It is a gray powder used in star mixtures Very similar to Potassium Picrate and should be handled with and for fuel in model rockets . the same precautions . It is also known under the name of Sodium Trinitrophenolate . Zinc Borate A white amorphous powder used in making smoke formulas . Sodium Silicate A relatively safe compound to handle. This chemical, commonly called water glass, is used as a fireproof glue. It is available in syrupy solution and can be Zinc Carbonate thinned with water if necessary. When dry it resembles glass, Another white Zinc compound used in some smoke formulas. hence the name. It can when desired be thickened with Also a safe compound to handle. calcium carbonate, zinc oxide, powdered silica , or fibre glass (chopped) if extra strength is desired. Zinc Oxide Sometimes called Flowe rs of Zinc . This is a white or yellowish Stearin powder used in some fireworks formulas . It has also found Colorless, odorless, tasteless , soapy crystal or powder. use as a thickening agent in water glass when a stronger pyro Sometimes referred to as Stearic Acid , purchase the technical paste is desired. grade, powder. It can often take the place of Sulfur and Charcoal in fireworks . 11I11111111111111r1 Strontium Carbonate Known in the natural state as Strontianite, this chemical is used for adding a red color to fires . It comes as a white powder in a pure, technical or natural state . , 0 FE '''ER lOUR L 'ACKERS PHREA/(ING S/(AMl GLOBAL CONTACTS PIRATE RAJ) 0 HIGHS ET EROTICA ELECTRON/I( CHOONZ SEI(URITY UTUR LIFESTYLES P.o. Box 1905, Boulder, CO 80306-1905 USA THUD Volume 1 Issue 1 - Spring 1998 31 CABLE TEST llIP FA PROVIDED BY TELECODE PRE-INSTALLATION You are about to install a test device in a cable descrambler. There are several things you should be aware of before you open the package containing the chip or board. Once installed, you own the chip or board . Any damage done to the box or test chiplboard is your responsibility. DO NOT install this chip or board in a box not owned by you unless you have permission from the owner of the box. I I' using the box with a test chip installed, it is the responsibility of the user to notify and get written permission fron the cable company supplying programming to the cable box or descrambler. HOW THEY WORK There is no magic involved with these chips or boards. They work by telling the microprocessor that all channels the box is normally capable of receiving are OK to "tum on". This DOES NOT necessarily mean that the chip or board, once installed, will "get all channels. It mayor may not. These are "test" devices, NOT theft devices. There does NOT exist a chip or board to GET all channels for free . Programming MUST enter the box to be seen . Test chips or boards only "enable signals" that are there for testing box. It mayor may not be able to test all channels, depending upon the installation by your cable company of any extra "traps and filters". Please re-read the preceding until you understand this basic point. Once installed, ALL channels that the box is "capable of receiving" are "turned on" enable testing of individual channels of the descrambler. If you intend to view programming on continued basis, you must pay for the programming you watch. BEGIN TESTING After installation, begin testing. All channels that you previously received prior to the installation of the test chip or board should be viewable. If you then tune to a premium channel, such as HBO, which was NOT previously watchable, and it DOES NOT COME IN CLEARLY or AT ALL, the test board or chip is MOST LIKE LY still working properly. The reason that the descrambler is NOT displaying the channel is most likely due to the cable company having installed a "trap" on the cahle line servicing this descrambler. The "trap" has removed the HBO channel from the cable. NO signal = NO picture. The signal for HBO not being there means it cannot be displayed by the descramhler. The descrambler before the test chip was installed could not tune the channel. Now it can, but the channel is "missing" due to the "trap ". This is common in some areas and not in others. It costs money to have an employee of the cable company come out and remove or re-install the trap each time you wish to view a PPY event or add Premium channels. So, the cable companies have mostly gone to addressable descramblers. Each addressable descrambler box has a unique electronic serial number (ESN) that can be "spoken to" by the cable company (CACO), or "head -end" as it is called. Authorization is done electronically by telling a specific ESN, what channels are authorized. IT WORKED FOR A WHILE .. . Installation of test chip or boards may enable all channels, including PPY and other Premium channels, but only for a short time . In these cases, Electronic Countermeasures (ECM) have most likely been sent from the headend to ALL boxes . Only those boxes WITH test chip or boards installed permanently will be affected. Click here for Starcom Diagnostic Codes. ECM signals are typically sent just before and during a PPY event, and at regular or non-regular intervals during other times . The ECM instructions "confuse" the box and it may shut-off some or all of its programming. ECM sometimes "kills" authorized boxes, also . Unplugging the box for 10 minutes and then plugging again may reset the box back to normal until the next ECM hit. If you have an authorized box and the programming disappears without reason, call the cable company and asked that the box be "re-initialized" or sent a "hit". ECM ECM can be "controlled" by installing a filter to trap out the ECM signal, which is usually transmitted as a I 06MHZ carrierwave "on top" of the regular programming. These traps are known collectively as "Bullet Busters". Bullet Busters are specific to the frequency of the transmitted ECM signal, so they usually arc adjustable . Follow the installation instructions for the particular Bullet Buster you are using. WARNING Installation of a test chip or test board does NOT MEAN you can watch channels that you have NOT PAID for. Use of the test chip or board is legally limited to testing descramblers and viewing channels that have been paid for but are otherwise not viewable. One example could be where a second box has been installed, with a test chip, in a house that has paid for cable programming and the cable company is unable to authorize the second box. Another example is where the descrambler, because of some electrical fault, is incapable of displaying channels that have been paid for. Boxes with test chips will display all programming input to it, but you are legally only authorized to view programming you have paid for. If you have any doubt as to whether or not you would be breaking the law in you community, we suggest that you consult an attorney for legal adv!ce before installing or testing any channels. DISCLAIMER The sale(s) of all test chips or boards are made with the understanding that the user of these device(s) will comply with all laws, both State and Federal. If in doubt, consult an attorney prior to use. TROUBLESHOOTING TIPS 1. The most common cause of test device not functioning properly is from poor soldering or a bad connection during installation. Inspect connections before applying power to the unit. Solder connections should be shiny and smooth. If connections are dull and/or rough, it could be a "cold solder joint". 2. The second most common cause of test device not functioning, is that the device is not installed in accordance with the instructions supplied. Some test chips do not align pin 1 of test device with pin I of unit under test (Zenith ZF-I). Follow instructions "...to the letter". Be careful not to bend pins under chip when installing. 3. If installing the test device "piggyback" onto another chip, make sure that the pins of the test device are in contact with that of the "host" chip. Clean pins of host IC and solder on a socket first. Then plug the test chip into the socket. CONTINUED ON PAGE 49 32 Volume 1 Issue 1 - Spring 1998 THUD @@)~0~~~U1lJU1®[K]~@0 2430 JUAN TABO, HE #259, ABQ, NM 87112 1IIII-06l ~ .... P.O. Box 23097, ABQ, NM 87192 IP!'I\I _ Voice: 505-237-2073 (9-6,M-F) Fax: 505-292-4078 (all hours, orders only) www.tsc-global.com Add $5 total S/H (US, Canada) 10% Offorders $100+ CATALOG is$3 w/ order / $1 w/ 0 Postal MO is fastest VISA, MCOK COD,add $7 Sold for educational purRoses only See CATALOG for all Policies How cellphones operate and are modified . Vulnerabilities . . . to hack attack and coun- I Pager Ma~ual VOIC~ 1\lall Hack. I The Hacker ~I1es termeasures. Comprehen- Net Tr acking & Tracing Hack. Answer. Machines sive info 0 reprogrammin~ NAMs Net Cons & Scams ComputerPhreak. ~ons&Scams In. ' Stealth Technolog I Iron Gonads Crypto Techs ESNs, ~tc. (cloning), control ata formats, Polygraph Defeats High Volt. Devices I Secret IDs computIng encoded MINs, ESNs,.SIDHs, op- Mind Cantrall Under Attack! I Rocket's Red Glare er~tIng sys~ems, PROMs and their program- Casino Hacking I S,e , cret & Survival Radio I Ultimate mIng,. forcing f\CK, test mode an.d resets, Success Man.,~~J.lJhL:~n Order of the Magnitude :~adm~~~~~:lC~ll~:~~:s~r:~:~r~~~n;~~~~A· · · · · ··· · · ;:;;: ?iiiill liiiIi B=-:qM~ucl:llhpm.orl'eraq!"~FIJ.q'" e ui ment sources. Much more! 9. ' , ClJ The absolute latest tricks and methods being used on the Net to pirate software and crack passwords. Internet security, ~~ot":4.~ ... How to Avoid Getting ~ Caught, To:p- 20 Hacking Sites, Anony- mous FTP, Defeating Copy Protection, Using Net News rou s. Much, much more! $29. THUD Volume 1 Issue 1 - Spring 1998 33 Pirate Radio Trials And Tribulations In November, three Tampa Bay, Florida residents got rude wake up calls from raiding parties involving SWAT teams, Federal Marshals, local police, customs agents, and a CIA agent. They were all led by agents from the FCC. The raids, conducted against, Arthur Kobres, Kelly Benjamin, and Doug Brewer were a successful attempt to shut down three area unlicensed micro-power FM broadcasters. They've succeeded for the time being. Arthur Kobres, who operates 'Lutz Community Radio' and transmits on 96.7 FM was charged in a l4-count federal indictment for operating a radio without a license. He was eventually released on a $25,000 bond . Kelly Benjamin operates '87X' on 87 .9 FM in Seminole Heights. Known on the air as Kelly Kombat, he was also arrested on state charges of possessing marijuana and other drug paraphernalia. He was later released on a $1,000 bond . Doug Brewer, operating 102.1 FM's 'The Party Pirate' says some of the equipment seized from his home belonged to other groups, such as the Temple Terrace Golf & Country Club and was nothing more than ham radio repeater equipment unrelated to any 'pirate radio' broadcasting equipment. A 150 foot broadcasting tower was also dismantled. Brewer has been in trouble with the FCC before. He refused to pay a $1000 FCC fine and even taunted the FCC on and off the air. A web page even shows FCC agents outside his home measuring his broadcast strength. Ralph Barlow, head of the FCC in Tampa had no comment but a Wall Street Journal article on Brewer quotes Barlow as saying "Sooner or later I'll nail him." Drew Rashbaurn , VP and owner of several legal Tampa area radio stations had filed a complaint with the FCC about 102.1's 'The Party Pirate' about a year before claiming it's proximity to his station 102.5 was confusing listeners. Although Rashbaum doubts this will stop pirate broadcasters he says "to some degree, it makes the airwaves safer to listen to." This rash of raids come son the heals of a California Federal Judge Claudia Wilken's ruling that refused to grant the FCC a permanent injunction to shut down Free Radio Berkeley. The ruling also questioned the FCC's involvement in violating the constitutional rights of citizens. Richard Edmondson, speaking for SF Liberation Radio had strong words to say in regards to the matter. "The raid against Doug brewe and other microbroadcasters in Florida, coming as it has just a week after the Federal Court Ruling in California, is a display of lawless thuggery which demonstrates to me more clearly than ever that the US Government does not care about its own courts, its own laws, or its own Constitution." In response to the raids there have been several organized demonstrations against Federal Buildings and the FCC. In San Marcos protestors showed up to the only Federal building in town, the Post Office. The peaceful protest was decorated with signs saying "Free the Tampa 3", "Micro Radio is not a crime", and "FCC: Obey Judge Wilken". Most citizens who say the protest were friendly and curious. Some were even shocked to learn about the victims civil rights being violated by our government once again. In another protest a lone man showed up to the FCC office in the LA area to hand out flyers protesting the raids. Several security guards tried to force the man to leave but he was well armed saying that he had a right to be on the property because it was a public agency conducting public business. The guards had tried to convince him it was private property. One of the many complaints towards the FCC from microbroadcasters is that they couldn't get licenses when they applied to the FCC. It appears the FCC simply won't grant a license to anyone unless it's a big money mongering corporation. But not to fear, there are already several legal actions in progress which could change all this in the future. Minor Threat's letter to the media DATE: July 9, 1997 FROM: Chris Lamprecht (mthreat@paranoia.com) TO: All interested journalists SUBJ: Lamprecht challenges Internet ban on First Amendment grounds Dear Journalist: On May 5, 1995, I was sentenced to 70 months in federal prison. The judge ordered that upon my release I shall not use the "Internet or any other computer network." I became the first person to be banned from the Internet. Additionally, the judge prohibited me from getting ajob as a computer programmer (my hobby since age 9, and my career throughout high school and college). If! violate these conditions I could be sent back to prison . Although hacking was a "hobby" of mine for several years, I have never had a criminal charge for hacking, and my current crime has nothing to do with computer programming or the Internet. I admit that I have committed undisputed crimes involving theft and sale of telephone equipment (stolen from Southwestern Bell Telephone). And for this I will spend five years in prison as punishment. But banning me from the Internet and from programming computers when I am released from prison is unjust and will not help foster my rehabilitation into society. So on April 22, 1997, I filed a Federal habeas corpus petition challenging my Internet ban on First Amendment (and other) grounds. I claimed that banning me from the Internet is a Free Speech violation in light of recent cases dealing with the Communications Decency Act (CDA), ACLU v. Reno, currently in the Supreme Court. The government has been ordered to respond to my petition by July 11, 1997. If! do not win in the district court, I will appeal to the U.S. Court of Appeals and, if necessary, to the United States Supreme Court. I am writing this letter for this reason: Attorney George Lasko recently contacted me, and will be helping me fight my computer restrictions pro bono . However, we want to publicize what the government is doing with this absurd "Internet ban" restriction as a Free Speech violation. 34 Volume 1 Issue 1 • Spring 1998 THUD While I may be the first person banned from the 'Net, I won't be the last. Recently, I learned through the Freedom of Information Act that the U.S. Department of Justice and the Parole Commission plan to add restrictions to ban parolees from the Internet and to prohibit parolees from using or possessing encryption software (like PGP, or even PKZIP , since it has an option to encrypt) . My story has been covered in magazines such as Texas Monthly (January 1996), Internet Underground (December 1996), SWING (March 1997), and on three television shows: TV.COM (CBS), Extra (ABC), and the KVUE-24 local Austin news. But the media attention so far hasn't been focused on the legal implications of an Internet ban on one's right to Free Speech on any medium, including the Internet. If you are interested in helping , or want more information, please visit www.paranoia.conv--mthreat/ on the Web. To contact me in prison , mail me at this address: Christopher Lamprecht #61153-080, Houston Unit, PO Box 1010, Bastrop, TX 78602-1010 Thank you for taking the time to read this. Real Time Face Recognition Software Facelt DB is a new program from Visionics that allows real time scanning of video images of peoples faces that can be compared to a large data base giving a match within minutes. The software can search live video images or static images, even scanning multitudes of faces in a single frame for matches. Facelt uses Local Feature Analysis (LF A) that breaks up a face into local features making it possible to map an individuals face into a computer database . The program compares the target picture with those stored in its database and presents to the operator a a list of the top matches . The operator can then quickly scan for themselves the possible matches in order to confirm the actual identity. The software can work even when the head is turned up to 35 degrees , can compensate for lighting, skin color, glasses, facial hair, facial expressions, and even compensate for natural aging. The software runs on a standard PC in either 95 or NT environments and can use standard file formats such as JPEG or TIFF . Once an image is scanned the program can store enough information for over a million images on a typical multi -gigabyte hard drive. Uses for the software are wide ranging. Several examples given are the uses of identifying of terrorists in airports , snagging of shoplifters in stores, and searching for missing or exploited children by scanning the multitudes of pictures on the Internet. This author fears the use of such programs, not that I have fear of being caught for any crime. It could readily be used to keep track of a persons where-abouts. Already in my city , and in hundreds of cities nationwide, cameras are being installed in public locations for uses unknown. There are many intersections in my area that have cameras on each of the four signal poles. That's four cameras in one intersection!' Face recognition software linked to such cameras could be used for tracking a person without their knowledge. Even if laws become enacted to prevent such tracking without a warrant , since when has that stopped anybody? There's even places where people already know about and accept cameras for 'security' reasons which could easily be used. Maybe it's time to start learning how to put on makeup and use disguises? New Jersey Resident Charged With Multiple Cable Violations Andrew Anthony Christopher of Newark , New Jersey has been Indicted on 18 charg es relating to the use and distribution of devices for cable TV theft . Some of the charges relate to using mail fraud, conspiracy, and alleged false statements to the Social Security Administration for the false collection of benefits. Oth er charges relate to unlawfully receiving cable service, possession of devices for such theft, and distribution and sale of such devices. Court documents also state that Christopher unlawfully possessed and distributed modified tone dialers for the use of simulating the tones pay phones use to recognize money being deposited (AX.A. Red Box). U.S. Attorney Faith Hochberg said that Christopher sold turned on cable boxes and descramblers "knowing they were to be used to descramble encrypted cable television programming without the authorization of the cable television provider and without the payment of the required fee." The Indictment includes one count of conspiracy, seven counts of mail fraud, five counts of assisting in the unlawful reception of cable service, one count of possessing illegal telecommunications equipment, and four counts of making false statements to a government agency. Each count comes with a maximum of $250,000 fine and five years in prison except for the count on the telecom equipment, which is ten years. These indictments were made by a Grand Jury, a group of 16 to 23 citizens who use a vote of at least 12 jurors to find probable cause that a crime has been committed. Defendants nor their jurors are allowed to be present during grand jury hearings. New Remotely Scannable Cards SCS Corporation along with Hitachi Maxel Ltd. have announced their development of of SCS's Interactive Identification System labels into an ultra thin contactless card . The cards , only .25mm thick are read by radio frequency scanners to obtain the information stored on them. The cards can also be printed on using ordinary printers and copiers. No more sliding hard plastic cards through terminal slots . The cards can store 1024 bits of information which is about 5 times as much as existing cards. Projected uses for such cards or strips are for airline tickets, payphones, libraries , pharmaceuticals, mass transit, and anyplace else where existing ID cards are in use. The cards do not use batteries and are readlwriteable, meaning they should last forever. New scanning systems for use with the cards will be capable of scanning multiple cards simultaneously. This could be useful in such places as subway terminals where users can just walk through a specified area without even removing their debit card from their wallets, or having to walk single file in a line. The strips can also be placed on packages for tracking of inventories, dating of perishable items, or for retail anti-theft applications. I would also imagine they could be used or hidden in such items as money . Since they can be accessed remotely a person can be scanned for the presence of such cards or strips and immediately all information on them can be accessed. This could even be done without the carriers knowledge. Just another way Big Brother could keep an eye on us all. THUD Volume 1 Issue 1 • Spring 1998 35 This section will be for "letters to the editor" in future issues. Since we don't yet have any letters from our readers, we're going to list some standard questions that we've seen in the past and answer them. This will be a kind of hackers FAQ to start the ball rolling with the letters section. Please address all letters to: THUD Letters P.O. Box 2521 Cypress, CA 90630 Q: What is a Red Box and how can I make one? (we have seen Q: I'm familiar with some of the more common boxes, such as this question millions of times.) Red, Blue, and Gold. I know there's more out there. What are they? A Red Box, also known as a quarter box. is a little gizmo that simulates the tones made by a pay phone when coins are inserted. A: Well. the most common are Beige. Blue, Chrome. Gold. Green, Since there are three coins used by phones there are three different Infinity. Red, Silver, and White. signals that can be made. The basic tone is 1700Hz and 2200Hz combined. It's the pulse length. number of pulses and the spacing A Beige box is really nothing more than a poor man's version of a between them that counts. For a nickel it is one 60 millisecond pulse linemans test set. To make a simple one all you do is take a regular (06 seconds). A dime is two 60ms pulses separated by 60ms of phone . preferably a baseless type. By baseless I mean the kind silence . A quarter is a little different; it is five 33ms pulses with where the whole phone is contained in the handset. Kinda like a 33ms silent spaces in-between each. cordless, but the phone line hooks directly to the handset. All you do is take a phone cord. cut one end off and put alligator clips (or There are several ways to make a red box. roach clips. if you prefer) on the inside pair of wires. Then all you do is clip your phone to someone else's line and you can make calls. Radio Shack tone dialer mod: Best access point is the telephone access box. or .l-box on the back ofthe house or apartment . Radio Shack has a handy little tone dialer. There's been several part numb ers available. Part no. 43-141 which was stopped being A blue is a type of tone generator. Mainly , it generates the 2600Hz made in 1994 is the older model with 33 pres ets. The current model tone that's used to take contro l of a trunk line. The other tones are is 43-146 There are two different versions with this same catalog used to access the "operator touch tones" or operator functions that number . One is supposed to be 'hacker-proof in that the crystal is control what operation of the trunk. In essence. you become an disguised (some say it looks like a capacitor) and is the newest operator. These don't work anymore cuz the phone company got model and is the one you are likely to get if you go out and buy one wise to it a long time ago. today . IT CAN STILL BE MODIFIED!!! The tone dialer is basically a DTMF encoder that can store and playback the tones needed to A chrome box is pr etty much nothing more than a portab le strobe dial a number . The modificati on changes the crystal inside on of light. When set to the correct flash rate it is used to trigger traffic these to a differ ent fr equency so that the * key is close enoug h to the lights to turn green, just like the strobes on fir e engines and poli ce tones required. Then all one needs to do is program a pr eset to playcars. Of late. a new system has been starting to come into use. back 5 *'s and voila! a quart er. All y ou do is change the Infrared triggers are starting to be used. The advantage is that 3. 579545MHz crystal inside the tone dialer to either 6. 5536MHz or strobe lights won't work anymore . but they 'll ju st say it's to keep just plain 6.5MH z. The 6.5 is preferred as it is closer to the epileptics from having seizures. There's a way around that one too. frequencies needed. but the 6.5536 crystal is easier to obtain and All you do is stand on a street corner near a fire station with one of will still work. See the Hack Exchange section (classified ads) in those universal remote controls. Wait for them to come your way this issue for sellers ofthe necessary crystals. and point the remote in their direction and program the remot e. Then whatever remote button you programmed will have the code Hallmark greeting card/digital memo recorders: pattern for the IR traffic trigger . Now all you do is point your remote at the traffic light and press you r button to get a green light. You ever get one ofthose greeting cards that allows y ou to record a You may have to make a modification to your transmitter by adding personal message for the person you're giving it to ? That is extra infrared LED's to have enough power to work. especially in basically a simple form of a digital sound recorder. There's also daylight . those pocket digital memo recorders . Basically all y ou do is if you have something that can generate the necessary tones. you use one A gold box. also known as a call diverter, is a little device that is of these devices to record them. Then. when needed . y ou just whip attached to two phone lines. When you place a call on One phon e out your memo recorder or greeting card and playba ck the tones line, the Gold Box picks it up and automatically connects you to the into the mouthpiece of the pay phone. You may find it more other phone line giving yo u a dial tone. Then you dial your number convenient to remove the guts from the card. It'd look kinda funny and it's as if you are actually making the callfrom the second phon e seeing someon e holding a greet ing card up to a pay phone . line. These are also sometimes called Dark. or Diverter Boxes. Tape recorder /walkman : A green box is similar to the Red. Silver. or White Boxes to generate tones except the tones it generates are those to make Coin Collect. This is just a variation on the above digital recording trick. Do the Coin Return. and Ringback tones. Coin Return is just that. it gives same thing as above except that you are using a tape recorder you your money back. Coin Collect tells the phone to take the instead. money that you entered and put it in it's box; can't get it back from there. Ringback tells the phon e system to make the payphone ring Ways ofgenerating tones : once you hang up. These used to work in the 80's but don't anymore . Once again. there's actually a smart person at the phone company . If you don't have a modified tone dialer or some other little electronic device already set up to make the tones for you. you can An Infinity Box is a neato little device that can allow you to spy on use your computer. Just use a WAV file editor that allows you to your home. or anywhere else. What you do with the device is you create tones and make them as needed, then record them into your put it on your line or the line ofthe phone you 're using. Then. when favorite device and there you have it. Check out the review on Cool you call the number it picks up the line and turns on the Edit 96 in this issue for an EXCELLENT program for generating microphone . Now all you do is sit back and listen. The microphone tones ofall kinds. will pick up everything in the area and put it on the phone line for your listening pleasure. 36 Volume 1 Issue 1 - Spring 1998 THUD A Red Box, sometimes referred to as a Quarter Box is used to Scanning IS illegal in SOME areas. You'll have to check your local generate the tones that a payphone makes when you drop coins in laws to find out. Scanning is usually not complained about by the them. For more information see the above question on Red Boxes. victims since they only receive one hang-up call. I'm sure we've all gotten them. Phone companies do not look kindly upon scanning. A Silver Box and a White Box are very similar. Both are devices Some central offices are set up to automatically detect scanning and that generate the DTMF tones used in dialing. The White Box can will shut down the offending line for a period of time. About the only generate tones for 0-9*# whereas a Silver Box can also only way you might get in trouble is if there is a law specific to generate the tones for ABCD. scanning or if you scan regularly and the telco catches it. A Black Box basically fools the phone company into thinking that Q: What is LATA? the phone it's hooked up to hasn't picked up the phone . What happens is that even after the person picks up the phone it continues A: LATA stands for Local Access Transport Area . These are to ring. You talk between the rings and the call is never billed. All it geographic areas used to determine whether the call is to be routed is is a resistor and capacitor in series placed across the phone line . using the loacal network or if it is to be routed by a long distance It does not work on the newer ESS type phone systems. Was a great carrier. If the source and destination are in seperate LA TA's then one back in the early 80's. the call is long distance . A Clear Box is a telephone pickup coil and a small amp used to LATA mapping is not restricted to geo -political boundaries. LATA's make free calls on Fortress Phones . Great for use on the newer can take up a whole state or just a small region . Some LATA's even phones that mute the pickup microphone. cross borders between states . A Color or Tan Box is a line activated telephone recorder . You can Maps of LATA boundaries can sometimes be found in phone books. actually buy these at Radio Shack They're known as It depends on whose phone book it is. The Center for phone line recorders. Communications Managment Information also sells LATA maps and can be reached at 800-929 -4824. It has also been mention that A Tron Box reverses the phase ofpower to your house , causing your McGraw-Hill business publishing may have LATA maps. electric meter to run slower. For more information see the article in this issue on Stopping Power Meters . BTW, it has NOTHING to do Q: Many times when I see schmatics for touch tone encoders or with phone systems. decoders I see the frequencies for the keys ABeD. What are they used for? Q: Someone was telling me once about something called Tempest and he said that with this stuff someone parked in a A: The ABCD extensions originally came for the militry. They had van outside your house would be able to see what's on your need for a way to prioritize their calls . If say there was an computer monitor or tell what you are typing. Is this true? emergency call because the Rushes were about to nuke our ass and all the phone lines happened to be busy , they could just press a A: All computers and electronic devices emit electromagnetic button and the phone system would drop line automatically so the radiation of one form or anoth er. Ever have a neighbor that had a call would go through . But this was only on the military's own phne HAM transmitter and liked to key down right when the winning play network known as Autovon . for the game was in progress and all you saw was a bunch of wavy lines? Well, this is called electromagnetic interf erence, or EMI for Originally the four keys ABCD were called Fa. F. I. and P. They short. It's also sometimes referred to as radio frequency stood for Flash Override. Flash, Immediate , and Priority. These interference, or RFI. If you look at the sticker on the back of TV's buttons ranked the priority of the call and would override calls of and such you'll see an FCC compliance statement concerning the leser priority. FO was the highest and P the lowest . devic es ability to not emit RFI but ye t accept RFI from other sourc es. Although these buttons are not in general commercial service. they are used in custom devices. Amateur radio repeaters make use of It is these emissions that are picked up by very specialized and these tones for contro/. Security systems sometimes make use of sensitive receivers that enable someon e to 'see' what you are doing these buttons as well, although for security reasons they don't use on your computer. Differ ent devices emit on differ ent frequ encies . the same set of DTMF frequencies . You may also find that most By having their equipm ent set up to scan only the frequencies for DTMF generators are capable of making th e ABCD tones. the device they want to surveil . they can home in on their suspect . including modems . Usually, they synchronize one of their monitors to the refresh sync pulses on your monitor so that they can see the image on your Q: I have a computer that I need to change the BIOS settings screen as you see it. It can also be applied to other devices. on it and it's password locked. Is there a way or a program that will crack the BIOS password! Yes, it's ve,y true, and you can thank our dear government for bringing it to us. Tempest stands for Transient Electromagnetic A: Well, what kind of BIOS is it? What you need to do varies from Pulse Surveillance Technology. Tempest is actually a u.s. machine to machine and from BIOS to BIOS. Common BIOS's Government program that evaluat es electronic equipment and sets include AMI, Award. IBM and Phoenix. There are several other the standards for how much EMI devices can emit without kinds of BIOS's but these are the most common for non-proprietary compromising any information stored or processed on them . It uses systems. shielding technology to prevent the EMI from getting out of the device . In the United States , Tempest shielding is illegal for the Also , there are two types of passwords that may be set . One is a average Joe Blow citizen to use. I wonder why? boot password, required when the user turns on the computer to allow it to boot up. The other is simply used to control access to the Q: What is war dialing and is it illegal? BIOS, which seems to be your problem . A: War Dialing (a.k.a. scanning. demon dialing) is the process by The BIOS must store this password somewh ere and that somewhere which a person dials phone numbers f or the purpose of finding is usually accessible in RAM. If you can boot the machine and you intersting tones or carriers . It is usually done automatically by know the memory address of where the BIOS password is stored. computer and modem in a search for other computer system dial in you can just read it directly. Ofcourse , it may be scrambled in some access points. Programs are usually written to scan all numbers in way so you'll have to know that also. The best way is to have a a given prefix . They can be set up to do so sequentially or randomly. program that knows both ofthese things . Most BIOS cracking programs are written for the AMI BIOS. Some Many people have written their own war dialers . But. for those of will give you the password in plain English (the best) while others you who are not comput er programmers, you can find already made just give you the ASCII codes. There are also some that just give packags on the internet . Probably the best one available for the PC you the keyboard scan codes. This not only varies from cracker to is ToneLoc . You can get the file on the internet atftp.paranoia.com/ cracker but also f rom version of BIOS to BIOS as well. One place pub/toneloc/. that you may be able to find the software you need is to ftp to oak.oakland.edu and look in /simtel/msdos/sysutil/. THUD Volume 1 Issue 1 - Spring 1998 37 Another common Irick 10 use if you are able to boot the machine but 607 993 609 958 just can't gel into the BIOS is to simply boot the machine and then 610 958 610 958-4100 remove the power supply to the CMOS memory chip that stores the 612 511 614 200 BIOS presets . A small battery all the motherboard is used to 614 571 615 200200200200200 maintain the information when the computer is turned off There's 615 2002222222 615 830 just aile catch. though. ALL of the BIOS information will he lost; 616 200-222-2222 617 200-222-1234 date/time. floppy drive settings . hard drive settings, and possibly 6/7 200-222-2222 617 200-444-4444 even more critical information. Depending Oil the machine this 617 220-2622 617 958 could be considered a last resort tactic . 618 200-xxx-xxxx 618 930 619 211-2001 6/9 21l-2/21 Q: What is an ANAC? 703 81/ 704 311 707 211-2222 708 /-200-555-/212 A: ANAC stands for Automatis Number Anouncment Circuit. Whe11 708 1-200-8825 708 200-6153 you call all ANAC a recording comes Oil that tells you the number 708 724-9951 708 356-9646 that you are calling from . It's an excellent way to find out the 713 380 713 970-xxxx number of a wire pair. They're very' useful when GaM Boxing. 713811 714 114 Following is a large list of ANAC's. They are not guaranteed to 714 211-212/ 714 211-2222 work. DO NOT abuse ANAC's as the phone company will catch Oil 716 511 716 990 and change the number. 717 958 718 958 802 2-222-222-2222 802 200-222 -2222 United Slates: 802 1-700-222-2222 802 111-2222 201 958 202 811 805 114 805 211-2345 203 970 205 300-222-2222 805 211-2346 805 830 205 300-555-5555 205 300 -648- I I // 806 970-xxxx 8/0 200200200200200 205 300-765-4321 205 300-798-11 11 812 4/0-555-/212 813 311 205 300 -833-3333 205 557-231/ 8 I 5 200-xxx-xxxx 8/5 290 205 811 205 841-/111 817 211 8/7 970-611-111/ 205 908-222-2222 206 411 818 /223 8/8 211-2345 207 958 209 830-2/2/ 8/8 211-2346 903 970-611-11 11 209 211-9779 2/0 830 904 200-222 -222 906 / -200-222-2222 212 958 213 1/4 907 8/ I 908 958 213 1223 213 211-2345 910 200 910 311 213 211-2346 213 760-2?? ? 9/0 988 914 990-1111 213 61056 214 570 915 970-xxxx 916 211-2222 214 790 214 970-222-2222 9/6 461 919 200 214 970-611-1111 2/5 410-xxxx 919 711 215 511 215 958 2 I 6 200-XXXX 216 331 Canada : 216 959-9892 217 200-xxx-xxxx 204 644-4444 306 115 219 550 219 559 403 311 403 908-22 2-2222 301 958-9968 310 114 403 999 416 997-xxxx 310 1223 310 211-2345 506 / -555-1313 514 320-xxxx 310 211-2346 312 200 519 320-xxxx 604 1116 312 290 312 1-200-8825 604 121l 604 211 312 1-200-555 -1212 313 200-200-2002 613 320-223 2 705 320-4567 313 200-222-2222 313 200-xxx -xxxx 3 I 3 200200200200200 314 410-xxxx# Australia : 315 953 315 958 +61 03-552-41 I I +61219123 315 998 317 310-222 -2222 +61211544 317 559-222-2222 317 743-1218 334 5572411 334 5572311 United Kingdom : 401 200-200-4444 401 222-2222 175 402 31l 404 31l 404 940-xxx-xxxx 404 990 Israel: 405 890-7777777 405 897 110 407 200-222-2222 408 300-xxx-xxxx 408 760 408 940 Q: Are caller ID and ANI the same thing? 409 951 409 970-xxxx 410 200-6969 410 200-555-1212 A: Yes. and no. ANI, or Automatic Number Identification is the term 410 811 412 711-6633 describing the phone company's internal system for identifying the 412 7JI-441l 412 999-xxxx the caller. This is used for routing and billing purposes and is of 413 958 413 200-555-5555 itselfnot accessible to the public. 414 330-2234 415 200-555-1212 415 21l-21l 1 415 2222 Caller ID. a/so called eNID or Call Display , is a service offered by 415 640 415 760-2878 the phone company to their customers that. for a fee. will display 415 7600-2222 419 311 the number of the calling party on a special box attached to the 502 2002222222 502 997-555-1212 phone which is bought seperately, again for a fee. 503 6J.J 503 999 504 99882233 504 201-269-1l 11 ANI has existed for a /oooooooooooooong lime. All this crap we 504 998 504 99851-0000000000 keep hearingfrom the phone companies that they can 't do it is bunk. 508 958 508 200-222-1234 How do you think 911 operators get their info when someone needs 508 200-222-2222 508 26011 help? A hangul' call to 911 will result in a patrol car being sent to 509 560 510 760-11 JI the location to confirm if there is an emergency or not. The 911 512 830 512 970-xxxx operator has the callers location shown on their computer display 515 5463 515 811 the moment the answer "911. what's the emergency?" 516 958 516 968 517 200-222-2222 517 200200200200200 Basically. ANI has always existed. for how else does the phone 518 511 518 997 company know who to bill? Caller ID is their way ofletting you use 518 998 603 200-222-2222 ANI but making you pay for it. 606 997-555-1212 606 711 38 Volume 1 Issue 1 - Spring 1998 THUD Q: What does COCOT stand for? The mobile transmits 45MHz below the base channel. i.e. channel I base channel is 870.030MHz so the mobile transmits at A: COCOT is Coin Operated Customer Owned Telephone, or could 825.030MHz and receives on 870.030MHz. Caution. the new be Customer Owned Coin Operated Telephone ...either way it digital systems are being allocated to some ofthese channels. means the same thing. It's like a payphone in the sense that you have to drop coins into the phoen to make a call. The difference lies Ch. Freq. (base) System in who actually OWnS the phone itself. Use 991-1023 869.040 - 870.000 A-RCC voice A regular payphone which you might see lines on the streets is 001-312 870.030 - 879.360 A-RCC voice owned by the phone company itself. A COCOT on the other hand is 313-333 879.390 - 879.990 A-RCC data owned by an individual. Of course the individual has to pay the 334-354 880.020 - 880.620 B - Telco data phone company to access the network but the cost is low enough to 355-666 880.650 - 889.980 B - Telco voice allow the owener to make a profit from the use ofthe phone. 667-716 890.010 - 891.480 A-RCC voice 717-799 891.510 - 893.970 B - Telco voice Sometimes individuals have COCOT's installed in their homes thinking that they can save money on their calls. Most often. Cordless Telephones however, the services they get are less than what is expected. Many times a COCOT is unsable to make long distance calls at all. Others Channels 16-25 we're once channels 1-15. These were the original have been knwn to have problems accessing new area codes when 10 channels allocated. Channels ABCDE are also used for walkie- they go into effect. talkies. baby monitors and other low power uses. COCOTs are also known to Red Boxers as "useless" since a red Ch Base Handset Ch Base Handset box proves to be ineffective on a COCOr. The reason for this is 1 43.72 48.76 14 44.46 49.46 very simple. Red Boxes work on this principle: recreate the toners) 2 43.74 48.84 15 44.48 49.50 that fool the phone company into thinking you inserted money into 3 43.82 48.86 16 46.61 49.67 the payphone. 4 43.84 48.92 17B 46.63 49.845 5 43.92 49.02 18C 46.67 49.86 You see, the payphones on the street that are owned by the phone 6 43.96 49.08 19 46.71 49.77 companies themselves are quite dumb. really. The payphone makes 7 44.12 49.10 20D 46.73 49.875 no decisions when it comes to handling calls. When a coin is 8 44.16 49.16 21A 46.77 49.83 inserted into one of these payphones, the phone creates the coin 9 44.18 49.20 22£ 46.83 49.89 insertion tones (the same ones that the Red Boxes reproduce) and 10 44.20 49.24 23 46.87 49.93 sends it offto the phone company switches. At that time. the phone 11 44.32 49.28 24 46.93 49.99 company equipment at the closest CO decides if the tones are real 12 44.36 49.36 25 46.97 49.97 and which amount of money was inserted. If everything goes all 13 44.40 49.40 right, the CO allows the call to go through. It 's a rather interesting cycle ofevents. Mobile Telephones These are FM transmissions. Many of the channels are now used Now, the COCOTs don 't work like this. COCOTs are special for paging. payphones that work on normal phone lines such as the phone line in your home. It works like this: You own your own line and put a VHF - 30 kHz spacing UHF - 25 kHz spacing payphone on it. The payphone itself has to make the decisions on Base: when a coin is inserted and if the coin is counterfeit or not. The 152.030 - 152.210 RCC 454.025 - 454.350 RCC COCOT does not send a special tone to the phone company CO 152.510 - 152.8/0 telco 454.375 - 454.650 telco since the phone company does not operate the payphone. The Red Mobile: Box tones are ineffective because of this. The COCOT does not /57 .770 - 158.070 telco 459.025 - 459.350 RCC generate tones anyway. so why would a Red Box work? A COCOT /58.490 - 158.670 RCC 459.375 - 459.650 telco is much like a vending machine. It's selfcontained and owned by a vendor. COCOTs have their own flaws. though. Air to Ground Telephones Q: What are DTMF tones and how do I make one? These are FM transmissions used on private aircraft. Anywhere from one to four channels are used in a given area. The ground A: DTMF stands for Dual Tone Multi-Frequency. When you dial a station repeats the airborne halfof the conversation. They transmit phone number with your telephone, the tones you hear are DTMF a steady tone when not in use. tones. Each tone actually consists of two tones. To create any kind Ch Ground Airborne of DTMF tone, you simply create two tones at the same time. For instance. the following is a list ofthe DTMF tones used Ona phone: Signal 454.675 (459.675) 6 454.700 459.700 1209Hz 1336Hz 1477Hz 1633Hz 7 454.725 459.725 697Hz 1 2 3 A 5 454.750 459.750 770Hz 4 5 6 B 8 454.775 459.775 4 454.800 459.800 852Hz 7 8 9 C 9 454.825 459.825 941Hz 0 # 0 3 454.850 459.850 /0 454.875 459.875 2 454.900 459.900 If you'd like to create these tones with a piece ofsoftware on your 11 454.925 459.925 IBM compatible. check out the review on Cool Edit '96 in this issue 1 454.950 459.950 of THUD. /2 454.975 459,975 Q: What are some good frequencies to scan to find interesting 800 MHz Air to Ground Telephones stuph? These are AM or sometimes SSB transmissions in digital format and A: Ok. .ithat 's a lall order, but I think we've got enough info to get are used on commercial airliners. Channel spacing is 6KHz. Each you started. geographic area is assigned a block of 29 unique channels. Ground stations do not echo the airborne half. Guard Band between each Cellular Telephones channel is xxx.x765 - xxx.x797. Control Channels for each channel is xxx.x813 - xxx.x973. These are transmitted in FM and each channel is 30KHz apart. Channels 991-/023 are sometimes referred to as channels 800-832. THUD Volume 1 Issue 1 • Spring 1998 39 Airhorne Ground They were allocated in June 1996. Freqs are in MHz. Block Ch / - Ch 29 Ch 1 - Ch 29 /0 894.0055 - 894./735 849.0055 - 849./735 Ch Freq Ch Freq 9 894.2055 - 894.3735 849.2055 - 849.3735 1 462.5625 8 467.5625 8 894.4055 - 894.5735 849.4055 - 849.5735 2 462.5875 9 467.5875 7 894.6055 - 894.7735 849.6055 - 849.7735 3 462.6125 10 467.6125 6 894.8055 - 894.9735 849.8055 - 849.9735 4 462.6375 11 467.6375 5 895.0055 - 895./735 850.0055 - 850./735 5 462.6625 12 467.6625 4 895.2055 - 895.3735 850.2055 - 850.3735 6 462.6875 13 467.6875 3 895.4055 - 895.5735 850.4055 - 850.5735 7 462.7125 14 467.7125 2 895.6055 - 895.7735 850.6055 - 850.7735 / 895.8055 - 895.9735 850.8055 - 850.9735 GMRS - General Mohile Radio Service Television Maximum power on these channels is 5 watts. 462.6750 may also he used as an emergency channel. The repeater is on the same Yeah. TV, the boob-toob, eye-hall burn er.... anyway, each TV frequency as the hase. These are licensed stations. channel is 6MHz wide (WOW!) . The video is upper sideband, supressed carrier 1.25MHz into the hand. Audio is 200KHz wide Base Mobile FM with it's carrier .25MHz helow the end of the hand. Some 462.5500 462.5625 stations might he off by +/- 10KHz. not much compared to the total 462.5750 462.5875 bandwidth. Note the gaps between ells 4/5,617. and 13/14. In some 462.6000 462.6125 areas the frequencies in channels /4-20 are used for Public Service 462.6250 462.6375 mohile use. For some oddball reason channel 37 is not used. 462.6500 462.6625 462.6750 462.6875 Ch Range Video Audio 462.7000 462.7125 2 54 - 60 55.250 59.750 462.7250 462.7375 3 60 - 66 61.250 65.750 4 66 - 72 67.250 7/.750 Railroads 5 76 - 82 77.250 8/ .750 6 82 - 88 83.250 87.750 The Association of American Railroads assigned the channel 7 /74 - /80 /75.250 /79.750 designations for these frequencies. all in MHz. 2 through 6 are only 8 /80 - 186 181.250 /85.750 used in Canada. Channel spacing above channel 6 is 15KHz. 9 186 - /92 187.250 /91 .750 10 192 - 198 /93.250 197.750 Ch Freq 11 198 - 204 199.250 203.750 2 159.810 12 204 - 210 205.250 209.750 3 159.930 13 210 - 2/6 211.250 2/5.750 4 160.050 14 470 - 4 76 271.250 475.750 5 /60 .185 15 476 - 482 277.250 481. 750 6 160.200 xxx-xxx + 6 xxx + 1.25 xxx+5 .75 7 /60 .2/5 68 794 - 800 795.250 799.750 8 160.230 69 800 - 806 801.250 805.750 96 161.550 Cable TV 97 161.565 Cable TV is pretty much the same as broadcast television except the The following frequencies are also shared with trucking. ranges for some ofthe channels are different . Base Mobile Ch. MHz 452.325 457.325 2 -13 54 - 216 same as broadcast VHF 452.375 457.375 14 - 22 120 - 174 Mid band Ch. A-I 452.425 457.425 23 - 36 216 - 300 Super band J- W 452.475 457.475 37 - 53 300 - 402 Hyper band AA -QQ 452.775 457.775 54 - 64 402 - 468 Hyper band 452.825 457.825 65 - 94 468 - 648 Ultra band 452.875 457.875 95 - 99 90-120 Low band A5-A1 452.900 457.900 100-125 648 - 804 Ultra band These ones are used for slave and remote controlled locomotives . Citizens Band 452.925 452.950 Also known as CE. Mostly AM with some SSE in use. Freq's are in MHz. These are for end of train monitors (ETM's). 161.115 is specific to Norfolk-Southern. Ch Freq , Ch Freq Ch Freq Ch Freq 1 26.965 11 27.085 21 27.215 31 27.315 457.9375 161.115 2 26.975 12 27.105 22 27.225 32 27.325 3 26.985 13 27.115 23 27.255 33 27.335 Marine VHF 4 27.005 14 27.125 24 27.235 34 27.345 In US waters ships may transmit on the shore frequencies of 5 27.015 15 27.135 25 27.245 35 27.355 channels 20, 24-28, and 84-87 . Shore frequencies are 4.6Mhz 6 27.025 16 27.155 26 27.265 36 27.365 above the ship frequency. Notice how the channel numbers are 7 27.035 17 27.165 27 27.275 37 27.375 interlaced. 8 27.055 18 27.175 28 27.285 38 27.385' Ch Ship Ch Ship 9 27.065 19 27.185 29 27.295 39 27.395 60 156.025 10 27.075 20 27.205 30 27.305 40 27.405 156.050 61 156.075 156.100 62 156.125 FRS - Family Radio Service 156.150 63 156.175 156.200 64 156.225 These frequencies are FM. Maximum power is 1/2 watt. These' xx xxx.xxx xxx.XXX channels are allowed to vary by up to 2.5KHz. You'll find that the 25 157.250 85 157.275 first seven channels are shared by the GMRS (see next section). 26 157.300 86 157.325 40 Volume 1 Issue 1 - Spring 1998 THUD 27 157.350 87 157.375 123.100 control tow er at special events 28 157.400 88 157.425 122.825 Enroute airline ops - local area 122.875 Enroute airline ops - local area Some channels have specific assignments. 122.750 air-to-air - private arcft 123.025 air-to-air - helicopter 6 156.300 Intership Safety 131.550 ACARS - digital (airlines) 9 156.450 General use - recreational vessels /3 156.650 Bridge-to-Bridge Ambulances /5 156.750 Weather. notices, etc /6 156.800 General Calling / Distress Channels Med-9 and Med-l0 are sometimes used by the ambulance 22 157.100 Coast Guard Liaison companies for dispatch purposes. AMTS - Automated Maritime Telecommunications System chan Hospital Ambulance Med-9 462.950 467 .950 Channel spacing is 25KHz. Ships are not allowed to transmit in Med -l0 462.975 467.975 groups C & D. Med-l 463 .000 468 .000 Med-2 463 .025 468 .025 Grp Ch Shore Ship Med-3 463 .050 468.050 D 101-120 216.0125-216.4875 Med-4 463.075 468.075 C 121-140 216 .5125-216.9875 Med-5 463 .100 468 .100 B 141-160 217.0125-217.4875 219.0125 - 219.4875 Med-6 463.125 468.125 A 161-180 217.5/25-217.9875 219.5125 - 219.9875 Med-7 463.150 468.150 Med-8 463.175 468.175 Here's some other frequencies used for one hoard communications. A special channel. Ch mobile repeater 1 467.750 457.525 155.340 HEAR Intersystem (Hosp. Emerg. AmbuJ. Radio) 2 467.775 457.550 3 467 .800 457.575 Poli ce 4 467.825 457.600 39.46 intersystem operations only Aeronautical Frequencies 45.86 int ersystem operations only 155.370 (wid ely used, but not a Federal allocation) There's a shitload of different frequencies and frequency ranges 155.4 75 statewide emergency nets used in aviation. The ones listed here are voice communications. 173.075 stolen vehicle recovery (LoJack) There's many others used for navigation. It is possible to obtain 154.665 154.680 154.695 Stat e Poli ce ariel navigational charts and have all the freqs used in a particular 154.905 154.920 154.935 coordinated operations area laid out for you . 155.445 154.460 154.490 " 25KHz wide AM unles s noted otherwise. Fir e 45.88 inters ystem. primarily base-mobile Range Use 154.265 mutual aid 108.000 - /17 .950 Nav Aid s - VOR & localizer. 50 kH z step /54 .280 mutual aid 118. 000 - 12/.4 00 ATC - towers & ARTCC 154.295 mutual aid 121. 600 - 121.925 A TC - airport ground control 122.000 - 122.650 Flight Service Stations. 50 kHz step Emergency Medical 122.700 - 123.500 UNICOM For ambulance MED channels see above. 123.600 - 128.800 ATC - towers & ARTCC 128.825 - 132.000 Enroute - airline company freqs 155.340 HEAR - Hospital Emerg. Ambul. Radio 132.025 - 135.975 ATC - towers & ARTCC 460.525 inter/intrasystem w/ Police & Fire 136.000 - 136.4 75 Enroute - international 460.550 inter/intrasystem w/ Police & Fir e 136.500 - 136.975 Enroute - domestic & international Public Safety - all UNICOM - Aeronautical advisory station at airport Mobile fr equencies for 220MHz range are I MHz above; for 122.700 122.725 460MHz range are 5 MHz above; and for 860MHz range are 45 122.800 123.000 MHz below. 122.950 at airport w/ full-time tower 122.975 above 10.000 feet 220 .8025 - 220 .8475 Mutual Aid (5 kHz intervals) 123.050 123.075 at heliports 866 .0125 866.5125 Mutual Aid 867.0125 867.5125 Mutual Aid Multicom - common freq. at uncontrolled facilities 868.0125 Mutual Aid 122.850 122.900 primary CTAF Weather - NOAA broadcasts 122.925 Fed/State natural resources The alert signal on these frequencies is a 1050Hz tone for about 5 FSS - FAA Flight Service Stations seconds. 122.000 122.050 EFAS "Flight Watch" 122.100 receive only (w/VOR) Ch Freq . 122.200 standard FSS 1 162.550 161.650 Environment CAN 123.600 123.650 AAS Airport Advisory Svc 2 162.400 161.775 marine weather 3 162.475 Aviation Support - training. gliders. ballons, etc 4 162.425 121.950 5 162.450 123.300 123.500 6 162.500 122.775 122.850 aviation services 7 162.525 Miscellaneous Television and movies. 121.500 standard emergency freq .. ELTs Broadcast Remote Pickup 123.100 Search And Rescue - actual 25.87 - 26.45 20/40 kHz intervals 122.900 Search And Rescue - training 152.87 - 153.35 60 kHz intervals THUD Volume 1 Issue 1 - Spring 1998 41 161.64 - 161.76 30 kHz intervals Full Disclosure 450.05 - 450.85 50/100 kHz intervals P.o. Box 903-C, Libertyville. I//inois 60048 455.05 - 455.85 50/100 kHz intervals HAC-TIC Dutch Hacking Magazine P.o. Box 22953 Film and Video Production 1l00DL 152.87 152.90 152.93 Amsterdam 152.96 152.99 153.02 Phone: +31 206001480 173.225 173.275 173.325 173.375 E-Mail: ropg@ooc.uva.nl Wireless mikes 2600 Magazine You may find some on unused FM/TV broadcast channels P.o. Box 752 169.445 169.505 170.245 Middle Island, NY 11953-0752 170.305 171.045 171.105 (516)751-2600 171.845 171.905 Cybertek Magazine Dot Frequencies P.o. Box 64 Brewster NY 10509 These are the channels used on the profJesional "walkie-talkies" /ike you'll find at construction sites and the /ike. They are assigned Mondo 2000 by the manufacturer or distributor. P.o. Box 10171 Berkley. CA 94709-5171 Color Freq. Comment Phone 415-845-9018 Red 151.625 itinerant Fax 415-649 -9630 Purple 151.955 Blue 154.570 Monitoring Times Green 154.600 P.o. Box 98 White 462.575 GMRS 7540 Highway 64 West Black 462.625 GMRS Brasstown, NC 28902-0098 Orange 462.675 GMRS (704)837-9200 Brown 464.500 itinerant www.grove.net Yellow 464.550 itinerant Email: mteditor@grove.net "J" 467.7625 "K" 467.8125 Satellite Times Silver Star 467.850 P.o. Box 98 Gold Star 467.875 7540 Highway 64 West Red Star 467.900 Brasstown. NC 28902-0098 Blue Star 467.925 (704)837-9200 Also check these frequencies . http://www.grove.net/hmpgst. html 27.49 35.04 43.04 151.505 Email: steditor@grove.net 158.400 469.500 469.550 Scrambling News CTCSS (PL) Frequencies 1060 Niagara Falls Blvd.. #110 Tonawanda. NY. 14150 Motorola differs from EIA with: XZ (L1), X4 (L2). XB (L3). yz (716)283-6910 (L4). YB (L4A), ZA (L5). ICOMM does not use 97.4 and uses one E-Mail: scramblingnews @msn.com less than the amateur numbers above that (i.e. ICOM #25 = 162.2). URL: http://www .scramb/ingnews. com/ Freq Designator Freq Designator Privacy Journal EIA Ham EIA Ham P.o. Box 15300 67.0 L1 01 136.5 42 21 Washington D. C. 20003 71.9 L2 02 141.3 4A 22 Phone 202-547 -2865 74.4 WA 03 146.2 4B 23 77.0 L3 04 151.4 52 24 Q: I know that a beige box is just a Iinemans test set. I'd like to 79.7 SP 05 156.7 5A 25 know where I can buy one of these and perhaps some other 82.5 L4 06 162.2 5B 26 telecom tools? 85.4 YA 07 167.9 62 27 88.5 L4A 08 173.8 6A 28 A: Try the following places: 91.5 22 09 179.9 6B 29 94.8 L5 10 186.2 72 30 Jensen Tools 97.4 2B II 192.8 7A 31 7815 S. 46th Street 100.0 12 12 203.5 Ml 32 Phoenix. A285044-5399 103.5 lA 13 206.5 82 (800)426-1194 107.2 lB 14 210.7 M2 33 http://wwwjensentools.com 110.9 22 15 218.1 M3 34 114.8 2A 16 225.7 M4 35 Contact East 118.8 2B 17 229.1 92 335 Willow Street 123.0 32 18 241.8 M6 37 North Andover. MA 01845-5995 127.3 3A 19 250.3 M7 38 (508)682-2000 131.8 3B 20 254.1 02 www.contacteast .com Q: What are some other hacking related magazines I can get Time Motion Tools ahold of! 12778 Brookprinter Place Poway, CA 92064 A: There are still quite a few titles available if you do some looking (619)679-0303 around. Check these out for starters : PLEASE SEND QUESTIONS & LETTERS TO: TAP Magazine P.o. Box 20264 Louisville. KY 40250 THUD MAGAZINE P.O. BOX 2521, CYPRESS, CA 90630 42 Volume 1 Issue 1 - Spring 1998 THUD the 555 timer Ie for dummies by: Orion The 555 timer IC is probably one of the most versatile chips the amateur electronics builder can have at their disposal for generating controlled and even quite precise waveforms. It comes in a small 8-pin IC package, although a dual version is available in a 16-pin package. There are many uses for this device and many ways to configure it for various types of output , however this we will only deal with the basics of how to set up the chip to produce the desired frequency. The output will generally be a square wave which is usually suitable for most applications. In this article we will describe the two basic modes of operation for the 555; monostable or one-shot, and astable. Monostable operation is when the chip is setup to deliver a single pulse of desired pulse-length when an input trigger is received . Astable is when the chip is setup to run freely or continuously oscillate at a pre-determined frequency. Depending on the selected external components it is possible to make the 555 run at frequencies as high as 100KHz or so low the the siganal on time can be measued in minutes, sometimes hours. , . . . . . - - - - - - - - - - - - - - - - - , In fig. 1 we have the pinouts for the 555. Note that the supply pins 1 and 8 are 555 pinouts not what one may be used to if you deal with normal 7400 series TTL. The typical maximum Vcc operating voltage is from 12-15 volts, although I have Vcc seen devices rated as high as 18 volts . Of course the chip will work just fine on normal 5 volt power so you can use it with other CMOS and TTL devices . Pin 2 is used to trigger the chip to produce the output pulse. It's connections vary discharge between mono and astable operation . Pin 3 is the output, not much need for an explaination there . Pin 4 is the active low reset input. For normal operation this should be tied directly to Vcc. Pin 5, the control voltage input is used to output threshold control the point at which the capacitor voltage triggers the 555 to go low or high. For our applications this is not used and is tied to ground via a .01uF control capacito r. Pins 6 and 7 are used in conjunction with the external RC network reset voltage to create the timing of the pulses generated . fig. 1 Fig. 2 shows the basic schematic for simple monostable or one-shot operation . 10--10--------------.. The input trigger is held high and sent low to trigger the 555. The output is low and goes high when triggered for the specified time . How long the 555 goes , . . . . - - - - - - - - - - - - - - - -... high is controlled by the resistor/capacitor network of Rand C. As you know a monostable operation cpacitor stores a charge . When used in conjuction with a resistor to control current flow, the capacitor with charge or discharge at a certain rate. This is +Vcc ~----....- - - - - used to control the timing of the 555. In the setup of fig. 2 the on time found at the ouput on pin 3 can be calcula ted with the following simple formula: trigger R t(seconds) = 1.1 RC input e.g. 51.7milliseconds=1.1 (100K)(.47uF) To spell it out take the resistor value in ohms and multiply it by the capacitor .01uF value in farads and then multiply that answer by 1.1 to yield an answer in seconds of how long the output will stay high when the trigge r is grounded . output fig. 2 monostable operation misfire modification +Vcc~------------ R .01uF Now , you might think, what's the point of monostable operation? Well, you know those outdoor lamps that only go on when someone trips the infrared fig. 3 sensor and then stays on for a short while? Or how about your garage door opener light that stays on for a short while after the door is opened or shut? Or what about those automat ic doors that open for you when you approach them or step on the floor mat? These are all examples of timers in monostable operation. Once they are triggered, they stay 'on' for a predetermined length of time then go 'off until another trigger pulse turns them 'on' again. Now, I admit that these examples almost surely don't use 555 timers , the principle is the same. Now, let's move on to astable or free running operation. In this setup the 555 basically self-triggers. Whereas in the monostable setup the RC netwrok only controls how long the output remains high by how quickly the capacitor is charged, this setup also controls how long the oupt remains low by controlling how long the same RC network discha rges. Actually, there is an added resistor, as can be seen in fig. 4. The formula for calculating the operating frequency is as follows : F =1.443/(R +2R )C 1 2 e.g. 3101.22 Hz = 1.443/(330ohms+2(330ohms)).47uF THUD Volume 1 Issue 1 - Spring 1998 43 astable operation +Vcc R1 output R2 .0 1u F fig. 4 astable operation +5v...-...- -....- ....I - - - Now, if you really want a precise frequency you can use a crystal to control the 555. An example of just such a circuit is shown in fig. 6. You still need to pick R1 your values for the RC network , but it's been reduced to a very simple formula : F = 1.443/RC R2 You will have to choose your values so that the resulting frequency value is as close as possible to the frequency of the crystal. You can vary by up to 25% and possibly more but the closer the better, of course . The small trimmer capacitor can be used to fine tune the frequency of your oscillator so you can match it to a known standard. fig. 5 crystal controlled astable operation 1K Now for the gravy. What can you do with two 555 timers, a 12 digit keypad , and a simple opamp to mix the 555's outputs together, and the correct Rand C values? A DTMF touch tone encoder, better known as a silver box. I present here a schematic with all the values figured out for you. Use the two 5K pots on each of the 555's to adjust each of the high side and low side tones . Have fun!!! 4 5 two tone 7 8 9 c o~p~J * 0 # D +1 2v 44 Volume 1 Issue 1 - Spring 1998 THUD WI~ELESS CABlE "ELE"ISI~N F~hUEN""~ ASkED ~IES"I.S Compiled by Brian J. Catlin Copyright This file is Copyright (C) 1993, 1997 by Brian J. Catlin. All rights reserved . Redistribution of this file in both electronic and printed form, is permitted provided that this file is distributed in its entirety, including this copyright notice. If you redistribute this file, please let me know so that I can keep track of where this file goes. Sources Most of this information is taken from FCC Public Notices along with information sent to me by both the FCC and the Wireless Cable Association (WCA). Other information has come from numerous newspapers, magazines, and from discussions with MMDS subscribers. I would like to thank Alan Larson, Craig Strachman, David Newman, David Simmons, and JBlitzEsq for their numerous contributions and corrections. Questions and Answers 1.0) ABBREVIATIONS USED : ITFS Instructional Television Fixed Service . Channels that must have a minimum of 5 hours per week of educational programming. May be leased for wireless cable usage. LMDS Local Multipoint Distribution Service. Two sets of 50 channels in the 28 GHz band . Not yet available for wireless cable usage. MDS Multipoint Distribution Service . Two channels that are similar to MMDS. May be used in a wireless cable system. MMDS Multichannel Multipoint Distribution Service . Two sets of four channels each . Also , type of service known as "Wireless Cable". 2.0) WHAT IS WIRELESS CABLE? Wireless cable is a name given to a service that is called Multichannel Multipoint Distribution Service (or MMDS). It is a type of cable television system that offers its subscribers a mix of satellite channels by transmitting the programming over MMDS frequencies along with MDS, OFS , and ITFS frequencies, if they are available. Wireless cable uses Super High Frequency ("SHFn) channels to transmit satellite cable programming over-the-air instead of through overhead or underground wires. 2.1) WHAT IS CELLULARVISION? CellularVision/Suite12 is a company that has been granted special permission by the FCC to transmit video services on a higher frequency than what wireless cable uses. They have been testing in the 28 GHz (or LMDS) band. It is believed that the FCC may allocate two sets of 50 channels in this band for wireless cable type service . CellularVision is hoping to provide television plus much more. Since the signal is interleaved , it is possible for a large number of services to occupy a narrow bandwidth. CellularVision is planning on offering interactive networking, grocery ordering, bank transactions, and video teleconferencing . I am not sure what all CellularVision is planning on offering during this initial testing period. Howeve r, using the 28 GHz band means sacrificing signal range. These signals aren't able to achieve even the 25-30 mile range that MMDS and other 2 GHz services are able to get, given the same transmitting power. To get around this , they are using 35 "cell sites" to transmit the programming . They hope to offer service to over 6.3 million subscribers in the region around New York City by 1995. 3.0) WHAT ARE THE BENEFITS OF WIRELESS CABLE TO THE CUSTOMER? Availability : Wireless Cable can be made available in areas of scattered population and other areas where it is too expensive to build a traditional cable station. Affordability: Due to the lower costs of building a Wireless Cable Station, savings can be passed on to the subscribers . 3.1) HOW DOES IT WORK? Scrambled satellite cable programming is received at a central location where it is processed and fed into special transmitters. The SHF transmitters distribute the programming throughout the coverage area. The signals are received by special antennas installed on subscribers' roofs, combined with the existing VHF and UHF channels from the subscriber's existing antenna, and distributed within the home or building through coaxial cable into a channel program selector located near the television set. Notice that you must provide a UHF and/or VHF antenna if you want the broadcast channels . This is because the Wireless THUD Volume 1 Issue 1 - Spring 1998 45 Cable Box only provides a UHFNHF tuner. Of course . not all boxes include even this feature (but most do). 3.2) WHAT IS THE HISTORY OF MMDS? It is a fairly new service that developed from MDS (multi-point distribution service) which could only send one or two channels. Originally. the FCC thought MDS would be used primarily to send business data. However, since MDS's creation in the early 70's, the service has become increasingly popular in sending entertainment programming. Because the FCC does not regulate the content of the transmission, alternative uses would not be prohibited. Today, there are systems in use all around the U.S. and in many other countries including the former Soviet Union, and Canada. Other systems are being built all over the place. including Australia . At the rate that the FCC has been receiving applications, it looks as if many more systems are going to be built in the U.S.. 3.3) HOW DOES MMDS WORK COMMERCIALLY? A MMDS licensee, which is similar to a broadcast station owner, leases transmission time to programmers on a first-come. first- served basis. The programmers . in turn. are responsible for designing and selling their programs to the subscriber . A MMDS applicant can choose to operate as a common carrier. In the telecommunications industry, a common carrier also may provide services such as audio only transmissions, telephone, or data. A MMDS applicant can alternatively choose to operate as a non- common carrier. This scenario in effect would constitute a non- common carrier wireless cable system . Also, note that a MMDS license only entitles you to FOUR channels. In order to use all 33 channels, you must apply for several different licenses. This can be very costly! 4.0) WHAT FREQUENCIES ARE USED? Frequency Range(MHz) Number of Channels used Type of Service Channel Groups 2.150-2,162 MDS 1,2,2(A) 2,500-2.596 16 ITFS ABC&D 2,596-2 ,644 8 MMDS E&F 2,644-2,686 ITFS G 2,644-2,686 MMDS H 2,686-2,689 .875 31* MMDS Response Channels * - Each channel's bandwidth is 125 KHz, and does not carry video. There are also tests being made in New York for transmitting in the 28 GHz band (LMDS). The frequencies used are 27.5 GHz - 29.5 GHz . I am not sure of how these frequencies are divided between the different services. The FCC is currently thinking about opening up more frequencies so that up to 7 wireless cable companies can compete in the larger markets. 4.1) HOW MANY CHANNELS CAN BE TRANSMITIED? When fully implemented, wireless cable operations may have as many as 33 channels of broadcast and cable programming . This, of course, depends on which channels are already used in your area. Furthermore, 20 of the 33 channels are borrowed from ITFS services and are earmarked for educational use. This means there is a requirement to program 20 hours per week per channel of educational material. All educational programming is now allowed to be placed on one ITFS channel instead of having it spread over the four channels in the ITFS group. For new ITFS licenses, only 12 hours per week per channel is required, but they cannot be grouped together. If any of these channels are being used, then any extra time can be leased by the MMDS station, if the owner of the license agrees. Approximately 150 to 300 channels may become available if digital compression is used. There are a few sites that are testing this new technology, and I have heard that the video and audio signals are quite good. They are using Zenith's new 16-level digital transmission system which is also capable of delivering HDTV (High Definition Television). Also, since the signals will be sent digitally, it is expected that the range of the signal will increase by approximately 3 times. 4.2) WHAT CHANNELS CAN BE SENT? Wireless cable systems can carry any of the typical cable channels. In the past, some channels refused to let wireless cable systems carry their signals. However, the cable re-regulation 'bill made channels that are available to cable companies also available to wireless cable . It can also send the 'SuperGuide' data along with similar data services. 46 Volume 1 Issue 1 - Spring 1998 THUD 5.0) WHAT IS THE RANGE OF WIRELESS CABLE? Wireless cable systems optimally can get a range of up to 25-30 miles. This depends largely on the terrain, transmitting power, both the transmitting and receiving equipment, and many other factors . In order to receive the signal, the transmitting and receiving antennas must be line-of-site. Because of its low startup costs, and the ability to reach places that cannot be served by traditional cable, MMDS may be feasible in certain rural areas. A range of 75 to 90 miles could be accomplished if a new digital compression system is used. (See question 4.1 ) 5.1) DOES WEATHER AFFECT RECEPTION? The answer to this question depends on the type of system used. For systems that transmit their programming without modification (ie. No compression or scrambling), severe fog and/or rain can cause the signal to be reflected, causeing the picture to deteriorate. From what I have heard,you can usually expect between eight to ten days per year of interrupted service. This figure, I believe, is the average for the current systems operating in the U,S.. If the programming is scrambled, the downconverter/descrambler may loose authorization sooner. On the other hand, if the programming is sent digitally, or is digitally compressed, the signal can deteriorate to a much lower level before the picture is affected. However, once the signal gets this weak, the picture will deteriorate at a much faster rate as the weather gets worse. From what I have read, the average number of days that this type of service would be interrupted, would be one day per year. (This sounds rather optimistic to me... does anyone have any info about this?) Also, the farther the receiver is from the transmitter , the sooner the picture will be affected. 6.0) WHAT EQUIPMENT IS IN THE SUBSCRIBER'S HOME? Each household subscribing to the service has a small antenna on its roof (about the size of an open newspaper) and a downconverter inside. The downconverter usually includes an addressable decoder and a VHF/UHF tuner built in. This gives it the ability to tune in broadcast channels without having to use up valuable MMDS channels. It also allows pay-per-view services and simplifies channel blocking and premium channel activation/deactivation. Also, the subscriber will need a UHF and/or VHF antenna if they want to receive broadcast channels. Recently, a new converter has been introduced that will send all channels out of the converter at once. This means that you can use your TV's and your VCR's built in tuner instead of having to have seperate boxes for each. This new technology is (hopefully) going to be integrated into Wireless Cable converters as well as the traditional cable boxes. 6.1) IS WIRELESS CABLE EQUIPMENT RELIABLE? Several excellent manufacturers produce antennas and downconverters for signal reception along with decoder boxes. Because the signal is broadcast over the air, it is not subject to the failures of traditional cable. However , the receiving end is somewhat more complex than most wired cable systems would use. Also, the signal is in a frequency range that may be attenuated by water (such as rain) and can be blocked by trees. There is also some risk of interference from microwave ovens operating in the area on 2,450 MHz. There are several companies that provide equipment and consulting services. If you are interested in this, you may want to pick up the latest copy of The Broadcasting Yearbook or Multichannel News. These can be found at most large libraries. 7.0) WHAT ABOUT COPYRIGHT ISSUES? In the past, wireless cable systems have assumed that they may use a compulsory license to pay for copyright issues (similar to what cable companies do today). A compulsory license enables systems to re-transmit broadcast signals for a pre- established fee to compensate producers of TV programs. The copyright office then announced that wireless cable is NOT a cable system, therefore, these systems may not use compulsory licenses . However, the Satellite Home Viewer Act of 1994 was passed and enacted on October 18, 1994. This act establishes that wireless cable systems fully qualify for the compulsory copyright license in the same manner as cable systems. I would like to thank JBlitzEsq for this information. 8.0) WHAT ABOUT SECURITY? In systems that use scrambling, signal security is provided by encoding each channel and equipping the converter with a decoding device that responds to a pilot signal carrying a data stream with authorization instructions. Thus, the system is totally addressable . No (legal) converter box will have any utility unless it is authorized for service by the central computer. All channels, both Basic and Premium, are hard scrambled . Because the wireless cable system is addressable, it can also accommodate pay- per-view service. One way to defeat this is to use an illegal converter box. These are not as easy to find as the ones for regular cable systems . However, a "Universal Descrambler" will probably be able to descramble the channels. (I have not tried this). If digital compression is used. then no scrambling is needed as a compressed signal is impossible to watch. According to Barry Nadler of the FCC office in Vero Beach, "There is not any restrictions on receiving wireless cable transmissions. There are currently restrictions on the cellular frequencies only. If you decode scrambled signals, you are THUD Volume 1 Issue 1 - Spring 1998 47 breaking the law. Cable companies can take you to court (Title 47 Section 605,USC) for 'Use of information not specifically directed to you'." This means that you may view any unscrambled/unmodified signals with your own receiver. You may not, however, unscramble a signal without authorization . I would like to thank David Simmons for providing this quote to me. 9.0) HOW ARE WIRELESS CABLE SYSTEMS REGULATED? The FCC has specifically preempted local regulation of wireless cable frequencies, asserting that it is interstate commerce. There is no basis for local regulation of the wireless signal. Unlike cable, no public rights of way are used, and all transmission and reception equipment is on private property. Furthermore, the antennas are so similar to regular television antennas that there can be no basis for zoning restrictions . If a particular area does have zoning restrictions against antennas , they can be fought against in court (the newsgroup rec.video .satellite occasionally has these discussions). However , if you signed an agreement that restricted antennas, you may be out of luck. This does not mean, however, that there is little regulation. The federal government regulates the industry heavily. This is done through processes of getting licenses, transfering licenses, applying for ITFS channels, report filings, etc. 10.0) I SAW ONE OF THOSE 'INFOMERCIALS' ABOUT WIRELESS CABLE. ARE THESE COMPANIES LEGIT? While some companies may be legit, there are some things that they don't disclose . Because of this, two companies have had temporary restraining orders placed against them . A judge has placed some of the following restrictions on them . They may no longer state that applicants are "virtually guaranteed" of winning a license in the FCC lottery or that most wireless cable licenses are "highly valuable ." "There may be substantial delays in the awarding of any MMDS license due to the length of time the FCC takes to process MMDS applications and award MMDS licenses ." That financing for wireless cable systems is hard to get. "given the relatively new nature of this field of technology and that such financing may require additional funds of the customer's own money as a condition" to obtaining a system. Provide a new "Risk Disclosure" statement that applicants must sign before sale is completed. This statement informs applicants , among other items, that any representations of value of systems are opinions and not actual values , that the winner of a MMDS lottery wins only 4 channels and that there may be competition with satellite, VCR, and other media . Also, take note that in the U.S., it is ILLEGAL to enter into (or even plan on entering into) a settlement group when applying for a license . 10.1 HOW CAN I TELL IF A COMPANY IS RUNNING A SCAM ON ME? Many scams work the following way: Television, radio, and newspaper ads say that a wireless cable company is looking for investors to apply for licenses for a given area, which the company will service. Investors are asked to pay a large sum of money for application and engineering fees. The application fee is only about $155 for four channels. The company then does an engineering study, which may not meet the technical requirements, and submits many applications at one time to the FCC for that market. If the investor wins a license, the company may not have the funding to actually bring a system on-line. Most legitimate companies get their investments from institutions instead of from individuals. Also, beware of any "limited liability partnerships" as they are frequently scams . 11.0) IS THERE AN INDUSTRY ASSOCIATION? Wireless cable operators, license holders, and equipment/service suppliers have formed the Wireless Cable Association. Among its activities the WCA has established a set of industry standards, both business and technical. The WCA has also made the industry's concerns known on Capitol Hill and at Federal agencies such as the FCC, NTIA, OTA and DOJ. The WCA has also opened channels of communication with organizations such as the National League of Cities, NATOA, MPAA and the Association of State Attorneys General. 11.1) WHO DO I CONTACT FOR MORE INFORMATION? FCC Mass Media Bureau Washington , DC 20554 Wireless Cable Association International, Inc. 1155 Connecticut Avenue, N.W. Suite 700 Washington, DC 20036 (202) 452-7823 FAX: (202) 452-0041- 11.2) ARE THERE ANY FTPOR GOPHER SITES AVAILABLE FOR MORE INFORMATION? The FCC is currently setting up a site (ftp.fcc.gov) for anonymous FTP of daily reports, transcripts , and many other things on 48 Volume 1 Issue 1 • Spring 1998 THUD cable, radio, television, telephone, and everything else that the FCC deals with . For more information on anonymous FTP, see your local network administrator or your BBS's sysop. This service is also available via gopher. All you need to do is gopher to ftp.fcc.gov port 70. 12.0) WHERE CAN I GET THE LATEST COpy OF THIS FAQ? This FAQ can be found via the World-Wide-Web (WWW) at: http://www.bearhunter.com/-bearhntr/wireless-cable.html Other FAQs can be found at: http://www.cis.ohio-state.edu/hypertexUfaq/useneUFAQ-List.html Disc laimer I have no affiliation with any type of cable or broadcast system . I am definitely not an expert in these areas. I have tried, to the best of my ability, to interpret and relay the most accurate and up to date information . However, I do not guarant ee the accuracy of this information as some of my sources may be biased or incorrect. For additions, clarifications, corre ctions, or if you just have some questions or comments, please feel free to e-mail me. B. J. Catlin . " (:JABEE TEST CHip FAQ ,. ' ' ." . ' ' contin~ed:lrom page 32 ., 4. Double check all work . A mistake in wiring may cause the test device to be damaged, and perhaps the box . Check your work carefully be fo re the box is powered up. 5. Once installed correctly, ifunit fails to work, make sure that it is connected to a signal that is compatible with that of the unit under test. I.E., a Zenith box will not work with a Jerrold type signal. 7. Sometimes the cable box /descrambler itself, is defective. If the box worked before you installed the test chip, and you suspect your installation as faulty, remove and reinstall test chip . 8. To protect pins of test chips which are removed and replaced often, install test chip first into high quality socket. 9. Test chips, typically, will allow reception of all channels that the box is capable of receiving. This means that PPV or Premium channels mayor may not be enabled for testing. Sometimes a second outboard descrambler, using a different scrambling method is required . Some test chips will reprogram the apparent locations of some or all channels. The box will still decode all channels, however, they may not all be in sequence. This is not a problem, it's just the way the test chip works . 10. If the box still does not operate, you must now determine whether (I) the box is at fault (2) the test chip or module is at fault (3) you have done a bad job of installing or (4) a combination of (l) through (3). If the box operates on all but a few premium channels, the cable company may be using a di fferent descrambler to decode those channels. If this is the case, the installation is OK and the test chip is operating correctly. If not, then remove the test chip and return the box to its original condition. You may have to bridge cuts made on the PCB or re-install jumpers, etc. The easy way to do this is to follow the installation instructions for installing the chip, only do it in reverse. Start at the end of the instructions and remove instead of installing, uncut instead of cut etc. 11. Once box is returned to original condition, connect cable company cable TV, and power-up box. The box should operate as normal. I.E., you should be able to receive some sort of programming. If nothing happens, double check the work you just performed. If the box has been returned to normal condition, it should work same as it did before you began work. If it does not, the box may be defective, Or YO U may not have programming going into the box . If the box received channels before the installation of the test chip, but does not work now, you either have not returned the box to original operating condition or have damaged the box during the initial installation. If you have incorrectly installed the test chip or module the first time, you may have damaged either the box or the test chip I module or both . 12. Ifbox works normally now, i.e., receives some channels, the box is OK. Now follow the instructions to the letter, and reinstall the test ch ip or module. Be sure to follow the instructions exactly. The majority of installation problems can be traced to improper installation. Very rarely, the chip or module will be bad . 13. If after re-installing the chip I module in a working box, it STILL does not work, contact us for return authorization to replace the mod ule or chip. We have the facilities to check the chip or module. If the chip or module is defective from manufacture, we will repair, repr og ram or replace it at NO CHARGE to you. This information was taken directly from Te/ecode webpage with permission to do so. Te/ecode sells all sorts of useful hacking material. Please take the time to check them out: TELECODE PO BOX 6426, YUMA AZ 85366-6426 (520) 726-2833 http://www .hackerscatalog.com/index.htm THUD Volume 1 Issue 1 • Spring 1998 49 THUD Magazine Presents "OhMyGoD" Acronyms A-B ?A Action field contains an error CSU Advanced T -1 channel service unit ?D Data field contains an error CT AC testing definition ?E Error exist in message but cannot be resolved to the proper field CT AC Testing definition ?I Identification field contains an error CT Activate ?T Time-out has occured on channel CT Active ?W Warning message CT Auto or automatic circuit transactions 15S Fifteen seconds CTS Automated coin toll service 1CF Singal party coin first pay phone CTV Acticated 1FAC Interface packs CTVD Activated 1FB One party flat business rate CU Alarm control un it 10F One party official (telco) business line CU Automatic calling unit 2SPDT Partial dial timeout in the 2nd stage of traditional 2stage international o Attendant INTERfTRA blocal 1-26 2SPST Permanent sig.timeout in 2nd stage of traditional 2stage international DAP Audix data acquisition package 2SVCA Vacant code in 2nd stage of traditional 2stage international outbound DAS Advanced directory assistance system 2W Two wire (pair) (circuit) DC American digital cellular 2WAY Two-way trunk groups DC Analog to digital converter 300 Log command menu (SARTS command) DCCP Advanced data communication controll procedure 376 Log clear (SARTS command) DCCP Advanced data communications control procedure 384 Write log (SARTS command) DCI Automatic display call indicator 385 Read log (SARTS command) DDEXP Address expander 399 Log print (SARTS command) DOL Additional 3KHZ Three kilohertz DDR Address translations 3RNGR Three ringer OJ Ajust 3WO Third wire open OM Add -drop mult iplex 4W Four wire (pair) (circuit) DMA Advanced DMA controller SAB82258 600 Test menu (SARTS command) ON Abbreviated dialing number 600B 600-ohm briged connection DP Automatic diagnostic process. 611 Detail tests (SARTS command) DPCM Adaptive PCM 621 Macro command menu (SARTS command) OS Administration of designed services 631 Automatic test command (SARTS command) OS Administration of designed services review 735T 735-ohm compromise termination OS Advanced digital system A A side (lead) (pair) OS Audio distribution system A Area OS Aux ilary data system A Telephone # or trunk group & member number from trouble DSL Asymmetrical digital subscriber line AlB Two wire phone connection (T&R) DTS Automated digital terminal system AA Automatic answer DTS Automatic data test system AA Packet analog access line INTERfTRA blocal 1-26 DTS Automatic digital terminal system AABS Automatic alternate billing service DU Automatic dialing unit AAE Auxiliary access equipment ERM Alignment error rate monitor AAR Automatic alternate rout ing F Commercial audio fulltime INTERfTRA blocal 1-26 AAX Automated attendant exchange FACTS Automatic facilities test system AB Packet switch trunk INTERfTRA blocal 1-26 FADS Automatic force adjustment data system ABATS Automatic bit access test system FE Analog front end ABATS Automatic bit access test system (DDS serv ice) FI Authority and format identifier (ISO 7498) ABC Automatic bill calling (TSPS) FSC Advanced featu res service center ABF Abandon fa ilure FSK Automatic frequency shift keying ABF Abandon failure (MOil) G/EEE Above ground electronic equipment enclosures ABHC Average busy hour calls GC Automatic gain control ABL Aux iliary Buffer oder word Left half GM Normal aging months ABM Asynchronous balanced mode ( -> SABME) GND Analog ground ABME ABM extended GT Accelerated aging type ABR Auxiliary Buffer order word Right half I Activate indication (C/I channel code) ABS Alternate billing service I Artificial intelligence ABS Alternative billing service I Assigner's initials ABSBH Average busy season busy hour I Automatic identified outward dial ing INTERfTRA blocal 1-26 ABT Abort IC Automatic intercept center I ABV Above ICC Automatic intercept commun ications controller AC Administrative computer IN Advanced intelligent network AC Alternating current 100 Automatic id of outward dialing AC Assembly code 100 Automatic identifaction of outward dialing ACA Asynchronous communication adapter IS Alarm indication signal ACB Annoyance call bureau IS Alarm indication signals ACB Automatic call-back IS Automatic intercept system ACC Audio communications controller IT Analit initialization of tables ACCS Automated calling card service IU AI upstream ACD Automatic call distribution L Alternate services INTERfTRA blocal 1-26 ACD Automatic call distributor LATS Automatic loop access system system (DDS service) ACDA Automatic call disposition analyzer LBO Automatic line buildout ACDN Access directory number LE Address latch enable ACDN Access Directory Number LE Automatic line evaluation ACE Assignment change establish LFE Analog line front end ACE Automatic calling equipment LGOL Algorhythmic computer language ACES Aris cabs entry system LI Automatic location indentification ACF Advanced communications functions LIT Automatic line insulation testing ACFA Advanced CMOS frame aligner peb2030 LL All eve nts ACG Automatic call gap LL All module controller maintenance interrupts ACH Attempt per circuit per hour LL Turns on all IDs ACI Answer controller interface (10M2 monitor command) LPT Alarm scan points ACIA Asynchronous communications interface adapter LRM Alarms ACK Acknowledge LRU Automatic line record update ACK No acknowledgement wink LS Automated list service ACK No acknowledgement wink (MOil) M Administrative module ACKDB Acknowledgement database M Amplitude modulation ACM Address complete msg . (SS7: in ISUP) M Asynchronous multiplexer ACOF Attendant control of facilities M Packet ACP Action po int MA Automatic Message Accounting ACSE Association control service element MA Automatic message accounting ACSNET Acedemic computing services network MACS AMA collection system ACSR Automatic customer station rearrangement MAIRR Automatic message accounting irregularity 50 Volume 1 Issue 1 - Spring 1998 THUD AMALOST Lost automat ic message accounting RSB Automatic repair service bureau AMARC AMA recent change RSSI Automatic rought selection screening index AMARC AMA recording center RT Audible ringing tone AMASE AMA standard entry RU Activation request upstream AMAT Automatic message accounting transm itter RU Audio response unit AMATPS Automatic message accounting teleprocessing system SAP As soon as possible AMATPS Automatic message accounting transmitter teleprocessing sys SC Alarm and status circu it AMC Add-on module connector (-> sipb) SC Alarm and status circuit. AMERITECH American information technologies SC Alarm surveillance and control AMI Alternate mark inversion code SCC2 Advanced serial communication controller AML Automatic maintenance limit. SCII American standard code for information interchange AMP Advance measurement processor SCII American standard code for information interexchange AMP Amplifier SO Automated SMAS diagnostics AMPS Advanced mobile phone service SOPE Synchronous data link controller (SOLC) A reset AMR Automatic meter reading SE Applicat ion service element AMWI Act ive message waiting indicator SEC Assignment section AN Announcement service INTERfTRA blocal 1-26 SGN Assign AN Associated number SGNMTS Assignments ANA Automatic number announcement SIC Application specific integrated circuit ANC All number calling SM Analog subscriber module ANCT Analysis control table SOC Administrative service oversight center ANI Automatic number identification SP Advanced service platform ANIF Automatic number identification failure SP Arcofi signal processor ANM Answer msg. (SS7 : in ISUP) SPACGCOMP ASP SCP response message with an ACG component ANS Answer received at the switch ANS Answer msg . SPBAORESP ASP SCP response message received with invalid data ANS Answer On Bus SPEN Automatic system for performance evaluation of the network ANSER AT&T Network Servicing System (i.e. via EAOAS link) SPNORTEMSG ASP reject message ret err and a play announc received at ANSI American national standards institute the switch from the SCP AO Allocation order SPSNCOMP ASP SCP response message with a send notifi AO International/overseas audio (full time) INTERfTRA blocal1-26 component received at the switch AOC Advice of charge (i.256 B) ASP termination notification message sent from the switch to AOSS Auxilliary operator service system the SCP AP-PG Access point page Access service request AP Access point Assignment AP Application (OSI layer 7) Posit ion acknowledge seizu re signal time-out (MOil) AP Application processor Asynchronous AP Attached processor Auto test-1 AP Auciliary processor Auto test-2 AP Automatic position Access tandem AP Commercial audio (part time) INTERfTRA blocal1-26 International/overseas audio (part time) INTERfTRA blocal 1- APC Alarm processor circuit 26 APC Amarc protocol converter T&T American telephone and telegraph APO Access point data T01 Results of trunk test - 1AESS automat ic trunk test APO Avalanche photo diode TA Automatic trunk analysis APOB Access point data base TAB Area trunk assignment bureau APOL Application processor data link TAl Automatic troubler analysis interface APH Application protocol handle r TB All Trunks Busy API Application interface TB All trunks busy APM Application processor modules TC Automated testing control APPC Advanced program to program communication (IBM) TC Automatic transmission con trol APPL 1-APPL5 Reserved for application handlers TO Accept date APS Automa tic position system TO Async. TOM APS Automatic protect ion switch TH Abbrev iated trouble history APS Automatic protection switching system TI Automatic test inhibit AQ Autoquote problem . TI Awake TI AR Activation request (CII channel code) TICS Automated toll integrity checking system AR Alarm report TIS Automatic transmitter identification system AR01 Office alarm - 1AESS alarm message TM Analog trunk module AR02 Alarm retired or transferred - 1AESS alarm message TM Asynchronous transfer mode AR03 Fuse blown - 1AESS alarm message TM Automatic teller machine AR04 Unknown alarm scan point activated - 1AESS alarm message TMS Automated trunk measurement system AR05 Commercial power failure - 1AESS alarm message TN Assigner's telephone number AR06 Switch room alarm via alarm grid - 1AESS alarm message TO Time-out waiting for address complete signal AR07 Power plant alarm - 1AESS alarm message TP All tests pass AR08 Alarm circuit battery loss - 1AESS alarm message TR Alternate trunk routing AR09 AMA bus fuse blown - 1AESS alarm message TRS Automated trouble reporting system AR10 Alarm configuration has been changed (retired inhibited) TIC Automatic transmission test and control circuit AR11 Power converter trouble - 1AESS alarm message TICOM AT&T communications AR13 Carrier group alarm - 1AESS alarm message TIG Attendant group AR15 Hourly report on building&power alarms -1AESS alarm message TIIS AT&T information system ARA Automatic reservat ion adjustment U Access unit ARC Administrat ive responsibility code U Autoscript INTERfTRA blocal 1-26 ARC Alternate route cancellat ion U Auxiliary ARC Alternate route cancellation control UO Assignment list audit ARC Audio response controller UO Audits ARCOFI-SP ARCOFI + speakerphone function UOIT Audit detected problem. ARCOFI Audio ringing codec filter UOIX Audio information exchange ARCOS ARCOFI coefficient support program UP Access unit port ARCOTI SIPB telephone module UTO Automaitc ARO AR downstream UTOOIN Automatic digital network ARG Alarm reference guide UTOSEVCOM Automatic secure voice communications ARG Assemble and run a given master file UTOVON Automatic voice network ARIS Audichron recorded information system UXF Auxiliary frame ARL Activation request local loop (C/I channel code) VO Alternate voice-data ARM Activation request maintenance (C/I channel code) VO Alternate voice data ARM Asynchronous response mode WI Awake indication ARM Automatic R(emote test system) maintance o All zeros data ARMAR Automat ic request for manual assistance resolution B B side (pair) (lead) ARN Activation request B Bridged connection ARQ Automat ic repeat request B Equipment number ARR Automatic ring recovery. B6ZS Bipolar with 6 zero subsitution ARS Alternate route selection B8ZS Bipolar eight zero suppression encoding (OS-1) ARS Automatic route selection B8ZS Bipolar with 8 zeros substitution (T1 pri) ARSB Automated repair service bureau B911 Basic 911 THUD Volume 1 Issue 1 • Spring 1998 51 BA Basic access BNSNBLK BVA BNS message returned because of network blockage BA Protective alarm (CD) INTERffRA blocal 1-26 BNSNCO BVA BNS message returned because of network congestion BAF Blocking acknowledgment failure N BVA BNS message returned because of no routing data BAI Bridge lifter assignment inquiry BNSNRTE BVA BNS message returned because of timeout BAL Balance BNSTOUT BVA BNS message returned because of unequippeddestination BAMAF Bellcore AMA format BNSUNE BVA BNS message received with an unexpected reply BANCS Bell administrative network communications system Q Business name x (x =number of line) BANKS Bell adminastration network systems BNSURPYBell operating companies BAPCO Bellsouth advert ising & publishing company BNx Bell operating company BAS Basic activity subset BOC Building operations control center BAT Battery (-48v) BOC Byte oriented protocol BAx Business address x (x =number of line) BOCC Basic output report BB Blue box BOP Battery BBDO/1 Binary Os or 1s detected in band d channels BaR Bit oriented signaling BCC Bellcore client companies BORSCH Business office supervisor BCC Block check character T Billing and order support system BCC Blocked call cleared BaS Business office service system (NYNEX) BCCP Bearer ccp BaS Beginning of tape BCD Binary coded decimal BOSS Bottom BCD Blocked call delayed BOSS Bits per inch BCFE Busy call forwarding extened BOT Bell point of contact BCID Business customer identifier BOT Bits per second BCLID Bulk calling line identification BPI Binary psk BCMS Basic call management system BPOC Basic packet-switching service BCS Batch change supplement (NTI) (DMS-100) BPS Backup pump BOCA Unk BPSK Bit robbing (CAS-BR) BDCS Broadband digital cross-connect system BPSS Business residence account tracking system BDS Basic data service BPUMP Business and residential customer service feature BOT Billing data transmitter BR Business and residential customer services BEF Band elimination filter BRAT Business residence custom service BEL Bell BRCF Broadcase BELLCOREBell communications research BRCS Bridge BER Bit error rate BRCS Bridged BERT Bit error rate test BRDCST Brevity control BETRS Basic exchange telecommunications radio service BRDG Baud rate generator BG Battery and ground signaling BRDGD Basic rate interface BG/EEE Below ground electronic equipment enclosures BREVC Basic rate interface transmission extension (5ESS) BHC Busy hour call BRG Break BHC Busy hour calls BRI Basic remote module BIB Backward indicator bit (SS7) BRITE Bell communications research practice BICU Bus interface contro l unit BRK Bridge signature table BIFIFO Bidirectional fifo BRM Backspace BIR Bit receiver BRM Banded signaling BIR Bus interface register BRST Bias battery (-19 .1v) BISON Broadband ISDN BS Siren control INTERffRA blocal 1-26 BISP Business information system program BS Basic serving arrangements BISYNC Binary synchronous communications BS Busy season busy hour BIT Bit BS Business service center BIT Bit transmitter BSA Business/residence service center BITNET Because-it's-time network BSBH Bisynchronous communications module BITR Bit transceiver BSC SDLC B reset BIX Building internal cross -connects BSC/RSC Basic service elements BK Back BSCM Bell shock force BKUP Backup BSDPE British standards institution BKUP Requests a backup BSE Backward sequence number (SS7) Bl Bell & lights INTERffRA blocal 1-26 BSF Bell systems operating company Bl Bridge lifter BSI Bell system practice BL Bridge lifters - COSMOS command BSN Basic standard reference frequency BLIDS Busy line/don 't answer BSOC Bell system reference frequency standard BlA Blocking acknowledgement (SS7 : in ISUP) BSP Basic services terminal BLF Busy line field BSRF Bell system technical journal BlFCA Blocking a fully coded addressed international outbound call routed BSRFS British telecom to a non-common channel signaling trunk BST Basic telecommunications access message BlK Block BSTJ Both BlKD Blocked BT Bell telephone laboratories BlO Blocking (SS7: in ISUP) BTAM Billing telephone number BlS Bridge lifter status BTH Bootstrapper board BLS Business listing service BTL British thermal unit BLV Busy line verification BTN System buffers (NTI) BMC Billing media coverage BTSR Billing validation application BMD Batch mode display BTU Billing verification and authorization for payment process BMI Batch mode input - TIMEREL and DEMAND BUFF Billing validation center BMOSS Building maintance operations service system BVA Basic voice service BMR Batch mode release BVAPP Broadcast warning message BMU Basic measurement unit (dip) BVC Broadcast warning twx BND Band number BVS Bandwidth test set BNS Billed number screening BWM Display the bypass file BNSDBOV BVA BNS message received indicating data base overload BWT Change the contents of the bypass file BNSDBUN BVA BNS message returned because data base unable to BWTS Commercial-automatic call distributor (aSPS) process BYF C-notch BNSGMSG BVA BNS message received garbled BYP Counting rate 52 Volume 1 Issue 1 • Spring 1998 THUD by Oxygene Here's a list of web sites deal ing with pirate radio , ham , amateur, manufacturers , suppliers , resources and anythin g else that has to do with pirate radio. Enjoy. ftp://dg-rt p.dg.com/fm 10 http ://users .aol .com/amn92/amn.htm FM-10 FTP Site Free Radio site from Connecticut with plans etc . Micropower f t p : 1/ f t P . u n i - pad e r b 0 r n . del F A a 1 a It . r a d i 0 . P ira tel broadcasting movement. Mark's micropower broadcasting movement Low_Po wer_B roadc astin g_FAa page . Micropowe r Broadc asting Movement. Low Power Broadcasting FAa http://users.aol.com/amn92/radio .htm ftp://netacs ys .com/pub/micro_radio Amplifiers for Pirate Radio . AND Freedom of the airwaves! Micro Radio FTP Site http ://users .aol.com/hldalis2/HOMEPAGE/home.html http ://206 .130 .20 .3 :80/-gle n/ H L Dalis - Parts and Equipment Supplier. Gle n's Pirate Radio Site . http ://users .aol.com/Net1fm /index .htm http://burn.ucsd .edu/-blr/ MORE Pirate Radio kits. Black Liberation Radio! http://vanbc.wimsey.coml rkozinuk/manual.html http://clandjop .com/- jc ruzan/frn .html Pirate radio Web pages! The Free Radio Network Info, pictures & audio clips . http ://w3 .one .neV-folklfrw.htm http://comm-data .com FREE RADIO WEEKLY on-line magazine . Communications Data Services, Inc - Broadcast & Communications http ://world .std.com/-maddawg/optimark.html Softwa re & Data Supplier. Optimark - Fiber Optic Components & Transmission Systems . http ://cust.iam erica .neVdwhowell/wavemach.html http://www-pp .hogia .neVjonny/pcl Wavemach Communications - transmitters, amps , etc . PIRATE MAGAZINE costs $$$ . Steph an Printz 's Swedish Pirate Site. http://cust.iamerica.neVdwhowelllomnij.htm http ://www-pp.kdt.neVjonny/index.html Antennas for pirates by John Lentz . A U.K. Pirate Web Site . SRS (The Swed ish Report Service) European http://deepthought.armory .com/- airbrick/frsc.html Pirate DX-ers Extensive logs (The Best European Pirate Rad io Site! !). Aa ron's Free Radio Santa Cruz Page! http://www .0171 .com http ://elektron.et.tudelft.nl/- stern/pulsar/scheme.htm Stuart Kidd's REAL AUDIO "Pirate Stat ion" on the WEB live broadcasts Diagrams etc for BA1404 transmitters , Linears and other stuff . Dutch WED & THU evenings from London . FM transmitter schematics on -line . http ://wwwAzzzfm .org .au/ http ://gwis2.circ.gwu.edu/- gringo/ AUSTRALIAN PIRATE RADIO SITE . Clandestine Rad io International. http ://www .abekas .com/ http://home.pi.neV- freak55/home.html Abekas - Furniture and equipment. FRSH Radio , Netherlands A Dutch pira te station . http://www .abg.coml http://home.pi.neV- trans/HOME.HTM Audio Broadcast Group - Broadcast Equipment Supplier. Harry 's pirate radio web site . Transatlantic radio Europ irates . http ://www.access.digex.neV-cps/ http://home.pi.neVusers/- freak55/home.html Chris Smolinski's SW/P irate/numbers Radio info page! Joop Ter Zee : Free Radio New from the Netherlands . http ://www .access.digex.neV- cps/pirate.html http ://homes .cls .neV-msievers/pirate/pirate.htm Free Radio Stations Pirate INFO . Martin's Pirate Site in Kiel Germany . http ://www .aceinfo .com/bbh/info http ://http ://tide1 .eventide.com/ BBH Software - Specializes in Media Addresses and Databases . Eventide - Audio Processors . http ://www .adc .com http://indigo.ie/- cruze AD C - ADC Telecommun ications - More than Patch Bays. Anoraks Anonymous : interesting FM band pirate rad io news . http ://www .adtnet.com/ http ://involved .com/ewolfe/index2.htm AID Technologies, Inc. - Technical Services & RF Systems. Burton Jame s of 102.1 FM Pirate & Patriot gove rnment consp iracy http://www .airwaves.com/fccdb.html page 2. Pirate radio Web pages! http://IOpht.com/- hotrod/frb.txt http ://www .alpcom .iVhamradio/freewaves Radio Free Berkeley Italian pirate radio freewave . http ://mcradio.com http ://www .ams-neve .com McCurdy - Hard Disk Audio , Metering and Audio Mon itoring. Seimans Aud io - Aud io Equipmen t. http ://members.aol.com/abfffr/index.htm http ://www .andrew .com Pirate address list , infos , DJs etc . Achim 's Free Radio Disaster. Andrew Corporation - Coax , Antennas & Accessories . http ://members.aol.com/wattsupmpr http ://www .angelfire .com/ma/wmbg/wmbg .html Los Angeles Free Radio Conference 6/97 . WATTS UP! - a pirate WMBG magazine. http://www .azstarnet .com/-dwahl http://members .aol.com /y ae suto m The Virtual Pirate Band TRY IT! Tom's Pirate Page . hltp:llwww .azstarnet.com/-dwahl/index.html http ://members.cruzio.com/-frsc/frscpage Var ious Pirate stations: Laryngitis, Confusion etc . Free Radio Santa Cruz!! http://www .beatworld .com http://members .cruzio .com/-roguel Pirate station in Minneapolis . Micro Radio, a history & a case study of Free Radio Berkeley. http://www .broadcast-warehouse .com http ://members.tripod.com/- wlmd Broadcast Warehouse Fm transm itters and products . A pirate radio station in Pittsburgh, PA. WMLD Rad io Pittsburgh , PA http ://www .broadcast.harris .com with 50 watts on 99 .1 FM . Harris/All ied Broadcast Division - Equipment Manufactu rer . http://metro .metro .mu.eduIWTPS/ http://www .broadcast.net WTPS PIRATE RAD IO. Broadcast.Net (BNet ) - Shopp ing Mall of Broadcast Equipment. http://new s.zippo.com/news-bin/www news?alt.radio.pirate http ://www .broadcast.neVbsc/onestep .html alt.radio.pirate via www news . One-Step - Coaxial Cable Leak Repa ir. http ://nighthawk.reichel .neVpatrioVdawn/ http://www .broadcast.neVjamprol Burton James of 102.1 FM Pirate & Patriot governmen t conspiracy Jampro Antennas - FM and TV Antennas . page s! http://www .broadcast.neVlogiteki http ://ourwo rld.compuserve .com/homepages/SLewis2/ Logitek Systems , Inc. - Digi tal Audio Meters , Amplifiers & consoles Stephen Lewis's Pirate Radio Page . http ://www .broadcast.neVorban http://ourworld .compuserve.com/homepages/sosoft Orban - Audio Processing . SOSO FT - ISDN Remote Talkba ck & Control Software . http ://www .broadcast.neVphaseteki http://ourworld.compuserve.com/homepages/tels tar90 1 Phasetek - AM Phasors and Anten na Systems Components. Telstar Radio FRCG . http ://www.bssaudio.co.uk http ://pages .prodigy.com/RFAmerica BSS Audio - Pro Audio Signal Process ing & Distr ibution Equ ipment. NLNR 102.1 FM American micro -broadcaster. http://www .ccaelectronics.com http ://pine .shu.ac .ukl - sejones/piratesl CCA Electron ics Broadcast Transm itter manufacturer . Latest UK & London pirate radio listings . List of all the lates t pirate radio http://www.chubs.demon .co.uk in Lond on . Radio World . Radio World - A British radio related page http://pirateradio.miningco.coml http ://www.clandjop.com/-jcruzan/greek-p .html Pirate Radio at The Mining Company J. Cruz an mirror for greek pirate radio . http://radiolink.neVkissfm http ://www.comrex .com/ Kiss 101.9 FM in Valdosta Georgia . Comrex - Equipment Manu facture r. http ://u se rs .aol.co m/am n9 2/ http://www .comnet.nl/-freestyle AM - FM Broadcasting Technology information , circuits with RealAudio . Freestyle FM (pirate radio from Delft, Holland) . THUD Volume 1 Issue 1 - Spring 1998 53 http://www.cris .com/-squesValt-tv-pirate/index.html http://www.guernsey.neV-bebridel/ Pirate Radio Newsgroup archives. Pirate Radio of the Offshore Kind . http://www.crtsystems .com http ://www .halcyon .comlrbds Circuit Research Labs - Audio Processing, RBDS . Smart Radio Store - RBDS Receiving Equipment. Smart Radio Store - http ://www.csos.orst .edu/-kenneke/rfccat.html RBDS Receiving Equipment. RF Consulting Catalog http ://www .halls .com http ://www .cybertron.com/-comcents/mhr/mhrgr/515.jpg Hall Electronics - Digital, Pro Audio & RF Equipment. Transmitter Plans on -line. http://www.hauraki.xtra .co .nz http ://www.decade.ca The Amazing History of Pirate Radio in New Zealand! The Decade Company A new Canadian company that sells , very http://www.hookup.com/bdst.html expensive FM transmitters(starting at $900) . Cool Site though!! Carpenter & Associates - Broadcast Equipment Leasing . http ://www.digiface.nll-smc/ http://www.hp.com Stichting Media Communicatie . Hewlett - Packard - Manufacturer. http ://www .directnet.com/-vasgroup http ://www .i-way .co.ukl-stunova/kickfm.htm VAS . Group - Scan Converters - Animation Controllers . KICK-FM Radio Station . http://www.dma.be/p/amphion/sztuka/marabu.html htlp://www.imagevideo.com Radio Marabu . Image Video - Manufacturer of Routing Switchers & Master Control http://www.dolby .com Switchers . Dolby Labs· Dolby Equipment Web Site. http://www.imagineV-rwaves/index .htm http ://www .dungeon .com/-starVrds.html RADIO WAVES INTERNATIONAL new updated URL. Radio Data Systems (RDS) - RBDS Equipment Suppl ier . http ://www .infi .neV-jlridge http ://www .durhamradio.ca/ramsey .html Audio Concepts and Engineering - Technical Broadcast Consulting. Durham Radio Sales & Service Low power FM Transmitters! Canada's http ://www .internet-ireland .ie/xfm/ largest Ramsey Dealer! Xfm , Pirate radio in Dublin Ireland . http://www.ecn .bgu .edu/users/bsngd/fmradio.html http ://www.intertype.co.ukldesign/talk Low Power FM Broadcasting PIRATE RADIO DESIGN? not sure! http://www.ECNet.NeVusers/bsngd/fmradio.html http://www.io .org/-dixon This is a low power broadcasting page with some pictures . part lists and Dixon Systems - Manufacturer & Services Supplier. other helpful items . http ://www .itc-net.com http ://www .ecsintl .com/ecs International Tapetronics - International Tapetronics Corporation (ITC) . Energy Control Systems - Power Quality Equipment. http ://www .jagunet.com/-kodis/station.html http ://www .edx.com Broadcast Station Locator. E 0 X Engineering - Broadcast Engineering Software Demos & http://www.jvc -us .com Databases. J V C - Commercial Video Products . http ://www .electrotex .com http ://www .kcuf .org/radio/ Electrotex - SBE Internet Provider/Electronic Parts Supplier. KCUF Extreme Death Metal (oh well ..). http ://www .euphonix .com http ://www .kfjc.org Euphonix - Audio Mixing Consoles . Psych Rock info page!! http ://www .exactweb.com/RSMI http ://www .kode .neVmeret RADIO SAN MARINO INTERNATIONAL. MereVDynair - Optical Transmission Products. http ://www .exit109.com/-jimh/radio.shtml http ://www .ldbrewer.com Jim's Radio Room - Tubes & hi-power BC transmitting LARGE graphics L.D. Brewer's Pirate pages . http ://www.ezlink.coml-meclpirateradio/ http ://www.ldbrewer.com/pirate.html The #PirateRadio home page, the Pirate Radio IRC channel. Pirate xmtr kits . Tampa Pirate Radio , 102.1 FM . This Guy Rules! http://www.faqs .org/faqslradio/broadcasting/low-power-faq/ http://www.legend.co.uk/-veronica/ Another Low Power Broadcasting FAQ Page . VERONICA FM transmitter kits 5 watts of pirate delight ! http ://www .fcc .gov/mmb/asd/lowpwr.html http ://www.leitch.com FCC Information about low power radio . Leitch - Equipment Manufacturer. http ://www .fni .com/-rice/bi/bi.html http://www.lls.se/-jal/ Broadcast Systems - Broadcast Equipment Distributor. The Swedish Report Service . This page contains QSL info. pirate links, http ://www .freeradio.org sounds and other fabulous items that must be seen to be believed . FREE RADIO pirate radio site . The Free Radio Berkeley Home Page . hllp ://www .lls.se/jal/pc http ://www .freespeech.org/html/free_rad io_berkeley.html Pirate Connection Maga zine . The Free Radio Berkeley page at Free Speech TV . htlp ://www.mediadesign.net http://www.freezywater.u-net.com Kind Micro Radio. with Internet Audio feed . DUNCAN's: Audio from Londons stations of the past. Radio Caroline http://www.mediadesign.neVkindmenu.htm etc. photos too! Micro Kind Radio 105 .9 FM San Marcos, TX They've got a constant http ://www .frn.net netcast going on !!! Free Radio Network. SW Pirate radio aud io , info & chat! An incredible http ://www .mgnonl ine.com wealth of information . Check it out! MGN Online - Media Graphics & Photo Database . http ://www.frn.neVace/ http ://www .mnet.fr/onda.caliente/ ACE Clandestine Radio site . Onda Caliente A shortwave pirate station from France that transmills http ://www .frn.neVgrapevine/chat2/chat.html on Sunday mornings. Onda Caliente Home page of a French SW Pirate Pirate Chat Room - Real time chats, give it a try . http ://www .mnsinc .com/bry//ham/fm15watt.htm http ://www .frn .neVrfi A practical 15 watt FM amplifier you can build (for VHF-FM broadcast or Andrew Yoder's RADIO FREE INTERNET. the 144 MHz ham band). http://www.fused .comlwww/xbones.html http://www.mnsinc.comlbry/mega/xtals.htm The Modern Day 1990s London Pirate FM scene. Suppliers of crystals for your (Medium Wave) AM band transmitter. http ://www .geocities .com/-garfield25/pirate.html http ://www .mnsinc .comlbry/mine/fcc_care.txt INFO from Radio World magazine! Does the FCC still care? Some comments! (works now!!) http://www.geocities.com/Athens/5383/lowpower.html http ://www .mnsinc.comlbry/mine/pirate .fun Low Power Broadcasting FAQ Page . A 14 year-old has fun with Free Radio! http://www.geocities.com/Broadway/1122/ http://www.mnsinc.comlbry/piralynx .htm -=Channel 61 =- The best of pirate radio and TV. Bry's Pirate Radio links - A huge selection of links Pirate Radio linkss, http ://www .geocities.com/CapeCanaveraI/2594/geo-pir.html quite a few links to quite a. few sites. Martin's pirate radio address list. etc . hltp ://www .mnsinc .comJbrylradio/1 pirate .txt http://www.geocities.com/capecanaveral/6702 A history of UK Pirate Radio . John Harper's FM Free Radio site . John Harper's Pirate FM radio site . http://www.mnsinc .comJbrylradio/2pirate.txt http://www.geocities.com/CapeCanaveraI/9885/ The history of a U.K. Pirate Radio D.J. KIWI Radio New Zealand's most prolific pirate station http://www.nmsinc.comlbry/radio/arc5.txt http ://www.geocities.comlCapitoIHill/Lobby/2395/ INFO about ARC5 SW transmitters from WW2 which can be converted The Pirate Monitor - great page . for Pirate AM (NOT for beginners!) http://www.geocities.comlheartland/hills/3764 http://www.mnsinc.comJbrylradio/pirat2.txt FCC Enforcement comments. NLNR 101 .9 MHz FM in Seattle, WA. Is it Legal? Willi get caught? The FCC and Pirates ! http://www.geocities .comlHollywood/HiIIs/8244 http ://www .mnsinc.comJbrylradio/pirate.txt KISS 102FM in Georgia MY FREE RADIO FAQ my copy available here! http://www.geocities.comlResearchTriangle/Lab/1635/equip.html http://www.mnsinc.comJbry/xtalpage.htm AM transmitter schematics for 550-1700 kHz band! Buy and sell crystals for your (Medium Wave) AM band transmitter. http ://www .geocities.com/SunsetStriplPalms/3840/icon_com.gif http://www.mole.com FRHC - Free Radio Hell's Canyon Mole/Richardson - lighting, Grip & Camera Supplies. http://www.GeoCities.conllSunsetStriplPalmsI9377 http://www.monitor.neV-mycal/mpr/default.html KPRT Pirate Radio . Mycal 's Micro Radio Page excellent: starting your own FM Pirate Radio http://www.geocities .comlWestHollywood/6507/pirate.html station. John Benjamin's Pirate Radio news . http://www.nashville.coml-monte.carroll/mbc.html http://www.glowbug.comledge/edge.html Monte Carroll: Nashville, TN pirate radio fan. The Edge - 91 .9 FM in Kansas 54 Volume 1 lssue 1 - Spring 1998 THUD http://www.netcom.com/-adscapes/new.html http ://www.speedline.ca/-glen/ Pirate radio Web pages! Glen's Pirate Radio Site. Glen's Pirate Radio Site. http://www.netwrx.neVbsi http ://www.summitmedia .com/hitech/ Broadcast Software International - Digital Studio and Other Broadcast Hi-Tech Enterprises, Inc - Dealers of used/new broadcast video eqpt. Related Software . http://www .surf.com/-graharn/ http://www.northcountryradio .com Legal Briefs filed in the Stephen Dunifer "Pirate" case . Pirate supplies from North Country . http://www.svetlana.com http://www.npsnet.com/leblanc/ Svetlana - Tubes. LeBlanc - Supplier. http ://www.swt .edu/SunsetStrip/Lounge/8311 http://www .omen.com The Dissent Show . Radio Free Moscow http://www .tek.com http://www.panasonic.com Tektron ix - Product Information. Panasonic - Products Division. http://www .teleport .com/-mmarcus/AMINFO/AM_lnfo.html http://www .paranoia .com/-filipg A less expensive route to AM transmitting! Latest update to the FREE RADIO FAQ, IF he is still doing it! http://www.teleport .com/-mmarcus/crrsw.html http://www.paranoia .com/-filipg/HTMULlNKlF_FM10.html Columbia River Radio Shortwave - 13560 kHz (22 Meter Band) . Ramsey FM10FAQ http://www.theoffice.neVbarbier http://www.paranoia .com/-filipg/HTMULlNKlF_FM10_more.html Reinier de Barbier's FREE-RADIO-FADING site (Dutch FM pirate w/ A great guide to transmitter kits. FAQ: Low Power FM Broadcast photos) . transmitters. Low Power Transm itter Kit Sources FAQ http://www.threethirtysix.org/pirate/ http://www .phlat.com/bk .shtml Media Pirate's Network Media Pirates Network . The Media Pirates PORTAL63 - Coming Soon : FM and SW transmitter Schematics . Network! http://www .pi.neV-freak55/home.html http://www.thud.org/mutiny.htm Pirates & more! PIRATE RADIO is alive! Radio Mutiny in Philadelphia . http://www.powergold .com http://www .tiac.neVusers/jcrose/zeplist.html Powergold - Music Scheduling Software. Zephyr - Audio Codec Manufacturer. http://www .pp.hogia .neVjonny/fr/kiwi .html http://www .tip.nl/users/henk.leppers/ History of KIWI Radio Henk Leppers Pirate Mediapage. http ://www.pp.hogia .neVjonny/index.html http://www.toshiba .com SRS The Swedish Report Service Toshiba - Equipment Manufacturer. http://www .proaudio .com/ http://www.tucker.com/ Crouse-Kimzey Company - Equipment Supplier. Tucker Electronics - New and Used Test Equipment. http://www.radio-online.com/radioearth http://www .tv36.com/buffalo .html AIRWARE - Showprep Software From Corey Deitz. Radio Newyawk International defunct pirate station . Real Audio clips http://www.radi0101 .de/radi0101/index-e.html soon . Radio Newyork International Famous offshore station . Not much RADIO 101 - a cool Euro-pirate rock station on 27 MHz Shortwave . here, but promises Real audio clips in the future . http://www .radi04all .org http://www .users.dircon.co.uk/- tomgrady/ Radio 4AII This one's packed with the latest info and a wonderous Tom Grady, G61GA's Ham Radio, Scanning & pirate site . collection of links . http://www.v-soft .com http://www.radi0510 .org V-Soft Communications - Doug Vernier AM/FMITV Engineering RADIO 510 International, from Europe . Software. http://www.radioresources .com http://www .vcnet .com/qvi/om i.html Steve Scarborough's Radio Resources , Baltimore, MD Go to Omnicron Video - AudioNideo Duplication Accesso ries . "preowned showroom" http://www.vtpinc.com http://www .rain.org/-dschmidV Videotape Products , Inc. - Broadcast & Ind. Video Equipment Dealer. D. Schmidt (FM pirate gear) Seller of transmitters etc . http://www.webcom .coml-ljvideo http://www.ramseyelectronics .com LJ Video Engineering - Equipment Rental & ; Services . Ramsey Home Page Ramsey Electronics AA-25 transmitter for AM http://www.wenzel .com Broadcast ing. Wenzel Co. Crystal Oscillators & RF modules . http://www.rdrop.com/users/billmc/khog/khog .html http ://www.worldonline .nl/-doublez KHOGBiography A Dutch Pirate station with great links . http://www .reelradio .com/ http://www1.tip .nl/users/t668302/index.html Real Audio On-ai r samples of old TOP40 DeeJays! Radio Free Holland Popular European SW pirate station) cool http://www.rell.com homepage. Richardson Electronics - Tubes and Semiconductors . http://zephyr .com http://www .rfspec .com/ TELOS Systems - ISDN & Telephone interfacing equipment. R F Specialties - Broadcast Equipment Supplier. mailto :sales@belar.com http://www.rfspec .com/crl/mbI100 .htm Belar Electronics Laboratory - Send Mail to Belar - Monitoring Sales page with info about AM BC transmitters . Equipment. http://www.rootsworld.com/rw/feature/rrb.html news :alt.radio .pirate FREE RADIO PRESS: An AWESOME site wlTONS of info! alt.radio .pirate Newsgroup . alt.radio .pirate. You've got questions, http://www.rule.com they've got opinions . Rule Broadcast Systems, Inc. - Equipment Rental. 6.500 MHz "Red Box" Crystals BLOWOUT ECS gUARTZ CRYSTALS HC ·49/US .142~ Q:+=~JJT .78! 1 .197 ~ .0 17 PRICES! S,.c .f ..: .Ii_", ~ fteq .. M., 0,., .li" II In~r.rw:'L AI 'I""P "••ge ::.. 1 ! U ' / tI." • I) n 1IIIIn (til . 1') ''( • l ue llilm 1,, :111 o -r l~: • Ii) -t,; Olive t ..·.I · 1:nW. The crystal used to make the infamous "Red Box" is available now at a reasonable price . These are very small & perfect for limited space applications . We've been selling the $4.00 + $1.00 s/h 6.500MHz crystals for Channel 21 "D.i~J,ey"Filters several years now! This is the very notch filter used to receive The Disney Channel on Paragon Systems in Southern Californ ia. They try to charge $150 for this sucker! Order YOURS TODAY! $20.00 + $2.00 s/h PVS you need Zenith Remotes, we got 'em! If /fyou need those hard to find 6.500MHz Xta/s, we got 'em! P.O. Box 1032 /fyou need channel 21 (Disney) notch filters, we got 'em! Los Alamitos, CA 90720 If you need it, CALL US TODA Y! THUD Volume 1 Issue 1 • Spring 1998 55 On this page are pictures of a few tools and other things we think you may find useful. Above, to the right and left of this text you see a total of 5 pictures . The security sleeve tool is used by the cable company to tighten down 75 ohm F- connectors (and the trap filters) fitted with special "sleeves" that you cannot remove using normal wrenches or pliers. To the left and right of this text you will find the Gilbert tool pictured. The Gilbert tool is a special security tool used to terminate unused ports along the cable line so people cannot simply "plug in" and get free cable. Note how the tool works . To the left, we have a Harris TS-22 linemans test set pictured. It's also known as a beige box , more or less. Pictured on the right, we have two Progressive Electronics tone generators - the 77M (smaller unit) and the 100A (the larger unit) Pictured on the left is what cable TV field techs are equipped with. It's called a "Star Key" tool. This is the sucker that opens up the boxes mounted on the walls (if a padlock is not in use). On the right is a crimper with cable TV type F connectors. 56 Volume 1 Issue 1 - Spring 1998 THUD Cool·Book List . Computer Security Basics Complete Lan Security and Control Author: Deborah Russell and G.T. Gengemi Sr. Author: Peter Davis Publisher : O'Reilly & Associates, Inc. Publisher: Windcrest / McGraw Hill Copyright Date: 1991 Copyright Date: 1994 ISBN: 0-937175-71-4 ISBN : 0-8306-4548-9 and 0-8306-4549-7 This is an excellent book. It gives a broad overview of Network Security computer security without sacrificing detail. A must read for Author: Steven Shaffer and Alan Simon the beginning security expert. Publisher: AP Professional Copyright Date: 1994 Computer Security Management ISBN: 0-12-638010-4 Author: Karen Forcht Publisher : Boyd and Fraser Applied Cryptography: Protocols, Algorithms, and Copyright Date: 1994 Source Code in C ISBN: 0-87835 -881-1 Author: Bruce Schneier Publisher: John Wiley & Sons Information Systems Security Copyright Date: 1994 Author: Philip Fites and Martin Kratz ISBN: 0-471-59756-2 Publisher : Van Nostrad Reinhold Copyright Date: 1993 Bruce Schneier's book replaces all other texts on ISBN: 0-442-00180-0 cryptography. If you are interested in cryptography, this is a must read. This may be the first and last book on Practical Unix Security cryptography you may ever need to buy. Author: Simson Garfinkel and Gene Spafford Publisher : O'Reilly & Associates, Inc. Cryptography and Data Security Copyright Date: 1991 Author: Dorothy Denning ISBN: 0-937175-72-2 Publisher : Addison-Wesley Publishing Co. Copyright Date: 1982 Finally someone with a very firm grasp of Unix system ISBN: 0-201-10150-5 security gets down to writing a book on the subject. Buy this book. Read this book. The Little Black Book of Computer Viruses Author : Mark Ludwig Firewalls and Internet Security Publisher: American Eagle Publications Author: William Cheswick and Steven Bellovin /' Copyright Date: 1990 Publisher: Addison Wesley ISBN : 0-929408-02-0 Copyright Date: 1994' ISBN : 0-201-63357-4 The original, and still the best, book on computer viruses. No media hype here, just good clean technical information. Un ix System Security Author: Rik Farrow Computer Viruses, Artificial Life and Evolution Publisher: Addison Wesley Author : Mark Ludwig Copyright Date: 1991 Publisher: American Eagle Publications ISBN: 0-201-57030-0 Copyright Date: 1993 ISBN: 0-929408-07-1 Unix Security: A Practical Tutorial Author: N. Derek Arnold Computer Viruses, Worms, Data Diddlers, Killer Publisher: McGraw Hill Programs, and Other Copyright Date: 1993 Threats to Your System ISBN: 0-07-002560-6 Author: John McAfee and Colin Haynes Publisher: St. Martin's Press Unix System Security: A Guide for Users and Systems Copyright Date: 1989 Adiministrators ISBN: 0-312-03064 -9 and 0-312-02889-X Author: David A. Curry Publisher: Addison-Wesley The Hacker Crackdown: Law and Disorder on the Copyright Date: 1992 Electronic Frontier ISBN: 0-201-56327-4 Author: Bruce Sterling Publisher : Bantam Books Unix System Security Copyright Date: 1982 Author: Patrick H. Wood and Stephen G. Kochan ISBN : 0-553-56370-X Publisher: Hayden Books Copyright Date: 1985 Bruce Sterling has recently released the book FREE to the ISBN: 0-672-48494-3 net. The book is much easier to read in print form, and the paperback is only $5.99. Either way you read it, Network Security Secrets you will be glad you did. Mr. Sterling is an excellent science Author: David J. Stang and Sylvia Moon fiction author and has brought his talent with words to bear Publisher: IDG Books on the hacking culture. A very enjoyable reading Copyright Date: 1993 experience. ISBN: 1-56884-021-7 Cyberpunk Not a total waste of paper, but definitely not worth the $49.95 Author: Katie Hafner and John Markoff purchase price. The book is a rehash of previously published Publisher: Simon and Schuster information. The only secret we learn from Copyright Date: 1991 reading the book is that Sylvia Moon is a younger woman ISBN: 0-671-77879-X madly in love with the older David Stang. THUD Volume 1 Issue 1 . Spring 1998 57 The Cuckoo's Egg The Day The Phones Stopped Author: Cliff Stoll Author: Leonard Lee Publisher: Simon and Schuster Publisher: Primus I Donald I Fine. Inc. Copyright Date: 1989 Copyright Date: 1992 ISBN: 0-671-72688-9 ISBN: 1-55611-286-6 Hackers: Heroes of the Computer Revolution Total garbage. Paranoid delusions of a lunatic . Less factual Author: Steven Levy data that an average issue of the Enquirer . Publisher: Doubleday Copyright Date: 1984 Information Warfare ISBN: 0-440-13495-6 Author : Winn Swartau Publisher: Thunder Mountain Press Secrets of a Super Hacker Copyright Date: 1994 Author: The Knightmare ISBN: 1-56025-080-1 Publisher: Loompanics Copyright Date: 1994 ISBN: 1-55950-106-5 HACK The Knightmare is no super hacker. There is little or no real information in this book. The Knightmare gives useful advice like telling you not to dress up before going "T HE trashing. The Knightmare's best hack is fooling Loompanics into publishing this garbage. WORLD·,' So, you have some piece of equipment you Regular 000Phillips Hex Security Hex want to open up, but you have no idea what the hell that little fastener is? There are all sorts of oddball screws (screw balls?) out there and here's a sample of some of them. o Use the Regular and Phillips diagrams to get an idea of how the diagrams work for 00 the rest of the screw/bit types you're unfamiliar with. The white part of each diagram is where the bit fits into the screw. The Black portion of the diagram is Torx Secu rity Scrulox/ Security the base of the screw that the bit is Torx Robertson Scrulox surrounded by when the bit is inserted. It'll make sense after awhile. Often, you will find Spanner screws used to hold wall plates in place at schools... primarily in bathrooms. Internal Security External Spline You will find Security Torx screws used in Line Head Line Head Line Head all the ST-1600 thru ST-2500 cable boxes. External line head screws are really unusual. Or are they? Check out Super Nintendo, Nintendo 64, Gameboy, Pocket Gameboy, SNES Carts, N64 Carts, Gameboy Carts, Sega Genesis, etc, etc Mostly, if not entirely, Japanese made Spanner Spanner Torq-set Posidrive home video game systems. Do you want some of these? Do you need some of these? It'd be a good idea to stock up just to have them handy in case you do happen to need them some day . Find them at the following locations: Jensen Tools, Inc. Parts Express (800)426-1194 (800)338-0531 http://www.jensentools.com http://www.parts-express.com/ Tri-wing 58 Volume 1 Issue 1 - Spring 1998 THUD Electronics & Computers Surplus City EIO is a versatile electronics surplus source associating information with the distribution of electronics, computer and optical materials. We have implemented interactive via e-mail, technical forums on Liquid Crystal Displays, Charge Couple Devices, Stepper Motors, Lasers, Laser Light Shows, Microcon trollers, Holography, Fiber Optics, Electro-Optics and ECSC Products with many more forums to come. We boldly supply links to competitors, revealing alternate and additional sources of surplus electronics, along with providing a rich listing of information on events (trade shows, swap meets, conferences, etc.) and resources such as web sites, magazines, newsgroups, and information of interest to the technologically inclined. ./ Tra nsistors LED's Softwa re ./ Network equipm ent Resistors Wire Hard drives ./ Monitors ,/ Capacitors Connectors Surplus equ ipment ./ Printers ,/ Inductors Compu ters RAM ./ Hardware ,/ IC's galore! Lasers EPROMs ./ Modems ./ Switches Racks NOS (New Old Stoc k) ./ Sockets ,/ Lights Cases Telephones ./ Tons of "obsol ete" stuff! lectronics and Computers Su rp lus City (ECSC) 1490 W. Artesia Blvd, Gardena, CA 90248 (800) 543-0540, (310) 217-802 1 FA X :(310) 217-0950 St ore Hours: Mon. t hrough Sat ., 10 AM - 6 PM http://www.eio.com/ SUBSCRIBE r------------------------ - - TO DAYI (T hat means NOW!) mup NagdZln8 SuP.fcn)l/ilJl1 Cdrl We suggest that you photocopy this coupon, fill it out and send it to us in the ma il with your payment option. V111 ) Please send me a 1 year subscription of THUD Magaz ine (4 quarterly issues) for $20 ) Please send me a 2 year subscription of THUD Magazine (8 quarterly issues) for $40 ) Please send me a 3 year subscription of THUD Magazine (12 quarterly iss ues) for $54 (10% discount) ) My Check is enclosed ( ) Money Order enclosed ( ) Bill my Cred it Card: ) MasterCard ( ) Visa ( ) American Express ( ) Discover Name : _ Company: _ Address: City: St : Zip: _ Card#: _ Exp Date: _ Phone: _ Signature: _ DL#: (Required for cred it card purchases) THUD Magazine E-Mail Address: _ P. O. Box 2521 Cyppress, CA 90630 Please enclose this card in an envelope for privacy. Copyrig ht 1998 THUD Magazine . . Canadia n orders add $4 u.s. per year. Other fo reign orders add $15 u.s. per yea r. Please aI/ow 6-8 weeks for delivery offirs t issue. ~---- THUD ------------ - ---- Volume 1 Issue 1 - Spring -- 1998 - - - - - - - - - - - 59