-------------------------------------------------------------------------------- The Hacker's Choice -------------------------------------------------------------------------------- THC-SCAN v1.50 *PUBLIC* (c) 1996,97 by van Hauser / [THC] Part Title Line Last Update ------------------------------------------------------------------------------ I. Introduction 50 v1.3 II. Features 140 v1.4 III. How to configure TS-CFG & modem 485 v1.3 IV. Commandline parameters 615 v1.4 V. Online scanning keys 780 v1.5 VI. Service programs 1050 v1.5 VII. Tips & tricks 1333 v1.5 Epilog: Update? How to contact? Etc. 1480 v1.5 ------------------------------------------------------------------------------ !NOTE! : A quickstart/reference manual is now available: THC-QUIK.DOC ->> Please read HISTORY.DOC to see what's new. <<- ->> Read HISTORY.DOC too to get to know what will be in v1.1! <<- ============================================================================== I. INTRODUCTION * Overview : What does THC-SCAN ? * -------- Hey this looks like TONELOC ! * Who's who in this ZIP archive ? What does THC-SCAN ? -------------------- THC-SCAN scans a defined range of phone numbers. It Reports : Carriers, Tones, VMBs, Fax etc. depending on the mode set & configuration. (You can do many more things with this piece, but get a brain to find out ... ;-) [>400 kb source code by the way ...] It supports : all flavors of XX-Dos (MS-, DR-, PC- etc.) win95 when rebooted in DOS mode Linux & BSD in the DOSEMU Normal Color Monitors + LCD/Hercules Monitors Plus timeslicing for multitaskers like Desqview, Windows etc. You want to run multitaskers with THC-SCAN? No Problem, read Section II. Hey this looks like TONELOC ! ----------------------------- Yep. Toneloc is very good. But first it didn't work on my computer and second it could be enhanced. So i wrote this one. And my personal opinion is, that this one is better. Much more flexible and more functions. Which programmer would say his one is not as good as? Why releasing it then? Take a look. Try it, test it. It's worth it's time ! Who's Who in this ZIP archive ? -------------------------------- FILE_ID.DIZ File Description for BBS README.DOC (english) Short Introduction, How 2 Install, etc. DEUTSCH.DOC (german) Short Introduction, How 2 Install, etc. THC.NFO Important. Our group infos ;-) THCINTRO.EXE A small nice intro-demo showing THC-SCAN and more ;-) TS-BIN.ZIP All packed .EXE files TS-DOC.ZIP All packed .DOC files TS-MISC.ZIP All packed files which are not .EXE or .DOC -> TS-BIN.ZIP includes THC-SCAN.EXE The Scanner EXEcutable (MAIN Executable) TS-CFG.EXE The ConfigMaker EXEcutable (Config Executable) DAT-CONV.EXE DAT File converter TONELOC <-> THC-SCAN. DAT-MANP.EXE DAT File manipulator for THC-SCAN, exchange ID values. DAT-MERG.EXE Merges two Dat files together to a new one. DAT-STAT.EXE DAT File statistical analyzer. EXTR-NO.EXE Extracts (phone-)numbers from a text file. TXT-CONV.EXE Converts a file : 8n1->7e1, 8n1->7o1, unix/amiga<->msdos<->st. MOD-DET.EXE Detects connected modems and prints out their datas THC-SCAN.BIN BIN File to load when AlarmKey (Alt-A) is pressed. SIGS.ZIP PGP Signatures of all EXEcutable files in this package. Please check to get a secure version of my public PGP key. -> TS-DOC.ZIP includes THC-SCAN.DOC Detailed documentation for the novice(?) Scanner Guy. THC-QUIK.DOC Reference/Short documentation for the experienced user. HISTORY.DOC History File. What's new, what changed, bugs etc. READ IT ! THC-FAQ.DOC Common problems & solutions for THC-SCAN. TONELOC.DOC Differences between Thc-Scan & Toneloc. How to (ex-)change. KEYBOARD.DOC Online keys. Print out and lay beside you while scanning. DATFILE.DOC The Structure of the Thc-Scan DAT Files ERRLEVEL.DOC Overview of the Errorlevels returned by Thc-Scan -> TS-MISC.ZIP includes THC&SCAV.SCR Script for the SCAVENGER DIALER >=v0.80 to use as external dialer! NETSCAN.BAT Batchfiles for guys scanning with a network of 3+ scan clients CARRIER.CFG config file for carrier scanning with a Zyxel FIRSTSCN.CFG config file for online scanning 1st sweep OTHERSCN.CFG config file for online scanning after 1st sweep ============================================================================== II. FEATURES * Overview : Modem support (Fossil or not Fossil - and problems) * -------- The different modes * The Autonom/Manual mode * Dial modes * Dialing numbers from a textfile * Dialing through a modem outdial * Using 2+ Modems and/or an ethernet network for scanning * Using an external program to dial the numbers * Primary & secondary identifications * Carrier hacking & nudge * The DAT file and the LOGs * How to prevent scanning detection from phone companies * van Hauser says ... Modem Support (Fossil or not Fossil - and problems) ---------------------------------------------------- Since v0.9b THC-SCAN supports direct port AND the Fossil Driver to communicate with your Modem. For those with an ISDN card, old modem or an old seriell port THC-SCAN does not support in direct mode, use the Fossil Driver. Using a Fossil Driver is more secure. Check your local Shareware BBS, Shareware CD-ROM or the Inet for a Fossil Driver ... you should use X00-202.ZIP - it's the best. Note that X00 was included in the THC-SCAN v1.0 release, but it was too big and of no great use because the direct mode is best for most cases. Note: If you want to execute programs out of THC-SCAN then run the X00 driver before running THC-SCAN! The different modes ------------------- There are two basic modes THC-SCAN can be set to. CARRIER MODE - THC-SCAN searchs for carriers. TONE MODE - THC-SCAN searchs for tones/pbx. Those ones with a dialtone. When in CARRIER MODE, THC-SCAN can also identify VMBs, Voice, Fax and more. You may change the mode online by pressing "ALT-M". The AUTONOM/MANUAL Mode ----------------------- This is a special mode never ever seen on a scanner before. For this Mode ADD-ON you have to sit in front of the computer while scanning. (You should do this every time, unless you are so lazy to scan for carriers only.) When turned on you may continue dialing with your modem! This is useful for Tones/PBX, or VMBs or Answering Machines to test the code length etc. Press ENTER when autonom/manual mode is turned on to continue dialing. You may also enter "M" while online to redial and enter autonom/manual mode for this call only. Or you may hit "Alt-M" to toggle this mode on/off. Note that after a specified time called Autonom_Timeout (can be set in TS-CFG) THC-SCAN will try to autodetect. Disable this feature by setting the Autonom_Timeout to 0 if you wish. DIAL MODES ---------- You can choose to dial random, sequentiel up & down (with step rates too) or to dial all numbers in a specified textfile. Read next paragraph for details on this. (It's the option DIALING in TS-CFG in menu SCAN MODE) DIALING NUMBERS FROM A TEXT FILE -------------------------------- This allows you to scan numbers from a textfile. THC-SCAN reads in the text file line-by-line and dials every read-in line. When you abort a textfile scanning, a .DAT file is created which will be auto-loaded if you continue the scan at another time and will continue on your last dialed number. DRAWBACKS : NO real Dat file is created (of course) ADVANTAGES : You can put any number on the list you want to. The first scanner ever to offer this possiblity. How to use this : Use EXTR-NO.EXE to extract the phonenumbers from any textfile (carrier listings ;-) ... check the created file after that for mistakes etc. Start THC-SCAN with : THC-SCAN.EXE @ [any other options] Note that /M, /X, /D and /R are disabled when using this option. Guys, this one is REALLY cool! I collected EVERY textfile, message, scanlist TL & TS DAT File and extracted every modem carrier into the file. Then I scanned ALL 800 numbers found, revealing me the list of 600 carriers on german toll free numbers, the most complete list ever to be created ... SCANNING THROUGH AN MODEM OUTDIAL --------------------------------- The option to use a modem outdial (of a university f.e.) is now included but STILL BETA. Please TEST ! To use this option, do this : 1) run TS-CFG and set in MODEM-SETUP the "Outdial Flee Char" to that char you'll set the outdial modem's flee char to. Use '#' for example. 2) connect to the server with a normal terminal program. The Terminal Program must have been set on the same seriel speed as THC-SCAN (COM Speed - not modem connect speed!) 3) When in command mode of the oudial modem, type 'AT S2=35' (for '#') 4) Quit the terminal program but don't hang up! 3) Run THC-SCAN with the normal options PLUS '-O' for outdial scanning Then it should do it's work. Please report if anything goes wrong or not. If it does NOT work, try again with a FOSSIL Driver. If it goes wrong, tell me when and why. If everything still fails or you want to have it simpler, do that : Do step 1) and then run THC-SCAN with the option -o ... a screen will pop up and ask you if you want to connect to the outdial modem. Choose Yes and use the terminal to do step 2) and 3), instead of step 4) you just exit the terminal screen with ALT-X ... and you don't need step 5 ;-) This new possiblity was introduced in v1.1 Using 2+ Modems and/or an ethernet network for scanning ------------------------------------------------------- First I thought about implementing network scanning into THC-SCAN but then decided that it's easier to do it via a good batch file ... and here it goes : Take a look at the file NETSCAN.BAT included in this archive. On every client in your network you want to scan with, put a SET CLIENT=[number] in their autoexec.bat. This specifies the CLIENT number. So SET CLIENT=1 for the first client, SET CLIENT=2 for the second etc. Edit NETSCAN.BAT and modify section [2] and [3]. Now just run NETSCAN.BAT with the dialmask (scan-area). One DAT file for every CLIENT will be created. Use DAT-MERG.EXE afterwards to merge them together. Currently the Batchfile supports either 3, 5 or 10 scan clients. If you want to scan with 2, 4, 6, 7, 8, 9 or 11+ clients : No problem, just reprogram NETSCAN.BAT (if you can't program batchfiles ... learn it!) Currently the Batchfile support only network clients and not a computer equiped with 2+ modem. If your computer has got 2 modems or more then just change the following in NETSCAN.BAT : CHANGE -> if a%3==a goto OK (in line 30) ADD -> SET CLIENT=%2 (in line 18) that should be all you need ... run netscan with the syntax NETSCAN [scan-area] [client] where [client] is 1 or 2 etc. see SET CLIENT above ... Remeber that if you want ot scan with 2, 4 or 6 etc. modems you must reprogram NETSCAN.BAT as described above. Using an external program to dial the numbers --------------------------------------------- Useful for what? If you are a blueboxer or got some other possibilites like a hardware to place calls for free and/or into other countries maybe you would like to do a bit scanning there too, right? So set EXTERNAL DIALER in TS-CFG/Misc to YES and specify the external program. Remember to put the ^D for the phonenumber to dial into the parameter string. You need to add the X3 config to your modem init string for this to turn dialtone detection off. To use with the SCAVENGER Dialer (from v0.80 on) : PROGRAM : SCAVENGE.EXE PARAMETER : /NOOUTPUT /DIALVAR ^D /S THC&SCAVE.SCR REACTION : 3 One more thing about REACTION : valid is either 1 or 2 (and 3 or 4, read below) 0 dials the phone number with THC-SCAN AFTER the external program, 1 does only a AT ... and add +2 if you need THC-SCAN to do a modem hook up BEFORE executing. PRIMARY & SECONDARY Identifications ----------------------------------- This is also a special thing never ever possible in a scanner. Primary Identification is the main thing about the number. It is a carrier, tone, vmb, girl voice, fax etc. You press the ID key (F for Fax f.e.) and THC-SCAN will stop and move to the next number. Secondary Identifications are other characteristica which are interesting. For example if the phone system of the target is using CCiTT #4 or #5 which is interesting for blueboxers, or to determine if the number is in an other country (better if you want to play with those numbers, depending on the law of your country, you may only break the law in the country the phone number is located. Check your lawyer.). When you press the ID key for a Secondary ID (5 for CCitt #5 for example) THC-SCAN will not stop. You may type some more 2ndary IDs. But when you press a Primary ID, THC-SCAN stops and moves to the next number. Read Section V. for the available SECONDARY Keys while online. Carrier Hacking & Nudge ----------------------- When mode enabled (TS-CFG : MODE HACKING), depending on mode set it will 0) wait for nudge delay timeout 1) send nudge string to system and wait for nudge delay timeout 2) beeps a few times to inform you that YOU can now enter the system. NO nudge delay timeout. You can online hack the system.) Don't unset the string variable for your Carrier Hack Log, or no log file will be created. Pressing ALT-T while 0) or 1) is in progress automatically enters 2)/ Try TS-CFG to see how to set up the NUDGE STRING. NUDGE DELAY counts the time after the connect had been made. When exceeding Nudge delay setting, THC-SCAN disconnects (only in 0) and 1) ) and continues. The DAT File & the LOGs ----------------------- In the DAT file are many things saved - all primary IDs and the no# of rings detected on that number. Not the 2ndary IDs ! The main log file loggs everything. All primary IDs have a LOG file defined in TS-CFG. To remove a special ID LOG file, clear it's name entry in TS-CFG / LOG. How to prevent scanning detection from phone companies ------------------------------------------------------ * General Preface: As you can read in in our first magazine (THC-MAG1.ZIP) the article about CCiTT #7 Line Monitoring, and an updated and more comprehensive one in the TFC #4 Magazine, there are now powerful monitoring computers running. First: All the tips together does help preventing the detection from the monitoring systems, they do NOT disable it at all ... So here what to do : The system does a pattern matching. So do look as normal as possible with your calls. If you got 2 or more phone lines (those of your parents, sisters, friends etc. count!) available in your house, try to scan from all lines available.. That reduces the chance to be detected by "repeated calls from the same origin" & "dialing many toll free numbers". Then you can deceive the monitoring option looking for automated dialings with these 3 possibilites : Scan sometimes with Pulse and sometimes with Tone if thats possible for your area. Use the THC-SCAN option to dial every number with a different speed. And the 3rd, waiting between every digit of the number being dialed randomly between 1-2 seconds. Dial random, not sequentiel - also if this doesn't make a big difference to the today's technology it does to the eyes of the operator who must analyse each alarm triggered. Last one : Best to scan either between 6:00 to 9:00 or 16:00 to 20:00 where are the main telecommunication traffic but operators don't like to work ;-) * How to set this up with THC-SCAN : An intelligent monitoring system can identify if a call, phonenumber or digit is placed in an equal manner (e.g. by a computer/modem) or by hand. These two options help to deceive this : DIAL SPEED DELAY - dials every phone number with a different speed. Fast and useful. You can find it in the MISC Menu of TS-CFG. Note that you should not set the number for the minimum dialspeed setting too low, because then your modem will dial to fast for your telekom phone system. SEND SPEED DELAY - dials every number of the phone number with a different speed. Slows down the scanning speed very much but is more secure. You can find it too in the MISC Menu of TS-CFG. Note that you should not set the number for the minimum sendspeed setting too low, because your moedm needs enough time to complete dialing one number. Test ... if you get a "NO CARRIER" while dialing, it's too low. Once they detected your scanning (by computer or operator) they can decide to do one of the two possibilities immedeantely : do nothing or jam the line. The last possiblity is favored by the german telekom. After dialing 1-3 digits of the number, the phoneline gets a busy signal ... this is done approx. every or down to every 3rd call. Also they can disable the line altogether or just slow you down by giving you the dialtone very late. To detect this, you can use this feature : JAMMING DETECTION - If a BUSY signal is received within a defined time, then the counter of possible detected jams will be increased by one. If it hits the margin of the defined number of max. NO DIALTONE responses (this can be defined in TS-CFG, SCANNING Menu), Thc-Scan exits with a special error level. It is important that you set the time for the jamming detection limit wisly, otherwise either it'll never detect a real jam, or will abort all your scans with false alarms. So here's how to set it right : Let's say you want to scan 111-800-555-xxxx, and you own phone number is 444-4444 you simply : 111800555xxxx 4444444 ----------- 444444455xxxx and start it this way : thc-scan.exe jam-test.dat -m:444444455xxxx you take a look at the first 5 results and note the elapsed time between them a BUSY response is detected from your modem. You then use the highest average found like this (let's say the highest average was 7 seconds) : you just add this parameter to all your scannings -> -J:7 Annotation from The Analyst: The systems creates a profile of your phonenumber with your dialing habits so if you dial standardly a lot of toll free numbers since months then you should have no problems with scanning. Last but not least use a limit of maximum calls. I think that is the main point of the monitoring system to react. I don't think it's mainly the kind of dialing. So 200-400 dials per day is enough. And dial them over one day. In the traffic hours or at night start at 10:00pm and end the dialing at 4:00am (TELEKOM workers are sleeping meanwhile). Do some tests. Check your lines if the go busy. There's a option in TS-CFG ;-). And the TELEKOM won't make trouble if you dial to many numbers but it's very annoying if you just typed in 0130 in your phone to get a busy. And the problem is if you call your "Entstoerungstelle 1171" then you can get some troubles. So be wise and do not overdo. van Hauser says : ----------------- Thanks to all Betatesters, especially to : The Analyst, Wilkins & Plasmoid ! Credits for the nice blinking Screen, and scrolling up/down go to Plasmoid ;-) Credits for the basic setup routines go to Scythe! Credits too for the nice EXE file crypter got to Marquis. ;-) Greetings to : Omega (hi chummer! Thanks for your help! And make a BACKUP!) JFF (good work spreading the THC releases) Mindmaniac (linux is great eh :) Scavenger (thanks for the help! (& the best dialer, ya know) El Griton (Where are you?) The Q (Telekom is fun ...) Muchos Maas, Minor Threat (for programming TONELOC, breaking the limit at the art of scanning. Your program gave me GREAT inspirations!) I hope you get out of jail soon. ... and to Dr. Fraud, Dr. Fonk, Chotaire, Coder, Giemor ... all on #bluebox With those guys, the sky is the limit ... ============================================================================== III. HOW TO CONFIGURE TS-CFG & MODEM * Overview : 1. Your modem * -------- 2. TS-CFG 1.YOUR MODEM First get all information about your modem. You need to know which COM Port, IRQ, BASEADRESS and BAUD SPEED is used. For COM IRQ BASE are common, but may differ. 1 4 3F8 2 3 2F8 3 4 3E8 4 3 2E8 HINT: run MOD-DET.EXE to do get the data easily. Also important is the baud speed. Suggestions : If you have a modem capable of 14400 Baud or more, try it with 14400 ... if you get the error message "Can't initialize Port" then set it to 9600. This is cause you use a 14.400+ Baud EXTERNAL Modem and your seriel port is not fast enough. But this is not important. Real scanning freaks set their modem to 2400 Baud to get every carrier without problems. NOTE : This limitation of the baud speed does NOT happen using the FOSSIL Driver support in TS-CFG. 2.TS-CFG Set Up TS-CFG. You have to run TS-CFG for the first time creating the configfile for THC-SCAN (Def:THC-SCAN.CFG). Change the defaults to suit your modem. Everything about the options in TS-CFG are explained there. So here you'll only see those options which need to be explained further and those with no help. MODEM CONFIG MENU ----------------- Modem Init : Configure your modem to wait for a carrier longer then the timeout time defined (S7 register to 60+) The carrier won't be lost easily (S10 reg. to 50) Check exact the time your modem needs to identify the dialtone. Put this time into the S6 Register. The modem should lower datarate when line quality is bad, and it should try to connect on any possiblity. Set speaker on or off as you like. Use the factory settings and only change those things, not more, that's the most securest way. Also important is, that you set the REPORT level to the highest (most time X set to 7) (except you are a modem configuration artist ;-) Note: You can also change the S11 reg to 50-65 to dial faster. MODEM CONTROL - Can either be FAST or SECURE. Choose FAST and try this with a) normal scanning, b) carrier hangup c) choose manual/autonom mode and scan. If everything works fine using this mode, it's much faster. It works great with Zyxels, but USRs are much slower. Try FAST - Can either be CHECK or DUMB Check for an OK after modem init commands. Make stuff a bit faster but for very unusual modems or strange scan settings you must use dumb. Try CHECK - Can either be SMART or WAIT Smart doesn't send the hangupstring after every call. Because you don't need it to do after a BUSY, NO CARRIER etc. But if you set the thc-scan config in a strange way it can be necessary to use wait. Try SMART MODEM COMMAND DELAY Time to wait between modem commands. A Zyxel only needs about 250ms, a USR about 300-350 and a Creatix about 400+. AUTO DETECT DATA If you want to autodetect databits, parity etc. used by a system you're scanning, you must set your modem data to 8N1. It will detect after the first 100 characters transmitted if it's really 8N1, or if it's 7E1 or 7O1. It will switch mode if 7x1 detected and reprint them correctly and reset also the nudge string & nudge timeout. MODEM RESPONSE MENU ------------------- Very important. If this isn't configured properly, not all will work correctly. For example, if a 'no dialtone' is detected, USR modem responds with NO DIAL, Zyxel modem reports NO DIALTONE, and last but not least, Creatix reports NODIALTONE. All new modems report CONNECT when a carrier was found, but old ones may report CARRIER ... and so on. And not all modems can detect VOICE. Keep that in mind. To make your life more easy you can do enhanced identification. When you get a VOICE response, and your modem didn't recognized a RINGING, then it's likely to be a VMB ... so set for there FROM_RINGS to 0 and TO_RINGS to 0 too for VMB detect (and set modem response to VOICE) Make up your mind, you can do powerful things with that but you need a brain to make that out! ;-) hehehehe SCANNING MODE MENU ------------------ REDIAL BUSY In RANDOM SCANNING MODE busy numbers will be redialed. In SEQUENTIEL SCANNING MODE only busy saved numbers from former tries will be dialed again. OVERWRITE WITH BUSY If you scan special ID numbers (f.e. all carrier, or tones - /*: option) this will define if existing data IDs will be overwritten as BUSY when a BUSY is detected. ============================================================================== IV. COMMANDLINE PARAMETERS THC-SCAN.EXE [@] [/M:] [/X:] [/R:-] [/D:-] [/#:] [/H: