FAQ H. No document will make you a hacker

authorities then think again, as there was a famous case where a Judge
ordered the administrator of the server to reveal the identity of a
poster.

To see a comprehensive list on anonymous remailers finger
[e-mail] or point your web browser to
http://www.cs.berkeley.edu/~raph/remailer-list.html.

33. How do I defeat Copy Protection?

There are two common methods of defeating copy protection. The first
is to use a program that removes copy protection. Popular programs
that do this are CopyIIPC from Central Point Software and CopyWrite
from Quaid Software. The second method involves patching the copy
protected program. For popular software, you may be able to locate a
ready made patch. You can them apply the patch using any hex editor,
such as debug or the Peter Norton's DiskEdit. If you cannot, you must
patch the software yourself.

Writing a patch requires a debugger, such as Soft-Ice or Sourcer. It
also requires some knowledge of assembly language. Load the protected
program under the debugger and watch for it to check the protection
mechanism. When it does, change that portion of the code. The code
can be changed from JE (Jump on Equal) or JNE (Jump On Not Equal) to
JMP (Jump Unconditionally). Or the code may simply be replaced with
NOP (No Operation) instructions.

34. What is 127.0.0.1?

127.0.0.1 is a loopback network connection. If you telnet, ftp, etc...
to it you are connected to your own machine.

35. How do I post to a moderated newsgroup?

Usenet messages consist of message headers and message bodies. The
message header tells the news software how to process the message.
Headers can be divided into two types, required and optional. Required
headers are ones like "From" and "Newsgroups." Without the required
headers, your message will not be posted properly.

One of the optional headers is the "Approved" header. To post to a
moderated newsgroup, simply add an Approved header line to your
message header. The header line should contain the newsgroup
moderators e-mail address. To see the correct format for your target
newsgroup, save a message from the newsgroup and then look at it using
any text editor.

A "Approved" header line should look like this:

Approved: [e-mail]

There cannot not be a blank line in the message header. A blank line
will cause any portion of the header after the blank line to be
interpreted as part of the message body.

For more information, read RFC 1036: Standard for Interchange of
USENET messages.

36. How do I post to Usenet via e-mail?

Through an e-mail->Usenet gateway. Send an a e-mail messages to
<newsgroup>@<servername>. For example, to post to alt.2600 through
nic.funet.fi, address your mail to [e-mail].

Here are a few e-mail->Usenet gateways:

[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]

37. How do I defeat a BIOS password?

This depends on what BIOS the machine has. Common BIOS's include AMI,
Award, IBM and Phoenix. Numerous other BIOS's do exist, but these are
the most common.

Some BIOS's allow you to require a password be entered before the system
will boot. Some BIOS's allow you to require a password to be entered
before the BIOS setup may be accessed.

Every BIOS must store this password information somewhere. If you are
able to access the machine after it has been booted successfully, you
may be able to view the password. You must know the memory address
where the password is stored, and the format in which the password is
stored. Or, you must have a program that knows these things.

The most common BIOS password attack programs are for Ami BIOS. Some
password attack programs will return the AMI BIOS password in plain
text, some will return it in ASCII codes, some will return it in scan
codes. This appears to be dependent not just on the password attacker,
but also on the version of Ami BIOS.

To obtain Ami BIOS password attackers, ftp to oak.oakland.edu
/simtel/msdos/sysutil/.

If you cannot access the machine after if has been powered up, it is
still possible to get past the password. The password is stored in CMOS
memory that is maintained while the PC is powered off by a small
battery, which is attached to the motherboard. If you remove this
battery, all CMOS information will be lost. You will need to re-enter
the correct CMOS setup information to use the machine. The machines
owner or user will most likely be alarmed when it is discovered that the
BIOS password has been deleted.

On some motherboards, the battery is soldered to the motherboard, making
it difficult to remove. If this is the case, you have another
alternative. Somewhere on the motherboard you should find a jumper that
will clear the BIOS password. If you have the motherboard
documentation, you will know where that jumper is. If not, the jumper
may be labeled on the motherboard. If you are not fortunate enough for
either of these to be the case, you may be able to guess which jumper is
the correct jumper. This jumper is usually standing alone near the
battery.

38. What is the password for <encrypted file>?

This FAQ answer was written by crypt <[e-mail]>

Magazine Password
~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~
VLAD Magazine Issue #1 vlad
VLAD Magazine Issue #2 vx
VLAD Magazine Issue #3 virus
NuKE InfoJournal Issue #2 514738
NuKE InfoJournal Issue #3 power
NuKE InfoJournal Issue #4 party

Program
~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~
Sphere Hacker 1.40 & 1.41 theozone
Virus Creation 2000 high level
Virus Construction Lab Chiba City
Ejecutor Virus Creator EJECUTOR
Biological Warfare v0.90 lo tek
Biological Warfare v1.00 freak

39. Is there any hope of a decompiler that would convert an executable

program into C/C++ code?

This FAQ answer is an excerpt from SNIPPETS by Bob Stout.

Don't hold your breath. Think about it... For a decompiler to work
properly, either 1) every compiler would have to generate substantially
identical code, even with full optimization turned on, or 2) it would
have to recognize the individual output of every compiler's code
generator.

If the first case were to be correct, there would be no more need for
compiler benchmarks since every one would work the same. For the second
case to be true would require in immensely complex program that had to
change with every new compiler release.

OK, so what about specific decompilers for specific compilers - say a
decompiler designed to only work on code generated by, say, BC++ 4.5?
This gets us right back to the optimization issue. Code written for
clarity and understandability is often inefficient. Code written for
maximum performance (speed or size) is often cryptic (at best!) Add to
this the fact that all modern compilers have a multitude of optimization
switches to control which optimization techniques to enable and which to
avoid. The bottom line is that, for a reasonably large, complex source
module, you can get the compiler to produce a number of different object
modules simply by changing your optimization switches, so your
decompiler will also have to be a deoptimizer which can automagically
recognize which optimization strategies were enabled at compile time.

OK, let's simplify further and specify that you only want to support one
specific compiler and you want to decompile to the most logical source
code without trying to interpret the optimization. What then? A good
optimizer can and will substantially rewrite the internals of your code,
so what you get out of your decompiler will be, not only cryptic, but in
many cases, riddled with goto statements and other no-no's of good
coding practice. At this point, you have decompiled source, but what
good is it?

Also note carefully my reference to source modules. One characteristic
of C is that it becomes largely unreadable unless broken into easily
maintainable source modules (.C files). How will the decompiler deal
with that? It could either try to decompile the whole program into some
mammoth main() function, losing all modularity, or it could try to place
each called function into its own file. The first way would generate
unusable chaos and the second would run into problems where the original
source hade files with multiple functions using static data and/or one
or more functions calling one or more static functions. A decompiler
could make static data and/or functions global but only at the expense
or readability (which would already be unacceptable).

Finally, remember that commercial applications often code the most
difficult or time-critical functions in assembler which could prove
almost impossible to decompile into a C equivalent.

Like I said, don't hold your breath. As technology improves to where
decompilers may become more feasible, optimizers and languages (C++, for
example, would be a significantly tougher language to decompile than C)
also conspire to make them less likely.

For years Unix applications have been distributed in shrouded source
form (machine but not human readable -- all comments and whitespace
removed, variables names all in the form OOIIOIOI, etc.), which has been
a quite adequate means of protecting the author's rights. It's very
unlikely that decompiler output would even be as readable as shrouded
source.

40. How does the MS-Windows password encryption work?

This FAQ answer was written by Wayne Hoxsie <[e-mail]>

The password option in MS Win 3.1 is easily defeated, but there are
those of us who really want to know how MS does this. There are many
reasons why knowing the actual password can be useful. Suppose a
sysamin used the same password in the windows screen saver as his root
account on a unix box.

Anyway, I will attempt to relay what I have learned about this algorithm.

I will describe the process starting after you've entered the password
and hit the [OK] button.

I will make the assumtion that everyone (at least those interested) know
what the XOR operation is.

First, the length of the password is saved. We'll call this 'len'. We
will be moving characters from the entered string into another string as
they are encrypted. We'll call the originally entered password
'plaintext' and the encrypted string(strings--there are two passes)
'hash1' and 'hash2.' The position in the plaintext is important during
the process so we'll refer to this as 'pos.' After each step of the
hashing process, the character is checked against a set of characters
that windows considers 'special.' These characters are '[ ] =' and any
character below ASCII 33 or above ASCII 126. I'll refer to this
checking operation as 'is_ok.' All indecies are zero-based (i.e. an 8
character password is considered chars 0 to 7).

Now, the first character of 'plaintext' is xor'd with 'len' then fed to
'is_ok'. if the character is not valid, it is replaced by the original
character of 'plaintext' before going to the next operation. The next
operation is to xor with 'pos' (this is useless for the first operation
since 'len' is 0 and anything xor'd with zero is itself) then fed to
'is_ok' and replaced with the original if not valid. The final
operation (per character) is to xor it with the previous character of
'plaintext'. Since there is no previous character, the fixed value, 42,
is used on the first character of 'plaintext'. This is then fed to
'is_ok' and if OK, it is stored into the first position of 'hash1' This
process proceeds until all characters of plaintext are exhausted.

The second pass is very similar, only now, the starting point is the
last character in hash1 and the results are placed into hash2 from the
end to the beginning. Also, instead of using the previous character in
the final xoring, the character following the current character is used.
Since there is no character following the last character in hash1, the
value, 42 is again used for the last character.

'hash2' is the final string and this is what windows saves in the file
CONTROL.INI.

To 'decrypt' the password, the above procedure is just reversed.

Now, what you've all been waiting for. Here is some C code that will do
the dirty work for you:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int xor1(int i,int j)
{
int x;

x=i^j;
return (x>126||x<33||x==91||x==93||x==61)?i:x;
}
void main()
{
FILE *f;
int i,l;
char s[80],s1[80];

printf("Please enter the path to your Windows directory\n");
gets(s1);
sprintf(s,"%s%scontrol.ini",s1,s1[strlen(s1)-1]=='\\'?"":"\\");
if((f=fopen(s,"rt"))==NULL){
printf("File Error : %s\n",sys_errlist[errno]);
exit(0);
}
while(strnicmp(fgets(s1,70,f),"password",8)!=0&&!feof(f));
fclose(f);
strtok(s1,"=\n");
strcpy(s,strtok(NULL,"\n"));
i=strlen(s)-1;
for(l=i;l>-1;l--)
s1[l]=xor1(xor1(xor1(s[l],l==i?42:s[l+1]),l==i?0:l),i+1);
for(l=0;l<i+1;l++)
s[l]=xor1(xor1(xor1(s1[l],l?s1[l-1]:42),l?l:0),i+1);
printf("The Password is: %s\n",s);
}

* Section B: Telephony *

~~~~~~~~~~~~~~~~~~~~

01. What is a Red Box?

When a coin is inserted into a payphone, the payphone emits a set of
tones to ACTS (Automated Coin Toll System). Red boxes work by fooling
ACTS into believing you have actually put money into the phone. The
red box simply plays the ACTS tones into the telephone microphone.
ACTS hears those tones, and allows you to place your call. The actual
tones are:

Nickel Signal 1700+2200hz 0.060s on
Dime Signal 1700+2200hz 0.060s on, 0.060s off, twice repeating
Quarter Signal 1700+2200hz 33ms on, 33ms off, 5 times repeating


Canada uses a variant of ACTSD called N-ACTS. N-ACTS uses different
tones than ACTS. In Canada, the tones to use are:

Nickel Signal 2200hz 0.060s on
Dime Signal 2200hz 0.060s on, 0.060s off, twice repeating
Quarter Signal 2200hz 33ms on, 33ms off, 5 times repeating

02. How do I build a Red Box?

Red boxes are commonly manufactured from modified Radio Shack tone
dialers, Hallmark greeting cards, or made from scratch from readily
available electronic components.

To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer, open
the dialer and replace the crystal with a new one. The purpose of the
new crystal is to cause the * button on your tone dialer to create a
1700Mhz and 2200Mhz tone instead of the original 941Mhz and 1209Mhz
tones. The exact value of the replacement crystal should be 6.466806 to
create a perfect 1700Mhz tone and 6.513698 to create a perfect 2200mhz
tone. A crystal close to those values will create a tone that easily
falls within the loose tolerances of ACTS. The most popular choice is
the 6.5536Mhz crystal, because it is the easiest to procure. The old
crystal is the large shiny metal component labeled "3.579545Mhz." When
you are finished replacing the crystal, program the P1 button with five
*'s. That will simulate a quarter tone each time you press P1.

03. Where can I get a 6.5536Mhz crystal?

Your best bet is a local electronics store. Radio Shack sells them, but
they are overpriced and the store must order them in. This takes
approximately two weeks. In addition, many Radio Shack employees do not
know that this can be done.

Or, you could order the crystal mail order. This introduces Shipping
and Handling charges, which are usually much greater than the price of
the crystal. It's best to get several people together to share the S&H
cost. Or, buy five or six yourself and sell them later. Some of the
places you can order crystals are:

Digi-Key
701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
[phone]
Part Number:X415-ND /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND

JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
[phone]
Part Number: 6.5536MHZ

Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
[phone]
Part Number: 10068625

Alltronics
2300 Zanker Road
San Jose CA 95131
[phone] Voice
[phone] Fax
[phone] BBS
Part Number: 92A057

Mouser
[phone]
Part Number: 332-1066

Blue Saguaro
P.O. Box 37061
Tucson, AZ 85740
Part Number: 1458b

Unicorn Electronics
10000 Canoga Ave, Unit c-2
Chatsworth, CA 91311
Phone: [phone]
Part Number: CR6.5

04. Which payphones will a Red Box work on?

Red Boxes will work on telco owned payphones, but not on COCOT's
(Customer Owned Coin Operated Telephones).

Red boxes work by fooling ACTS (Automated Coin Toll System) into
believing you have put money into the pay phone. ACTS is the
telephone company software responsible for saying "Please deposit XX
cents" and listening for the coins being deposited.

COCOT's do not use ACTS. On a COCOT, the pay phone itself is
responsible for determining what coins have been inserted.

05. How do I make local calls with a Red Box?

Payphones do not use ACTS for local calls. To use your red box for
local calls, you have to fool ACTS into getting involved in the call.

One way to do this, in some areas, is by dialing 10288-xxx-xxxx. This
makes your call a long distance call, and brings ACTS into the
picture.

In other areas, you can call Directory Assistance and ask for the
number of the person you are trying to reach. The operator will give
you the number and then you will hear a message similar to "Your call
can be completed automatically for an additional 35 cents." When this
happens, you can then use ACTS tones.

06. What is a Blue Box?

Blue boxes use a 2600hz tone to size control of telephone switches
that use in-band signalling. The caller may then access special
switch functions, with the usual purpose of making free long distance
phone calls, using the tones provided by the Blue Box.

07. Do Blue Boxes still work?

This FAQ answer is excerpted from a message posted to Usenet by
Marauder of the Legion of Doom:

Somewhere along the line I have seen reference to something
similar to "Because of ESS Blue boxing is impossible". This is
incorrect. When I lived in Connecticut I was able to blue box
under Step by Step, #1AESS, and DMS-100. The reason is simple,
even though I was initiating my call to an 800 number from a
different exchange (Class 5 office, aka Central Office) in each
case, when the 800 call was routed to the toll network it would
route through the New Haven #5 Crossbar toll Tandem office. It
just so happens that the trunks between the class 5 (CO's) and
the class 4 (toll office, in this case New Haven #5 Xbar),
utilized in-band (MF) signalling, so regardless of what I
dialed, as long as it was an Inter-Lata call, my call would
route through this particular set of trunks, and I could Blue
box until I was blue in the face. The originating Central
Offices switch (SXS/ESS/Etc..) had little effect on my ability
to box at all. While the advent of ESS (and other electronic
switches) has made the blue boxers task a bit more difficult,
ESS is not the reason most of you are unable to blue box. The
main culprit is the "forward audio mute" feature of CCIS (out of
band signalling). Unfortunately for the boxer 99% of the Toll
Completion centers communicate using CCIS links, This spells
disaster for the blue boxer since most of you must dial out of
your local area to find trunks that utilize MF signalling, you
inevitably cross a portion of the network that is CCIS equipped,
you find an exchange that you blow 2600hz at, you are rewarded
with a nice "winkstart", and no matter what MF tones you send at
it, you meet with a re-order. This is because as soon as you
seized the trunk (your application of 2600hz), your Originating
Toll Office sees this as a loss of supervision at the
destination, and Mutes any further audio from being passed to
the destination (ie: your waiting trunk!). You meet with a
reorder because the waiting trunk never "hears" any of the MF
tones you are sending, and it times out. So for the clever
amongst you, you must somehow get yourself to the 1000's of
trunks out there that still utilize MF signalling but
bypass/disable the CCIS audio mute problem. (Hint: Take a close
look at WATS extenders).

08. What is a Black Box?

A Black Box is a resistor (and often capacitor in parallel) placed in
series across your phone line to cause the phone company equipment to be
unable to detect that you have answered your telephone. People who call
you will then not be billed for the telephone call. Black boxes do not
work under ESS.

09. What do all the colored boxes do?

Acrylic Steal Three-Way-Calling, Call Waiting and programmable
Call Forwarding on old 4-wire phone systems
Aqua Drain the voltage of the FBI lock-in-trace/trap-trace
Beige Lineman's hand set
Black Allows the calling party to not be billed for the call
placed
Blast Phone microphone amplifier
Blotto Supposedly shorts every phone out in the immediate area
Blue Emulate a true operator by seizing a trunk with a 2600hz
tone
Brown Create a party line from 2 phone lines
Bud Tap into your neighbors phone line
Chartreuse Use the electricity from your phone line
Cheese Connect two phones to create a diverter
Chrome Manipulate Traffic Signals by Remote Control
Clear A telephone pickup coil and a small amp used to make free
calls on Fortress Phones
Color Line activated telephone recorder
Copper Cause crosstalk interference on an extender
Crimson Hold button
Dark Re-route outgoing or incoming calls to another phone
Dayglo Connect to your neighbors phone line
Diverter Re-route outgoing or incoming calls to another phone
DLOC Create a party line from 2 phone lines
Gold Dialout router
Green Emulate the Coin Collect, Coin Return, and Ringback tones
Infinity Remotely activated phone tap
Jack Touch-Tone key pad
Light In-use light
Lunch AM transmitter
Magenta Connect a remote phone line to another remote phone line
Mauve Phone tap without cutting into a line
Neon External microphone
Noise Create line noise
Olive External ringer
Party Create a party line from 2 phone lines
Pearl Tone generator
Pink Create a party line from 2 phone lines
Purple Telephone hold button
Rainbow Kill a trace by putting 120v into the phone line (joke)
Razz Tap into your neighbors phone
Red Make free phone calls from pay phones by generating
quarter tones
Rock Add music to your phone line
Scarlet Cause a neighbors phone line to have poor reception
Silver Create the DTMF tones for A, B, C and D
Static Keep the voltage on a phone line high
Switch Add hold, indicator lights, conferencing, etc..
Tan Line activated telephone recorder
Tron Reverse the phase of power to your house, causing your
electric meter to run slower
TV Cable "See" sound waves on your TV
Urine Create a capacitative disturbance between the ring and
tip wires in another's telephone headset
Violet Keep a payphone from hanging up
White Portable DTMF keypad
Yellow Add an extension phone

Box schematics may be retrieved from these FTP sites:

ftp.netcom.com /pub/br/bradleym
ftp.netcom.com /pub/va/vandal
ftp.winternet.com /users/nitehwk

10. What is an ANAC number?

An ANAC (Automatic Number Announcement Circuit) number is a telephone
number that plays back the number of the telephone that called it.
ANAC numbers are convenient if you want to know the telephone number
of a pair of wires.

11. What is the ANAC number for my area?

How to find your ANAC number:

Look up your NPA (Area Code) and try the number listed for it. If that
fails, try 1 plus the number listed for it. If that fails, try the
common numbers like 311, 958 and 200-222-2222. If you find the ANAC
number for your area, please let us know.

Note that many times the ANAC number will vary for different switches
in the same city. The geographic naming on the list is NOT intended
to be an accurate reference for coverage patterns, it is for
convenience only.

Many companies operate 800 number services which will read back to you
the number from which you are calling. Many of these require navigating
a series of menus to get the phone number you are looking for. Please
use local ANAC numbers if you can, as overuse or abuse can kill 800 ANAC
numbers.

N [phone] VRS Billing Systems/Integretel (800)4BLOCKME
[phone] Info Access Telephone Company's Automated Blocking Line
[phone] (800)MY-ANI-IS (Now protected by a passcode!)
N [phone] AT&T True Rewards

A non-800 ANAC that works nationwide is 404-988-9664. The one catch
with this number is that it must be dialed with the AT&T Carrier Access
Code 10732. Use of this number does not appear to be billed.

Note: These geographic areas are for reference purposes only. ANAC
numbers may vary from switch to switch within the same city.

NPA ANAC number Approximate Geographic area
--- --------------- ---------------------------------------------
201 958 Hackensack/Jersey City/Newark/Paterson, NJ
202 811 District of Columbia
203 970 CT
205 300-222-2222 Birmingham, AL
205 300-555-5555 Many small towns in AL
205 300-648-1111 Dora, AL
205 300-765-4321 Bessemer, AL
205 300-798-1111 Forestdale, AL
205 300-833-3333 Birmingham
205 557-2311 Birmingham, AL
205 811 Pell City/Cropwell/Lincoln, AL
205 841-1111 Tarrant, AL
205 908-222-2222 Birmingham, AL
206 411 WA (Not US West)
207 958 ME
209 830-2121 Stockton, CA
209 211-9779 Stockton, CA
210 830 Brownsville/Laredo/San Antonio, TX
N 210 951 Brownsville/Laredo/San Antonio, TX (GTE)
212 958 Manhattan, NY
213 114 Los Angeles, CA (GTE)
213 1223 Los Angeles, CA (Some 1AESS switches)
213 211-2345 Los Angeles, CA (English response)
213 211-2346 Los Angeles, CA (DTMF response)
213 760-2??? Los Angeles, CA (DMS switches)
213 61056 Los Angeles, CA
214 570 Dallas, TX
214 790 Dallas, TX (GTE)
214 970-222-2222 Dallas, TX
214 970-611-1111 Dallas, TX (Southwestern Bell)
215 410-xxxx Philadelphia, PA
215 511 Philadelphia, PA
215 958 Philadelphia, PA
216 200-XXXX Akron/Canton/Cleveland/Lorain/Youngstown, OH
216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH
216 959-9892 Akron/Canton/Cleveland/Lorain/Youngstown, OH
217 200-xxx-xxxx Champaign-Urbana/Springfield, IL
219 550 Gary/Hammond/Michigan City/Southbend, IN
219 559 Gary/Hammond/Michigan City/Southbend, IN
N 301 2002006969 Hagerstown/Rockville, MD
301 958-9968 Hagerstown/Rockville, MD
303 958 Aspen/Boulder/Denver/Durango/Grand Junction
/Steamboat Springs, CO
N 305 200-555-1212 Ft. Lauderdale/Key West/Miami, FL
N 305 200200200200200 Ft. Lauderdale/Key West/Miami, FL
N 305 780-2411 Ft. Lauderdale/Key West/Miami, FL
310 114 Long Beach, CA (On many GTE switches)
310 1223 Long Beach, CA (Some 1AESS switches)
310 211-2345 Long Beach, CA (English response)
310 211-2346 Long Beach, CA (DTMF response)
312 200 Chicago, IL
312 290 Chicago, IL
312 1-200-8825 Chicago, IL (Last four change rapidly)
312 1-200-555-1212 Chicago, IL
313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI
313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI
313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI
313 200200200200200 Ann Arbor/Dearborn/Detroit, MI
314 410-xxxx# Columbia/Jefferson City/St.Louis, MO
315 953 Syracuse/Utica, NY
315 958 Syracuse/Utica, NY
315 998 Syracuse/Utica, NY
317 310-222-2222 Indianapolis/Kokomo, IN
317 559-222-2222 Indianapolis/Kokomo, IN
317 743-1218 Indianapolis/Kokomo, IN
334 5572411 Montgomery, AL
334 5572311 Montgomery, AL
401 200-200-4444 RI
401 222-2222 RI
402 311 Lincoln, NE
404 311 Atlanta, GA
N 770 780-2311 Atlanta, GA
404 940-xxx-xxxx Atlanta, GA
404 990 Atlanta, GA
405 890-7777777 Enid/Oklahoma City, OK
405 897 Enid/Oklahoma City, OK
U 407 200-222-2222 Orlando/West Palm Beach, FL (Bell South)
N 407 520-3111 Orlando/West Palm Beach, FL (United)
408 300-xxx-xxxx San Jose, CA
408 760 San Jose, CA
408 940 San Jose, CA
409 951 Beaumont/Galveston, TX
409 970-xxxx Beaumont/Galveston, TX
410 200-6969 Annapolis/Baltimore, MD
N 410 200-200-6969 Annapolis/Baltimore, MD
410 200-555-1212 Annapolis/Baltimore, MD
410 811 Annapolis/Baltimore, MD
412 711-6633 Pittsburgh, PA
412 711-4411 Pittsburgh, PA
412 999-xxxx Pittsburgh, PA
413 958 Pittsfield/Springfield, MA
413 200-555-5555 Pittsfield/Springfield, MA
414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI
415 200-555-1212 San Francisco, CA
415 211-2111 San Francisco, CA
415 2222 San Francisco, CA
415 640 San Francisco, CA
415 760-2878 San Francisco, CA
415 7600-2222 San Francisco, CA
419 311 Toledo, OH
N 423 200-200-200 Chatanooga, Johnson City, Knoxville , TN
N 501 511 AR
502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY
502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY
503 611 Portland, OR
503 999 Portland, OR (GTE)
504 99882233 Baton Rouge/New Orleans, LA
504 201-269-1111 Baton Rouge/New Orleans, LA
504 998 Baton Rouge/New Orleans, LA
504 99851-0000000000 Baton Rouge/New Orleans, LA
508 958 Fall River/New Bedford/Worchester, MA
508 200-222-1234 Fall River/New Bedford/Worchester, MA
508 200-222-2222 Fall River/New Bedford/Worchester, MA
508 26011 Fall River/New Bedford/Worchester, MA
509 560 Spokane/Walla Walla/Yakima, WA
510 760-1111 Oakland, CA
512 830 Austin/Corpus Christi, TX
512 970-xxxx Austin/Corpus Christi, TX
N 513 380-55555555 Cincinnati/Dayton, OH
515 5463 Des Moines, IA
515 811 Des Moines, IA
516 958 Hempstead/Long Island, NY
516 968 Hempstead/Long Island, NY
517 200-222-2222 Bay City/Jackson/Lansing, MI
517 200200200200200 Bay City/Jackson/Lansing, MI
518 511 Albany/Schenectady/Troy, NY
518 997 Albany/Schenectady/Troy, NY
518 998 Albany/Schenectady/Troy, NY
N 540 211 Roanoke, VA (GTE)
N 540 311 Roanoke, VA (GTE)
N 541 200 Bend, OR
603 200-222-2222 NH
606 997-555-1212 Ashland/Winchester, KY
606 711 Ashland/Winchester, KY
607 993 Binghamton/Elmira, NY
609 958 Atlantic City/Camden/Trenton/Vineland, NJ
610 958 Allentown/Reading, PA
610 958-4100 Allentown/Reading, PA
612 511 Minneapolis/St.Paul, MN
614 200 Columbus/Steubenville, OH
614 571 Columbus/Steubenville, OH
615 200200200200200 Chatanooga/Knoxville/Nashville, TN
615 2002222222 Chatanooga/Knoxville/Nashville, TN
615 830 Nashville, TN
616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI
617 200-222-1234 Boston, MA
617 200-222-2222 Boston, MA
617 200-444-4444 Boston, MA (Woburn, MA)
617 220-2622 Boston, MA
617 958 Boston, MA
618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL
618 930 Alton/Cairo/Mt.Vernon, IL
619 211-2001 San Diego, CA
619 211-2121 San Diego, CA
N 659 220-2622 Newmarket, NH
N 703 211 VA
N 703 511-3636 Culpeper/Orange/Fredericksburg, VA
703 811 Alexandria/Arlington/Roanoke, VA
704 311 Asheville/Charlotte, NC
N 706 940-xxxx Augusta, GA
707 211-2222 Eureka, CA
708 1-200-555-1212 Chicago/Elgin, IL
708 1-200-8825 Chicago/Elgin, IL (Last four change rapidly)
708 200-6153 Chicago/Elgin, IL
708 724-9951 Chicago/Elgin, IL
713 380 Houston, TX
713 970-xxxx Houston, TX
713 811 Humble, TX
N 713 380-5555-5555 Houston, TX
714 114 Anaheim, CA (GTE)
714 211-2121 Anaheim, CA (PacBell)
714 211-2222 Anaheim, CA (Pacbell)
N 714 211-7777 Anaheim, CA (Pacbell)
716 511 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
716 990 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
717 958 Harrisburg/Scranton/Wilkes-Barre, PA
718 958 Bronx/Brooklyn/Queens/Staten Island, NY
N 770 940-xxx-xxxx Marietta/Norcross, GA
N 770 780-2311 Marietta/Norcross, GA
802 2-222-222-2222 Vermont
802 200-222-2222 Vermont
802 1-700-222-2222 Vermont
802 111-2222 Vermont
N 804 990 Virginia Beach, VA
805 114 Bakersfield/Santa Barbara, CA
805 211-2345 Bakersfield/Santa Barbara, CA
805 211-2346 Bakersfield/Santa Barbara, CA (Returns DTMF)
805 830 Bakersfield/Santa Barbara, CA
806 970-xxxx Amarillo/Lubbock, TX
810 200200200200200 Flint/Pontiac/Southfield/Troy, MI
N 810 311 Pontiac/Southfield/Troy, MI
812 410-555-1212 Evansville, IN
813 311 Ft. Meyers/St. Petersburg/Tampa, FL
N 815 200-3374 Crystal Lake, IL
N 815 270-3374 Crystal Lake, IL
N 815 770-3374 Crystal Lake, IL
815 200-xxx-xxxx La Salle/Rockford, IL
815 290 La Salle/Rockford, IL
817 211 Ft. Worth/Waco, TX
817 970-611-1111 Ft. Worth/Waco, TX (Southwestern Bell)
818 1223 Pasadena, CA (Some 1AESS switches)
818 211-2345 Pasadena, CA (English response)
818 211-2346 Pasadena, CA (DTMF response)
N 860 970 CT
903 970-611-1111 Tyler, TX
904 200-222-222 Jackonsville/Pensacola/Tallahasee, FL
906 1-200-222-2222 Marquette/Sault Ste. Marie, MI
907 811 AK
908 958 New Brunswick, NJ
N 909 111 Riverside/San Bernardino, CA (GTE)
910 200 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 311 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 988 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
914 990-1111 Peekskill/Poughkeepsie/White Plains/Yonkers, NY
915 970-xxxx Abilene/El Paso, TX
N 916 211-0007 Sacramento, CA (Pac Bell)
916 461 Sacramento, CA (Roseville Telephone)
919 200 Durham, NC
919 711 Durham, NC
N 954 200-555-1212 Ft. Lauderdale, FL
N 954 200200200200200 Ft. Lauderdale, FL
N 954 780-2411 Ft. Lauderdale, FL

Canada:
204 644-4444 Manitoba
306 115 Saskatchewan
403 311 Alberta, Yukon and N.W. Territory
403 908-222-2222 Alberta, Yukon and N.W. Territory
403 999 Alberta, Yukon and N.W. Territory
416 997-xxxx Toronto, Ontario
506 1-555-1313 New Brunswick
514 320-xxxx Montreal, Quebec
U 514 320-1232 Montreal, Quebec
U 514 320-1223 Montreal, Quebec
U 514 320-1233 Montreal, Quebec
519 320-xxxx London, Ontario
604 1116 British Columbia
604 1211 British Columbia
604 211 British Columbia
613 320-2232 Ottawa, Ontario
705 320-4567 North Bay/Saulte Ste. Marie, Ontario
N 819 320-1112 Quebec

Australia:
[phone] Victoria 03 area
[phone] All major capital cities
[phone]

United Kingdom:
175

Israel:
110

12. What is a ringback number?

A ringback number is a number that you call that will immediately
ring the telephone from which it was called.

In most instances you must call the ringback number, quickly hang up
the phone for just a short moment and then let up on the switch, you
will then go back off hook and hear a different tone. You may then
hang up. You will be called back seconds later.

13. What is the ringback number for my area?

An 'x' means insert those numbers from the phone number from which you
are calling. A '?' means that the number varies from switch to switch
in the area, or changes from time to time. Try all possible
combinations.

If the ringback for your NPA is not listed, try common ones such as 114,
951-xxx-xxxx, 954, 957 and 958. Also, try using the numbers listed for
other NPA's served by your telephone company.

Note: These geographic areas are for reference purposes only. Ringback
numbers may vary from switch to switch within the same city.



NPA Ringback number Approximate Geographic area
--- --------------- ---------------------------------------------
201 55?-xxxx Hackensack/Jersey City/Newark/Paterson, NJ
202 958-xxxx District of Columbia
203 99?-xxxx CT
206 571-xxxx WA
N 208 59X-xxxx ID
208 99xxx-xxxx ID
N 210 211-8849-xxxx Brownsville/Laredo/San Antonio, TX (GTE)
213 1-95x-xxxx Los Angeles, CA
N 214 971-xxxx Dallas, TX
215 811-xxxx Philadelphia, PA
216 551-xxxx Akron/Canton/Cleveland/Lorain/Youngstown, OH
219 571-xxx-xxxx Gary/Hammond/Michigan City/Southbend, IN
219 777-xxx-xxxx Gary/Hammond/Michigan City/Southbend, IN
301 579-xxxx Hagerstown/Rockville, MD
301 958-xxxx Hagerstown/Rockville, MD
303 99X-xxxx Grand Junction, CO
304 998-xxxx WV
305 999-xxxx Ft. Lauderdale/Key West/Miami, FL
312 511-xxxx Chicago, IL
312 511-xxx-xxxx Chicago, IL
312 57?-xxxx Chicago, IL
315 98x-xxxx Syracuse/Utica, NY
317 777-xxxx Indianapolis/Kokomo, IN
317 yyy-xxxx Indianapolis/Kokomo, IN (y=3rd digit of phone number)
319 79x-xxxx Davenport/Dubuque, Iowa
334 901-xxxx Montgomery, AL
401 98?-xxxx RI
404 450-xxxx Atlanta, GA
407 988-xxxx Orlando/West Palm Beach, FL
408 470-xxxx San Jose, CA
408 580-xxxx San Jose, CA
412 985-xxxx Pittsburgh, PA
414 977-xxxx Fond du Lac/Green Bay/Milwaukee/Racine, WI
414 978-xxxx Fond du Lac/Green Bay/Milwaukee/Racine, WI
415 350-xxxx San Francisco, CA
417 551-xxxx Joplin/Springfield, MO
501 221-xxx-xxxx AR
501 721-xxx-xxxx AR
502 988 Frankfort/Louisville/Paducah/Shelbyville, KY
503 541-XXXX OR
504 99x-xxxx Baton Rouge/New Orleans, LA
504 9988776655 Baton Rouge/New Orleans, LA
505 59?-xxxx New Mexico
512 95X-xxxx Austin, TX
513 951-xxxx Cincinnati/Dayton, OH
513 955-xxxx Cincinnati/Dayton, OH
513 99?-xxxx Cincinnati/Dayton, OH (X=0, 1, 2, 3, 4, 8 or 9)
N 515 559-XXXX Des Moines, IA
516 660-xxx-xxxx Hempstead/Long Island, NY
601 777-xxxx MS
609 55?-xxxx Atlantic City/Camden/Trenton/Vineland, NJ
610 811-xxxx Allentown/Reading, PA
612 511 Minneapolis/St.Paul, MN
612 999-xxx-xxxx Minneapolis/St.Paul, MN
N 613 999-xxx-xxxx Ottawa, Ontario
614 998-xxxx Columbus/Steubenville, OH
615 920-XXXX Chatanooga/Knoxville/Nashville, TN
615 930-xxxx Chatanooga/Knoxville/Nashville, TN
616 946-xxxx Battle Creek/Grand Rapids/Kalamazoo, MI
619 331-xxxx San Diego, CA
619 332-xxxx San Diego, CA
N 659 981-XXXX Newmarket, NH
N 703 511-xxx-xxxx VA
703 958-xxxx Alexandria/Arlington/Roanoke, VA
708 511-xxxx Chicago/Elgin, IL
N 713 231-xxxx Los Angeles, CA
714 330? Anaheim, CA (GTE)
714 33?-xxxx Anaheim, CA (PacBell)
716 981-xxxx Rochester, NY (Rochester Tel)
718 660-xxxx Bronx/Brooklyn/Queens/Staten Island, NY
719 99x-xxxx Colorado Springs/Leadville/Pueblo, CO
801 938-xxxx Utah
801 939-xxxx Utah
802 987-xxxx Vermont
804 260 Charlottesville/Newport News/Norfolk/Richmond, VA
805 114 Bakersfield/Santa Barbara, CA
805 980-xxxx Bakersfield/Santa Barbara, CA
810 951-xxx-xxxx Pontiac/Southfield/Troy, MI
813 711 Ft. Meyers/St. Petersburg/Tampa, FL
817 971 Ft. Worth/Waco, TX (Flashhook, then 2#)
906 951-xxx-xxxx Marquette/Sault Ste. Marie, MI
908 55?-xxxx New Brunswick, NJ
908 953 New Brunswick, NJ
913 951-xxxx Lawrence/Salina/Topeka, KS
914 660-xxxx-xxxx Peekskill/Poughkeepsie/White Plains/Yonkers, NY

Canada:
204 590-xxx-xxxx Manitoba
416 57x-xxxx Toronto, Ontario
416 99x-xxxx Toronto, Ontario
416 999-xxx-xxxx Toronto, Ontario
506 572+xxx-xxxx New Brunswick
514 320-xxx-xxxx Montreal, Quebec
519 999-xxx-xxxx London, Ontario
N 604 311-xxx-xxxx British Columbia
613 999-xxx-xxxx Ottawa, Ontario
705 999-xxx-xxxx North Bay/Saulte Ste. Marie, Ontario
N 819 320-xxx-xxxx Quebec
N 905 999-xxx-xxxx Hamilton/Mississauga/Niagra Falls, Ontario

Australia: +61 199
Brazil: 109 or 199
N France: 3644
Holland: 99-xxxxxx
New Zealand: 137
Sweden: 0058
United Kingdom: 174 or 1744 or 175 or 0500-89-0011
N Amsterdam 0196
N Hilversum 0123456789
N Breukelen 0123456789
N Groningen 951

14. What is a loop?

This FAQ answer is excerpted from: ToneLoc v0.99 User Manual
by Minor Threat & Mucho Maas

Loops are a pair of phone numbers, usually consecutive, like 836-9998
and 836-9999. They are used by the phone company for testing. What
good do loops do us? Well, they are cool in a few ways. Here is a
simple use of loops. Each loop has two ends, a 'high' end, and a
'low' end. One end gives a (usually) constant, loud tone when it is
called. The other end is silent. Loops don't usually ring either.
When BOTH ends are called, the people that called each end can talk
through the loop. Some loops are voice filtered and won't pass
anything but a constant tone; these aren't much use to you. Here's
what you can use working loops for: billing phone calls! First, call
the end that gives the loud tone. Then if the operator or someone
calls the other end, the tone will go quiet. Act like the phone just
rang and you answered it ... say "Hello", "Allo", "Chow", "Yo", or
what the fuck ever. The operator thinks that she just called you, and
that's it! Now the phone bill will go to the loop, and your local
RBOC will get the bill! Use this technique in moderation, or the loop
may go down. Loops are probably most useful when you want to talk to
someone to whom you don't want to give your phone number.

15. What is a loop in my area?

Many of these loops are no longer functional. If you are local
to any of these loops, please try them out an e-mail me the results
of your research.

NPA High Low
--- -------- --------
201 666-9929 666-9930
208 862-9996 862-9997
209 732-0044 732-0045
201 666-9929 666-9930
213 360-1118 360-1119
213 365-1118 365-1119
213 455-0002 455-XXXX
213 455-0002 455-xxxx
213 546-0002 546-XXXX
213 546-0002 546-xxxx
213 549-1118 549-1119
305 964-9951 964-9952
307 468-9999 468-9998
308 357-0004 357-0005
312 262-9902 262-9903