The Great British Payphone                 by Aztech

THIS FILE MUST BE READ ALL THE WAY THROUGH BEFORE ANYTHING IN IT IS ATTEMPTED!

The payphone should be a familiar sight to you if you live in the UK,what
with its Grey/blue livery and distinctive BT logo,screaming to be trashed..
Todays Payphones have come a long way since our pioneer forephreakers in 
the day of the AB phone.Todays standard call box is designed to stand up
to a fair amount of bashes and knocks,while still remaining functional.
Approx.2ft by 3ft by 0.5ft,they do the job but remain open to HACKER ATTAKK!

Firstly,look at the front panel of the phone itself,where all the dialling
gubbins and handset is.You will notice that the front panel seems to be 
hinged on the inside,as there are no hinges outwith the case itself.
Sometimes,If you live in a really shitty,rough area previous attempts on the 
phones case may have loosened the locking bolt within the case,situated next
to the right hand side of the phone case itself.Whether or not this is the 
case,get some form of leverage,like a crowbar,or floorboard remover(very 
small,with a large flat edge:perfect for the following task) and place it
two inches from the bottom of the phone case,just resting inside the lip
created by the overlapping halfs of the phone.

                  /\  /\   
                  ||**||  
                  ||  ||      (This is a very rough sketch of the
                  \ \/ /       locking bar located on the right of
                   \  /        the phone case.The two points marked
                    ||         ** should have the full force of the
                    ||         lever placed on them.The bar will then
                    ||         bend and pop the case of the phone open)
                    ||
                    ||
                    ||
                    ||
                 ---+|
                 **  |
                -----+

Prise steadily,and you should
a loud <kerchunk><pop!!>.This is the locking bolt ratchet within the phone 
slipping a gear,and lossening the case.Keep doing this,periodically shifting
your lever to two inches from the top of the case on the same side to 
the bottom,ensuring a good clean break.Eventually,the case should swing open,
revealing its glorious contents.(Remember to stop the phone swinging too
far,or you will disconnect some ribbon cabling.)
If you now decide you wish to steal the entire phone,you better have come
tooled up.You will need:

1 1mm allen key
1 pair of electricians pliers
1 adjustable spanner
        
See the diagram below for the various attack points:


              +-------------------------------------------+
              | +----------------  ##  --+                |
              | |                 ####   |                |
              | |         ALLEN    ##    |                |CASE
              | |         KEY       ^    +-------------+  |
              | |         BOLT      |                  |  |
              | |          |        |                  |  |
              | |          +--------+                  |  | (TOP OF THE PHONE)
              | |                                      |  |
              | |                                      |  |
              | |                           PCB        |  |
              | |                                      |  |
                                                          

                                                        | |
              | |                                       | |
              | |                                       | |
              | |   POWER CABLES                        | |
              | |   !!!!           NUT AND BOLT         | |
              | +---------------####--------------------+ |
              +-------------------------------------------+

Cut the power cables with the insulated pliers,one at a time.Now just lossen
each mounting bolt,and lift the phone off the wall.There may be more bolts
behind the PCB,but I wasnt about to dissassemble a payphone in broad daylight
in the middle of Glasgow,was I?

        You should now be staring at a large PCB with various connectors
catering for ribbon cabling to various parts of the phone.One goes to the
handset,one to the keypad,one to the tolling mechanisms,and so on.DO NOT
under any circumstances touch the wires encased in the clear plastic box
at the base of the box.You wil be a VERY crispy critter if you do,as this
is the power connection point for the phone itself,branched of from the 
lighting circuit(240V AC,50hz,6a).

The PCB is held in by rubber clips on each leading edge,so to free it from
the phone,simply gently prise them open,and lift the circuit board out.
        Assuming you havent already been crisped,Ill continue.Starting with
the fascia and its associated circuitry.An Orange Box with a CMOS 
!!NO STATIC!! sticker on it contains the sensor equipment neccesary to 
count the coins and their rough size.Break this,and the phone will just stop
working,period.This circuit board also handles the LCD Display,and 
contains the neccesary Test display procedures for FOC Testing.DO NOT tamper
with it!!You have been warned.Next to this little box of tricks is the coin 
chute.Following this to its logical point of contact to the main case,you will
see that it is highly improbable that you will be able to force your grimy 
little fingers in there.It is a very tight fit,and was designed to be so.
However,pushing metal objects into the slot and breaking the plastic coin
carrier channels will cause all sorts of problems,so bear that in mind.
Two large white Microswitches are situated below the coin hopper,one for
returned coins and on for tolled.Determine which is which by dropping a coin
into the slot.It will sit in the hopper until something is done(either
hanging up or dialling).Now,depress one,and note where the coin goes.If 
the coin hits your toe,you have just activated the tolling switch.If,
however,you hear a <clink>but cant see the coin,then it has landed in the 
coin return slot.This can be quite handy for re-using coins when the 
phone is open,so remember which is which.

Moving into the actual body of the phone,and the PCB,you should see in the 
very centre of it a small circular device with squiggles across it,labelled
LDR.This is a Light Dependant resistor,and when there is light shining on it,
the phone automatically goes into self test-mode.To continue to use the open
phone as a normal phone,simply tape black masking tape over the LDR,and all
should be well.In the phone case,on a little brass hook,should be a book
with the BT logo on it.This is the Handbook for the Payphone Test codes,and
gives a detailed rundown of the testing facilities on the phone.
Unfortunately,I wasnt able to obtain one of these,but Ill try and give a
rough idea of what happens during testing.If you look where the book should
be hanging,you will see a brass panel with a sticker on it,detailing each 
individual stage of testing.Below this,you should see a D-shell peripheral
port,with an anti static cap on it.This is the interface for the Linesmans 
testing device,and it is this through which he enters and reads each test 
code.Pulling down the brass panel will reveal a large list of what each code
does,from monitoring coin tones and DTMF tones,to contacting Route and Rate
and inward operators.You should also see some socketed Rom chips(Mostly
EEproms) which hold the billing and rating info as well as the number of the
relevant phone,and a directory of various test numbers and operators.
What actually happens when one of these devices is plugged in is this:
The screen goes blank for a second,and then displays the legend:

              +---------------+
              | NO CASH CALLS |
              |               |
              |  œ 1 : 1 1    |
              +---------------+

Each cell within the display(The Money cells,1)indicates a particular system
status and check.The first indicates whether or not the handset loop is still 
connected,the second indicates problems with the phone internals,and the
third indicates problems with DC operation within the phone.These are 
indicated by a one or a zero for each,1 for okay,0 for Bad.
The purpose of this rudimentary testing is to give the engineers a rough idea
of where to start their tests,instead of slowly going through each one.
Some of the facilities provided by the FOC Test unit are as follows:

DTMF Monitoring
Loop Disconnect/Earth Breaking Switching
Tone/Pulse Dialling
Billing Incrementation/Decrementation
Tone Testing
Inward Operator
Handset Testing 
List of procedures executed
SALT Tests
Voltage Monitoring

The unit also returns codes for the engineer to note down and determine what
has happened after each test,and these codes are integers spanning from
0 to 100.Eg;67 is "Im Okay",which indicates no problems with the phone,
27 is Inward Operator Disconnect,etc,etc.These codes arent accurate,Im just
remembering bits and pieces,because I had no way of noting down the codes
at the time,which was an immense pain in the ass.

At this point you may be wondering:
"All very well,but how do I rip cash out of it?"Remember the trick 
illustrated by Jolly Roger?(Stealing Cash from Payphones;Jolly Rogers Cookbook
V3.0)Well,the same principles apply here.Just be careful that you arent caught
pulling that little stunt,as it will net you at least 6 months inside.

The Coin box on a BT payphone is somewhat sturdier than the phone itself,and
trying to pick the lock is futile unless you are an accomplished locksmith.
A set of Hexagonal screwdrivers or Allen keys will go some way towards 
helping the situation however,as each box is screwed shut as well as locked.
The box itself is encased an 1/2 inch thick steel,and lies on a tray 
mechanism to ease removal(It is VERY heavy,so watch those toes).Contrary to 
popular belief,BT do not know exactly how much goes into each payphone,so 
feel free to pillage at will.Thermite does the job of opening these boxes
just nicely,although many coin boxes are now an integral part of the phone,
or sloped at the top to prevent the magic dust settling in a clean line.

The phone mounting is a strange contraption:Hammered aliminium,with a very
awkward screw mounting(Hexagonal with a central pin).There are two of these
such panels in the phone;The top one contains any lighting and power
switching gear,and the bottom protects the line outs that actually carry data
to the CTO.

Some recent developments on the phone security front have left this model
in the shade somewhat in terms of durabilty,namely the UK Phortress fone.
Very large,and very,very heavy(try 60lbs).This mammoth is designed to be used
in high crime areas and public service institutions.
It boasts 3 Presets for Operator,Fault Reporting and International operator
as well as a chargecard facility(obligitary now) and an LCD green display
to show the dialled number and the calling number.
Multiple languages and voice prompting are catered for,as well as on-screen
help.The DTMF tones are actually heard when dialling,unlike its forerunner.It
also has a reserved audible tone for next call which I have not decoded yet,
but will include If I manage to.

The slot usually reserved for phonecards is extended to 
include credit cards....Including AMEX,Visa,Mcard
Switch,Discovery,Diners Club,etc..Obviously,If there was some way to scarf
the number from the phone at a remote site,then I would be very intrested.
The cradle or hook is unusually positioned,and the coin return slot is 
weighted and narrowed,only allowing you to reclaim your change when it drops
into the receptacle.Inserting foreign objects into the coin return slot is
now made virtually impossible,so just put away that coat hanger..

The Coin box is actually integrated into the phone itself,and any attempt
to interfere with it will mean it dialling the nearest fed-shop in a panic.
(Im serious,please!!)As if this wasnt enough,the phone case is hermetically
sealed around the rim,and fine chainmail or metal mesh is strung around
inside the rim,to foul up any probing instruments or crowbars.
And Finally,the The whole phone itself is bolted onto the holding panel
with twelve 8ins bolts,preventing any random theft of the phone.
A tough cookie to crack indeed..

To remove the handset on the fortress phones and older phones,twist the 
handset clockwise until it will not go any further,then puncture the metal
cable protector with a pair of heavy pliers.Now continue to twist clockwise,
and you should see some wires exposed like this:

--------------->-------BLUE-------------------------<--------------                             
>METAL CABLE>>>>-------BLUE-------------------------<<<<<<<<<<<<<<<                               
<<<<<<<<<<<<<<<>-------RED--------------------------<>>>TO PHONE------>                
>>>>>>>>>>>>>>>>-------RED--------------------------<<<<<<<<<<<<<<<
--------------->*******METAL ANCHORING BRAID********<--------------

Simply snip the Anchoring Braid using your heavy pliers,and then severe
the wires and metal ducting surrounding it all.
RED denotes the earpiece,and BLUE the mouthpiece.These are the actual colours,
but you will have to determine polarity yourself.

The white or beige plastic payphones usually found in supermarkets or
other such dives,on the other hand,are a complete fucking pushover.
For instance,In my local Gateway,the phone connection there is actually
exposed,and can be plugged and unplugged at will.All you need is a phone
of your own,and hey! Free phone call time! They can easily be lifted off 
walls with the minimum of effort,and require only 50Vdc to run.Because
of the cheapness of the phone,and the realtively thin throughfare of users,
they are very rarely alarmed,although you may find one or two padlocked to 
the wall.The white models are particularly good for getting free phone
calls to information lines,as billing does not commence until a voice
carrier from you to the dialled number has been established.The clear box
(See 2600,the hacker quarterly or JRCB V3.0)works on these,and they as well 
can be commandered for home usage very easily.Solitaire Payphones,usually
found in supermarkets and small shops,are also open to this.(Basically,
so is any phone with a button you must press when the called party answers).

In the beige units,the pulse dialler can be heard very clearly to the bottom
left of the unit above the coin box,clicking merrily away as you dial.
Thumping the box in your dialling pattern(eg:2 thumps for 2,3 for 3,etc..)
may work,although I simply must state that not only is this blatantly obvious
to passerbys and feds,It is very tiring and makes you look like
a complete and utter fucking spastic.

(PS:To make the New fortress fones take NO coin calls,simply stick the coin                              
return flap open.This switches the fault reporting mechanism on,and
it phones out to BT to tell it to come and empty it.A great waste of time
for your local telco employee.Try bending a phonecard over double and then
sticking it into the slot to wedge it up into the phone.)

                                     ---=[AZTECH]=---