TriTel XP1230

All you've ever wanted to know about Phreaking. Many of the actions described in these tuts are illegal. They are presented for informational purposes only.
Post Reply
User avatar
Net Battle Bot
Owns you
Posts: 1816
Joined: Fri Jun 04, 2004 6:44 am
Location: Groom Lake

TriTel XP1230

Post by Net Battle Bot » Tue Feb 22, 2005 7:27 pm

Code: Select all

é é Ø
é TriTel XP1230 é Ø
é Handset Un-Mute & é Ø
é Other Payphones é Ø
é é Ø
é [ Version 1.0 ] é Ø
é é Ø
é ~pHreakaz0id~ é Ø
é é Ø
éúúúúúúúúúúúúúúúúúúúúúúúúúúúé Ø

Contacting the elusive -=pHreakaz0id=-
>> Aust Phreaking Forum <<
>> <<
>> #ausphreak,#p4k on <<
>> <<

"The future is not a single national voice network with
limited connection to the outside world. It will be a mass
of interconnecting networks, under many different ownerships,
of different geographical spreads, offering voice, image,
text and data services from which the customer can choose
quickly and easily."

- Tom McKinlay, DG XIII, Eurpoean Commission [DeBony]


>> Contents <<

* Summation - "TriTel XP1230 Handset Un-mute & Other Payphones"
* TriTel Payphones - The Un-Mute
I. Un-Mute Method for the XP1230
II. The Theory
III. Dispelling the Myths
* TriTel Australia - The Specs
* Protel International & the TrendTek connection
* The Protel XP1230 Payphone - Specs
* Understanding the Payphone Line
I. Payphone Lines
II. Accessing the Line
III. Pricing
* Appendix 1 - PayTel Australia
* Appendix 2 - Siemens Payphones Australia
I. Cityphone Compact
II. Easyset Entry
III. Telstra Interset 751
IV. Diamond (L6 Bluephone)
V. Elasa (Telstra X1/X2)
* Appendix 3 - DORO Zircon Payphones
* Appendix 4 - Vector Technology Corporation (VTC)
* Appendix 5 - Metalwork, Heat Treatment, Tempering
I. Silver Solder Gaff
II. Lock Picks
* Resources & Links


Somewhere in Australia
May 2002

Tucked away in wooden enclaves or against cement-rendered walls flanked 
by bright green palmettes we find the TriTel sitting proudly upon its 
metallic throne. Encased within its plastic aegis, the first TriTel I layed 
eyes upon beseeched me to lift its Electro-dynamic handset and finger the 
delicate yet manipulable keypad as I would a sweet-scented woman.

Enough with the shit, on with the show ...

Summation - "TriTel XP1230 Handset Un-mute & Other Payphones"
This article basically covers the method of UN-Muting a TriTel payphone 
handset for clear Two-Way Communication with your accomplice, or whomever 
has called the phone. It also contains vital information pertaining to these 
new payphones seen frequently throughout all major cities in Australia. They 
are particularly fond of Westfield Shopping Centres and have been known to 
congregate within a variety of other Malls and the like on numerous 
occasions. Recent sitings of TriTel herds have been reported in Universities 
throughout Sydney and strays have been spotted roaming at the occasional 
public venue.
Appendices at the end of the document contain details and various 
information on other exotic and rare payphones throughout Australia.

TriTel Payphones - The Un-Mute
I. Un-Mute Method for the XP1230

(i) From the Caller's point-of-view: When an External party dials the 
number for the payphone, they will hear two rings followed by a long beep. 
After this beep the Caller stays connected to the payphone for a period of 
approximately 2 minutes.
· Anyone attempting to use the payphone will find that they cannot dial 
out since there is an incoming call occupying the line. The External party 
at this point will hear only a hollow sound.
· If anyone lifts the handset at the payphone the External party (or 
Caller) will hear various clicks as it is being manipulated at the source 
and can actually listen in on the DTMF being played down the line as the End 
User attempts to dial numbers on the keypad (however, there several seconds 
of delay between when the DTMF was heard at the payphone and when they are 
heard by the calling party).
· Whilst in this mode the Caller can actually speak to the Receiving 
party (at the payphone) but cannot hear any replies as the handset is still 
· The Calling party remains connected for 1 or 2 minutes as mentioned 
earlier, they will stay connected for the duration of this period even if 
End User's at the payphone lift the handset and attempt to hang it up or 
disconnect the incoming call. As with telephone lines the Calling party has 
precedent over the connection of the call.

(ii) From the [Payphone] End User's point-of-view: When the external 
source is ringing the payphone, for the first two rings there is no 
indication that a call is coming through. Once the external source hears the 
long beep, the LCD screen at the payphone displays "Thank You. Please 
Insert Money/Coins".
· If the Receiving party (person at the payphone) lifts the handset 
*before* the long beep (ie. during the first two calls only heard by the 
Caller): then they automatically "by-pass" it.
· If the Receiving party lifts the handset *during* the long beep: they 
are able to hear the Calling party if they speak loud enough over the beep, 
but cannot reply as the handset is still muted. Sometimes the Receiving 
party is cut-off when they first lift the handset, see the following point 
for details.
· If the Receiving party lifts the handset *after* the long beep: they 
will be automatically cut out, he/she must then depress the hook-switch and 
lift the handset again (or press Follow-On in some cases).
· At this point the End User at the payphone can hear everything at the 
other end of the line but cannot be heard by the Caller. They must dial any 
random 1800 (Free to Caller) number. After a short pause of 2 or 3 seconds 
the handset is un-muted and both parties can have a continuous conversation 
minus interruptions by clicks, beeps or time-delays.

II. The Theory

When studying the XP1230 one begins to understand how it is possible 
that the Un-Mute method described here actually works. As will be detailed 
later on in the article, there are several outstanding features that make 
this payphone distinctly different to that of its rival the Telstra X2 

TriTel payphones work on ROA [R]eversal [O]n [A]nswer, which basically 
refers to the line polarity being reversed when a number is dialled thus 
unmuting the handset and charging the End User accordingly (Free to Caller 
numbers are obviously recognised as such and the payphone cannot charge 
you). (For further discussion on this matter See the chapter Understanding 
the Payphone Line).

The payphone is an American Protel XP1230 model which has its own 
internal recognition software that analyses the actual number itself against 
the time of day & day of the week with a charging table - this is known as 

The reason why the Un-Mute Method works is because when the End User 
dials the 1800 number, the payphone itself (as an individual entity and not 
via CLM) analyses the number that was dialled against the time of day and 
the charging table, within those few seconds it realises that the number is 
Free to Caller and this is where ROA comes into play. The line polarity is 
reversed, no money is taken (since it is free) and the handset is un-muted 
to allow the number to connect. Obviously, the number cannot connect since 
there is already a call occupying the line.

III. Dispelling the Myths

Over the past six odd months the TriTel payphone discussion has reached 
a climax, during that period many myths and misconceptions were distributed 
by pretentious neophytes and other undesirables. Provided are some brief 
points outlining what, in my extensive experience, are known to be fact:

(a) TriTel XP1230 Ring-tone: this does *not* exist. I have heard of 
reference to some TriTel payphones in Canberra that are alleged to have a 
ring tone much like a "hushed" L6 Bluephone. Since there is no evidence to 
the contrary, the current status quo stands that when TriTel phones are rung 
the only external indication that there is an incoming call is a message on 
the LCD screen reading "Thank You - Please Insert Money".

(b) The following payphones *cannot* call a TriTel XP1230 payphone for 
various reasons:

· Telstra X1/X2 Smartphone (Siemens Elasa)
· TriTel XP1230 (Protel)

When one attempts to dial a TriTel from another TriTel, the line is 
immediately disconnected but the Calling party is charged 40 cents for the 
call before it drops out. X2's on the other hand are completely barred from 
dialling a TriTel XP1230 in some areas, but the vast majority are not barred 
from calling other X2 Smartphones.

(c) TriTel payphones *cannot* accept Telstra Phonecards: this is true. 
Even though the XP1230 is infact quite capable of doing so, Telstra has 
barred access. For further discussion on this matter and consultations with 
the ACCC, see the link provided at the end of the "TriTel Australia - The 
Specs" chapter.

(d) Yes, using Bankcards in TriTel XP1230's is perfectly acceptible, 
there are numerous signs on both the payphone itself and the stand 
indicating this.

(e) Free To Caller number the Called Party dials to Un-mute the handset 
can "eavesdrop" on the conversation: this is *untrue* and was confirmed 
after extensive discussion with numerous phreakers on the Aust Phreaking BBS 
and over the phone. The XP1230 is Self-Tariffing rather than utilising 
Customer Loop Metering (See Understanding the Payphone Line) and is designed 
to analyse the number dialled against the time of day and a pricing chart. 
Since the number is Free to Caller (ie. 1800-xxx-xxx) the payphone is 
tricked into un-muting the handset, something which occurs via reversal of 
the line polarity when the called party lifts the handset - although in this 
situation the called party is the payphone itself and the handset is already 
off the hook. Due to the fact that the line is already occupied with a call 
between the external source and the called-payphone, it cannot actually 
connect the 1800 number the End User dialled.

TriTel Australia - The Specs
John Bucknell - Managing Director
TriTel Australia Pty. Ltd.
135 Darling Street, Balmain East, Sydney 2041 NSW
Ph: (02) 9810 0146 Fax: (02) 9810 2780

· Who: TriTel Australia is the only major alternative to Telstra for
public payphones in Australia (see Appendices for others).
· Evolution: Over the past two years TriTel Australia has expanded
from operating payphones in major shopping centres throughout
Sydney and in South Eastern Queensland, to entering the payphone
market across Australia. They are found in Universities, shopping
centres and a few public locations in almost every State and
· Payphone: TriTel use an American payphone that was proven in the
USA to be "highly vandal resistant" - the Protel XP1230.
· Objective: Deliver real benefits to the Australian public by
offering substantially better rates than Telstra payphones.
Compete with Telstra's long-standing monopoly of the payphone

For further discussions on Telstra's smartcard technology trial and its 
associations with TriTel paphones see "ACCC To Monitor Negotiations Over 
Payphone Service":


Protel International & the TrendTek connection
TriTel Australia makes use of the American payphone produced by Protel 
International, one of the major US payphone manufacturers. The payphone 
itself was provided through a contract with TrendTek Australia, the supplier 
of telecommunications products to major carriers, service providers and 
retail organisations throughout the Asia Pacific region. TrendTek receive 
the Protel XP1230 model via Galaxy Payphones (Supplier Code N1141). In 
addition to supplying TriTel with their payphones, TrendTek supplies various 
products to organisations such as Telstra, Optus, Alcatel, AT&T Australia, 
Ericsson, Australia Post and Queensland Payphones.

The particular model utilised by TriTel is titled the Protel XP1230 and 
supports a variety of payment methods and access network connections. 
Network connection of the various payphones TrendTek offers can be provided 

· Conventional PSTN copper links
· Cellular Wireless Networks (GSM, CDMA, AMPS)
· VHF/UHF radio links
· Digital Pair Gain systems

Beneath the vast majority of these payphones - just under the cash box 
to be precise - is a sticker with the following details: "Galaxy Payphones 
(Supplier Code N1141) TrendTek Australia".

The Protel XP1230 Payphone - Specs
The Protel XP1200/1230 Payphone offers a variety of payment options: 
magnetic stripe, microchip and coins/tokens. The XP1200 model is a 
coin/token payphone only; the XP1230 model upgrade (distributed in Australia 
by TrendTek and currently utilised by TriTel) offers both coins/tokens and 
card technology.


· Line-powered, loop start. 48 VDC line voltage, 20 mA minimum.
· Two Protel [Remotely Programmable Electronic] Coin Scanner models
are available:
ECSII: Accepts coins of up to 27 mm in diameter with a max.
thickness of 2.8 mm.
ECSV: Accepts coins of up to 33mm in diameter with a max.
thickness of 3.3 mm.
· Reads all chip cards conforming to ISO 7816 and magnetic stripe
cards Track 2 conforming to ISO 7810 to ISO 7813.
· Optional SAM authentication (5 slots).
· High Contrast Liquid Crystal Display of 2 lines x 20 characters
per line, 9 mm character height.
· Electro-dynamic handset [High Impact Poly-carbonate], hearing aid
compatible with internal stainless steel lanyard with pull
strength of 450 kg.
· Rugged, Vandal-resistant Construction & Stainless Steel Faceplate
· Magnetic Proximity Hookswitch
· Six function keys for Language selection, Volume amplification,
New Call [Follow On], Redial, Change Card, and Emergency number.
[The last three keys are not yet operational in Australia - pH.]
· Encased state-of-the-art electronics for physical and ESD
· High Quality Anti-drill Locks
· 4mm Stainless Steel Vault Door
· Anti-stuffing Coin Return
· Call Subscriber Answer includes line reversal, 12/16 Khz, 50 Hz
pulses, DTMF tones.
· Bi-directional communications with the ProNet Payphone Management
System for Call Detail Records and multiple alarm detection.
· All payphone features, including Operating System, are
downloadable from the ProNet Payphone Management System.
· Self-Tariffing - TriTel Australia does not utilise CLM to operate
its payphones. It analyses the dialled number against the weekday,
time and a charging table to determine the call cost.
· Service Difficulties - dial 1800 181 922
· Utilises 1800 REVERSE (1800 738 3773)
· Directory Assistance - Local: 1223 - International: 1225

Understanding the Payphone Line
I. Payphone Lines

Standard payphone lines differ in several ways to that of a normal 
telephone line. In this section I will attempt to outline the main features 
which distinguish its line configuration.

(1) Dial Tones: Payphone lines have a 60-second dial tone; as opposed 
to normal lines which have a standard 10 seconds (allowing customers time to 
insert money and dial).

(2) ROA (Reversal On Answer): refers to the reversal of line polarity 
when the called party lifts the handset. This is necessary to indicate to 
the payphone when it should take the money, un-mute the handset and allow 
two-way conversation.

(3) CLM (Customer Loop Metering): refers to a mechanism for charging 
calls to mobile phones, long distance and so on. For each timed period the 
exchange sends a pulse which is used to signal the payphone to deduct 
another 40 cents (1 meter pulse = 1 local call). Telstra payphones require 
these meter pulses to operate - this includes their Customer Operated L6 
Bluephones and C4 Goldphones.

(4) Self-Tariffing: the [Protel] XP1230 TriTel payphone does not 
utilise CLM to operate. Instead, it is Self-Tariffing - essentially having 
its own intelligence, which allows it to analyse the dialled number against 
the weekday, time and a charging table to determine the call cost which is 
then displayed on the LCD.

(5) Pre-selected Carrier Barring: the oppressive corporate giant that 
is Telstra did not allow payphone lines to be pre-selected to any other 
carrier during the pre-2000 era. In effect, tens of thousands of L6 and C4 
operators pay full retail rates for each call. In March 2000 Telstra agreed 
to create a new line after consultation with the ACCC, it was to be 
identical to the standard payphone line, minus CLM.

(6) Payphone Lines vs. Normal Lines: payphones such as the TriTel 
XP1230 utilise a Telephone-style 12 Core cable; whilst the common line you 
will come across in your own home is a Normal, Austel Approved, Telephone 
Cable Flat 4 Core. Depending on the area you are in, the copper wires you 
require for beige boxing are Red and Green or alternatively, White and Blue.

II. Accessing the Line

The vast majority of TriTel XP1230's you will come across are encased 
in a stand rather than a booth. In many instances the aperture between the 
stand and the wall it is backed against can vary from a centimeter to an 
inch. If one is able to locate an easily accessible stand with at least one 
inch of space, gently pry it slightly wider and take a peek behind the 
metallic hull. You will notice several chords leading from both the 
mid-section of the payphone and higher up.

(a) White: the thickest chord (several millimeters short of a 
centimeter in diameter) encased in corrugated white plastic, is the power 
source. Do not cut this line.

(b) Blue: thickness of a standard pen, this houses the phone line and 
is known as a Telephone-style cable, 12 Core.

(c) Green-Yellow (striped): several millimeters in diameter, the 
thinnest; this is the insulated Earth copper wire.

(d) Black: some TriTel payphones I have come across have a black 
telephone cable instead, it is a Flat 6 Core cable and is accessed via a 
hole directly underneath the phone itself but in the actual stand, roughly 
5cm in diameter.

(e) Grey: this is also an additional line found inconjunction with 
Black 6 Core cables on some TriTel phones and is accessed via the same hole 
as mentioned above. It is understood to be the Flat Earth copper wire in 
some areas.

If you are able to see the phoneline or ascertain its location, it is 
possible to create a nice hook out of worked silver solder in order to 
"fish" the chord out from behind the stand for beige-boxing. (See Appendix 5 
- Metalwork, Heat Treatment, Tempering to create your own "gaff").

WARNING. Please make sure you are very certain the line you are about 
to strip is definitely the telephone line. Colours vary in different areas 
as I have illustrated above (See d. and e. for some examples of 
alternatives). A simple, yet effective, method of getting to the copper 
wires underneath the insulation *instead* of stripping the line or slicing 
them length-wise with a knife, is to burn off the plastic with a lighter. I 
*will not* take responsibility for anything you attempt to do based on what 
you have read - you do so at your own risk.

III. Pricing

As mentioned earlier, the corporate behemoth, known as Telstra, charges 
full retail rates to all payphone operators who are connected to their 
network. Their payphone division pays an estimated 12 cents per meter pulse, 
(1 meter pulse = 1 local call). Payphone Operators are thus unable to offer 
better rates to the End User due to the method by which they are charged.

TriTel payphones do not need meter pulses to operate (they are 
Self-Tariffing) and are thus able to pre-select to other carriers, 
theoretically able to offer better rates.

Due to Telstra's control of the Phonecard market (for alternative 
phonecards see Appendix 1 - PayTel Australia) and their barring of TriTel 
from allowing the XP1230 to read Telstra SmartCards, TriTel has come out 
with their own brand of Phonecards which are available at various Newsagents 
in certain regions of the country, at this writing they are still hard to 
come by.

Appendix 1 - PayTel Australia
Almost half a year ago, whilst researching various exotic payphones 
available around Australia, I came across the PayTel S400 Satellite 
Payphone. Although I have never seen one let alone operated one before, I 
can provide you with quite a detailed amount of information on it (all of 
which I obtained from their website and am essentially presenting here as a 
means of preservation and future reference). If any of you Melbournites ever 
come across any of these, or anyone across Australia for that matter, have a 
good look at them, try various things and email me with some constructive 
information (Do they ring? Do tonediallers work on them? Is the handset 
muted for incoming calls? Are there any barred services and so on).

PayTel payphones are generally found in a variety of locations and are 
designed for providing remote locations with telephone communication. They 
utilise wireless technology (Analogue / Digital; Cellular Radio, and/or 
Satellite) to provide these services in "mobile environments" or where wire 
connections are not available. They can operate on both credit and 
phonecards - PayTel is the holder of ISO financial card IIN [I]ssuer 
[I]dentification [N]umber 836 600. The phonecards use Magnetic Stripe 
technology encoded with a proprietary data system unique to PayTel. Charges 
for calls Australia-wide and each of 4 ISD call zones are uploaded into each 
S400 by data signalling from the PayTel office (think, Telstra MTMS 

Locations where PayTel S400 Satellite Payphones can be found and are 
applied include: Military; Coaches; Outback Tours; Oil Rigs; Trains; 
Freighters; Mining Camps; Roadside Assistance; Isolated Communication; 
Liners; Remote Events and Emergency Locations.

PayTel is an entirely Australian owned company and claims to be the 
only group providing payphones actually designed and manufactured here.

Pay·Tel Australia Pty Ltd
PO Box 456 (4/43 Railway Road)
Blackburn, Victoria 3130, Australia
Phone: (03) 9877 0222, Fax: (03) 9877 9499

S400 Satellite Payphone - Overview:

· 3rd Generation Coinless Payphone (based on Mk II satellite & cellular
payphones supplied to numerous railway operators across the country)
· "Flash" Memory - payphone operator can change/set phonecall rates, eg.
Subsidy $1 p/min
Cost $2 p/min
Profit $3 p/min
· Features benefits of chosen CAPSAT telephone (phone/credit card phone)
· Payphone Diagnostics performed remotely (data signalling from PayTel
· Allows for pre-paid phone calls
· Operates via Thrane & Thrane Capsat telephone as well as "Inmarsat
· Constructed of strong steel
· LCD (20 x 2) display: Call Duration & Charging Information
· Call payment options: credit cards & pre-paid smart cards (phonecards)
· Payphone Management System provided by PayTel

Further Specifications & Details:

· Measurements: 100mm x 300mm x 380mm (depth x h x w)
· Weight: 5 kg (incl. CAPSAT unit)
· Power: 200-250v AC / 12v DC.
· Solar Power (optional)
· Connection: Voice port & data port, CAPSAT TT-3060, TT-3062A, TT-3062B
· Fittings: CAPSAT unit can be housed in the payphone or separately
· Placement: 4 x 5 mm holes at rear for wall mounting
· Marine protection: Fully cod plated
· Maintenance: Maintenance free, only requires hygiene cleaning
· Call payment: Visa, Mastercard, Bankcard or PayTel phonecard
· Authorisations: Credit Card data sent via modem to PayTel Processing
· Phonecard personalisation (optional at extra charge)
· Cost of service: 10% credit cards, $6.00 phonecards
· Call charging: Variable according to owner (1 minute increments)
· Call cost: As per Telstra standard billing
· Call information: Duration of call, call cost & remaining call time
credit displayed on LCD
· Enviromental resistance: Indoor application only (recommended)
· Coverage: World-wide Inmarsat coverage according to CAPSAT data
supplied separately
· Usage: Graphically indicated on payphone. English language prompts and
information on LCD
· Customisation: Call charges, card information and other variables
according to the owner
· Cards: Compliant with ISO 7811; PayTel holds IIN 836 600

Appendix 2 - Siemens Payphones Australia
"The company is currently the sole supplier to Telstra of owner
operated payphones."

- Siemens

I. Cityphone Compact

The Cityphone Compact is a Multi-chipcard & coin payphone. Siemens 
claim that their new phone model is "world leading technology" but has not 
yet been released in Australia at this writing. Quite a sexy phone I might 
add, silver and sleek (uses Abloy keys I see) but has the same handset as 
the Siemens Elasa (better known as the Telstra X2 Smartphone). Since they 
are not yet on the market I am going off what was written at the site 
re-worded in some cases (See Resources & Links).

(i) Semi-supervised multi-chipcard & coin [Indoor] payphone

· Line-powered payphone for coins and all kinds of chipcards
· Integrated security modules
· S-PMS support & software download
· Visually & mechanically compatible with TSP/TMI
· Modular field upgrades from coin to combinations

(ii) Features

· 2 wire analogue telephone line interface
· DTMF & Pulse dialling
· allows Incoming calls
· Card change function during call
· Various Langauge user messages
· Free to Caller numbers list
· Barred numbers list
· Remote charging
· Self-charging based on polarity reversal (PTT optional)
· Up to 5 coin escrow Upper compartment electronically controlled

(iii) Coins

· Coins escrow
· Remotely programmable electronic coin validator
· Escrow capacity: - 4 coin sequential access - 5 coin random access
· Integrated Coin box (700 cc capacity)
· External coin box optional (2000 cc capacity)
· Electromechanical coin entry slide

(iv) Chipcards

· Chip cards with or without enhanced security algorithms (e.g. SLE
4 43X)
· Electronic purse microprocessor cards

(v) Security Features

· Up to four security modules
· Offline operation
· Cryptographic authentication between chip card and payphone
· Reliable store of the charged units
· Black/white list storage
· Integrated anti line tampering unit

(vi) Statistical Data

· Income (charged quantity)
· Number of calls
· Number of invalid telephone cards
· Management System availability
· Other requirements

(vii) Maintenance Features

· Full diagnostics and tests capabilities
· Menu driven program for guided field maintenance
· Displaying of faulty elements, alarms, parameters and statistics
· Maintenance personnel identification
· Failure clearance reports

(viii) Management System

· Compatible with existing management system (S-PMS)
· Integrated 2400 bps modem
· Parameters up- and downloading
· Software download
· Download of security access keys

(ix) Technical Characteristics

· Process Capacity
* 16 bits microprocessor
* 4 Mbits Flash EPROM memory
* 32 kBytes EEPROM memory
* 4 Mbits RAM memory
· Power supply
* Telephone line powered
· Communications
* Integrated 2400 bps modem
· Keypad
* CCITT standard numeric keypad.
* Function keys
* Hot keys
· Card reader
* Conforms to ISO 7816-2
· Operating environment
* Temperature range - 20°C to 60°C
· Display / Instructions plate
* 2 line LCD display with 2x20 characters

II. Easyset Entry

Another payphone soon to be released on the Australian market by 
Siemens is their latest Indoor coin payphone, the Easyset Entry. All 
information included here is either quoted or r-eworded from data supplied 
online from websites found after extensive researching.

This boy in dark-blue comes with optional Integrated Anti Line 
Tampering security features, which makes for quite an interesting adversary. 
Please note that any of these "not yet released on the market" payphones are 
bound to appear in various locations across the country over the next few 
years, so keep an eye out and keep me posted via email or on the BBS.

(i) Indoor coin payphone; entry model - Features

· 2-wire analogue telephone line interface
· DTMF & pulse dialling
· allows Incoming calls
· 4 different languages for user messages
· Barred numbers
· Free to Caller numbers
· Charging pulses (CLM)
· Self charging with polarity reversal (Push to Talk option)

(ii) Coins

· Remotely programmable coin validator
· Escrow coin storage capacity (2 options):
* 4 coins escrow in sequential mode
* 5 coins escrow in random access mode
· Integrated cash box
· External coin box (optional)

(iii) Security Features

· Reliable collecting scheme
· Integrated Anti-Line Tampering (optional)
· Metal Coin Module

(iv) Statistical Data

· Amount collected
· Number of calls
· Management system access
· Fast dialling keys
· Additional statistics can be implemented on request

(v) Maintenance Features

· Full diagnostics and test capabilities
· Menu-driven program for guided field maintenance
· Display of faulty elements, alarms, parameters and statistics
· Failure clearing reporting

(vi) Management System

· Compatible with existing management system (S-PMS)
· Modem with 1200 bit/s
· Up- and downloading of parameters

(vii) Technical Characteristics

· Processing Power
* 8 bit Microprocessor
* 64 Kbits Flash EPROM
* 32 kBytes EEPROM
* 32 Kbits RAM
· Power Supply
* Line-powered
· Communications
* Integrated 1200 bit/s Modem (V23)
· Keypad
* Standard numerical keypad (CCITT/ITU)
* Function keys
* Fast dialling keys
· Operating Range
* Temperature Range: from 0ºC to +50ºC
· Display
* 2 lines LCD display with 24 characters/line.

III. Telstra Interset 751

Siemens example of "world leading technology" already available in 
Australia. A No-Coins payphone that deals in the latest generation of chip 
cards. I have not yet seen any of these around but they are said to be 
suited to hotels and hospitals and is obviously the reason why. They look 
like a dark blue Optus housephone with a Bright Red handset and a chip card 
sticking out diagonally on the top right-hand corner. Interestingly, this 
one also has anti line tampering modules.

(i) Desktop payphone for latest generation chip cards

· Analogue chip card telephone with integrated anti line tampering
· Bundled with hotel application
· Free flowing data port
· 12 kHz metering or behind PABX
· MTMS support & software download
· Refurbishment option to "as-new" standard for post-Olympic period

(ii) Features

· Analogue telephone line interface
· DTMF & pulse dialing
· accepts Incoming calls
· Number redial
· Change of card during a phone call
· 4 languages
· 8 Hot-line keys
· Storage of barred numbers
· Storage of non-chargeable telephone numbers
· Charge pulse evaluation 16 kHz (12 kHz optional)
· Self tariffing (optional)
· Data socket

(iii) Cards

· Memory cards with algorithm (eg SLE 443X)
· Microprocessor cards with electronic purses

(iv) Security Features

· Up to 3 security modules (eg SLE 44C80)
· Off-line operation
· Cryptographic authentication between chip cards and terminal
· Secure debiting of call charges
· Reliable storage of charge sums
· Storage of black/white list for cards
· Anti line tampering integrated

(v) Statistical Data

· Revenue
· Number of calls
· Invalid telephone cards
· Availability of the management system
· Use of hot-line keys

(vi) Maintenance Features

· Full diagnostics and tests capabilities
· Menu driven program for guided field maintenance
· Displaying of faulty elements, alarms, parameters and statistics
· Maintenance personnel identification
· Failure clearing reporting

(vii) Management System

· Compatible with MTMS Management System
· Modem communication 2400 bit/s
· Parameter upload/download
· Software and firmware download
· Key download to security module

(viii) Technical specification

· Processing Power
* 16 bit microprocessor
* 4 Mbit Flash EPROM
* 32 Kbytes EEPROM
* 4 Mbit RAM
· Power supply
* Telephone line powered
· Communication
* Integrated modem 2400 bit/s
· Keypad
* Numeric keys CCITT standard.
* function keys
* Hot line keys
· Card reader
* Conforms to ISO 7816-2
· Operating environment - Temperature range 10ºC to 40ºC
· Display
* 2 line LCD display with 2x24 digits

IV. Diamond (L6 Bluephone)

Made popular at tens of thousands of locations across Australia, from 
Swimming Pools to Newsagents, Chemists, 7-Eleven and other numerous 
Convenience Stores, Universities, Schools, Pubs, Petrol Stations and a host 
of different "indoor type" locations where these Customer Operated coin-only 
Payphones are in use. Marketted by Telstra as the Bluephone, it has been 
available in Australia since 1988.

Siemens Communications Pty Ltd
Cnr. Herring and Talavera Rds
North Ryde NSW 2113
Mail: Locked Bag No. 2500
North Ryde NSW 1670
Phone +61 137 222 Fax +61 1300 360 222

(i) Features

· Aluminium diecast casework
· Fraud resistant (haha)
· All models suitable for wall or desk mounting
· Electronic coin validation for 4 different coins
· Local, long-distance, international, free, barred and operator
· Follow-on Button
· Decadic (Pulse) / DTMF dialling (payphone identity tone, credit expiry
· Line powered (no mains req.)
· Self diagnosis of faults
· Owner mode facility allows operation as a normal phone
· Hearing aid facility. Fitted with an inductive coupled hearing aid
· 16-character display
· Dimensions: 245mm x 180mm x 310mm (w x d x h)
· Weight: 5 kg
· Operation Range: 0 to 45 degrees Celsius, 10 to 70% RH
· CLM - Called subscriber answer indicated by 50Hz / 12kHz meter pulses.
· Tariff Changing: Pre-set by factory or changed by the owner from the
· Accepts Incoming calls (has loud ring-tone)
· It is possible to do a 1800-REVERSE call from one Bluephone to another

(ii) Security

· Access to the mechanism compartment and cash container is via a single
keyswitch. A 3rd position on this keyswitch allows use of the
equipment as an ordinary telephone. Cash container capacity 1 litre.

(iii) Coin Handling:

· In-line escrow, capacity 4 coins. Coins are cashed as they are used,
in the order in which they are inserted. Unused coins are returned.

V. Elasa (Telstra X1/X2)

Manufactured in Spain, the Elasa model was originally designed for 
indoor use only but Telstra has utilised it as both an outdoor and indoor 
semi-supervised location Payphone. MTMS updates are constantly barring 
certain numbers that phreakers find and exploit excessively (publicly 
announcing "sensitive" numbers on places such as a BBS is highly frowned 
upon - this was how the iPrimus DCX and FAST were barred). There are 
numerous Workarounds publicised by Zaleth in his article and the Method for 
Un-muting an X2 Smartphone Handset are also included in numerous articles 
and is the reason for why it is not included here.

This particular subtitle was included to merely record various other 
information about the Elasa payphone as well as a list of currently known 
facts about X2's. The Smartphones are constantly being updated, some are of 
course not and so the differences vary according to location and other 


(a) The Ringtone: Yes, it is true that *some* X2 payphones have an 
initial two-tone chime to indicate that there is an incoming call. The vast 
majority *do not* have any sort of ringtone.

(b) The Un-Mute: Yes, it is possible to un-mute the handset (refer to 
numerous other articles detailing this method).

(c) Calling other X2's: It is possible to call other X2 payphones from 
an X2 and un-mute the handset for two-way communication. Of course there may 
also exist some X2's that have this capability barred.

(d) Calling TriTel XP1230's: *Some* X2's are barred from calling TriTel 

(e) Workarounds: Yes, these do work and are necessary if you wish to 
call FAST or the iPrimus DCX.

(f) Tonediallers: Some X2's will only accept tonedialler DTMF if at 
least 1 digit has been pressed on the actual keypad, others do not accept 
tonediallers at all.

(g) DTMF Time-delay: Almost all X2 Smartphones have a time-delay 
between pressing the number on the keypad and hearing the actual DTMF being 
played down the line (this only occurs after several digits have been 
pressed). It is possible to find some X2's that are not updated and do not 
have this annoying feature, they simply play the DTMF the moment you press 
the keypad for as many numbers as you dial.

(h) Straw-trick: This is pathetic, old and does not work any longer. 
The vast majority of payphones will not let you complete the call after 
$1.50 or so has been used up in credit (the line is disconnected and ERROR 
appears on the screen). I'm am quite sure that it isn't even possible now to 
do the straw-trick even for that minimal credit (it's been so long...)

(i) MTMS: this is dialled up automatically by the phone when an 
excessive amount of unconnected 1800 numbers have been dialled sequentially.

Appendix 3 - DORO Zircon Payphones
The DORO Zircon is an Indoor Coin-Only type Customer Operated payphone 
and can be found in a number of places, particularly Clubs, Restaurants, 
various Shops, Hotels and so on.

DORO Zircon Specifications:

· Exterior: White ABS plastic; compact design; ergonomic handset
· Four memory buttons for fast access to local business
· Redial; Follow-On; Volume Control; Multilingual selection
· Accepts 20c, 50c $1 and $2 coins
· Can be programmed to accept any new coins introduced in the future
· Raising pip on fifth digit to aid the visually impaired
· Can be affixed to a wall or desktop mounted
· Large cashbox capacity
· Backup battery with five-year life
· Liquid crystal display (single line)
· Help-desk coupled with self-diagnostic facility
· Hearing aid compatible
· Rather loud ringtone
· When called, the line connects as soon as the receiving party
lifts the handset

DORO Zircon MX Specifications (includes those above)

· 2mm secure Steel Jacket
· Secure Cashbox Drawer

The majority of this information was taken from the following webpage, 
which also includes pictures of these Indoor Coin Payphones:


Appendix 4 - Vector Technology Corporation (VTC)
VECTOR Customer Operated Payphone's (VT-200M) are found in a majority 
of places throughout Sydney, particularly associated with Newsagents, Phone 
stores and other venues in the Chinatown district. They have now spread 
across the entire city and can be found just as easily in the suburbs. Be it 
in secure, semi-secure and outdoor locations, they are in in more than 80 
countries worldwide.

Vector Technology Corporation
7F,No.87 Chung-Yang Rd, Sec. 3
Tuchen Taipei Taiwan
Tel: (886 2) 22678080 Fax: (886 2) 22678181
Key Contact: Mr Joe Ran MANAGER

The payphone itself is slightly larger than the Siemens Diamond model 
(or as it is more commonly known, the Telstra L6 Bluephone). The VTC's found 
commonly in Australia are in dark purple ABS Plastic but Vector Technology 
also release models in Yellow, Green, Brick-Red, Crimson-Red, Cream and so 
on. The dark purple model is known as the VT-200M and are Coin Only (they 
are also designed to accept cards, but I have not come across any with this 
feature activated as yet).

VT-200M (VTC Coins-Only Payphone) - Specifications:

· Power: line Power
· Call Limited: Local, STD, IDD, Internet Gateway Acces - (Minimum
insertion options)
· Call Area define: Local 300 sets, STD 300 sets, IDD 400 sets
· Function Button: Hot line, Barred, Emergency Call.
· Coin release: Avoids coin channel being blocked.
· Tariff Rate: Self Tariff, Or System Tariff by Meter Pulsed 12Khz /
16Khz / 50Hz) - Interfaces with all existing metering signals
(Tariff Rates programmable)
· Service Charge, minimum charge.
· LCD 16 Character - Multipurpose display
· Coin Definition: Max 12 Kinds - Smart coin collection - Multi-coin
· Microprocessor Controlled
· Electronic coin diameter validator (VT-100); Electronic
permeability validator (VT-200)
· Self-diagnostics; Cash Box Monitoring; Coin Jam Release
· Coin recognition: diameter, Material
· Tariff Change: By Keypad / By Remote Control System
· Income Monitor: By Keypad / By Remote control System
· Discount Time: 24 Period (Real Time Clock Request)
· Metal CashBox: default 300Pic, External 2000 Pic
· Frame: ABS Plastic
· Desktop / Wall Mouted
· Access to PABX Systems
· Size: 245mm x 183mm x 315mm (w x d x h)
· Weight: 3.5 Kg

Optional Extras:

· GSM 900/1800/1900 Mhz Triple Band Module
· IC Card Option
· Real Time Clock
· External Cash Box

Function List:

Function 00 - Self-Diagnosis
Function 01 - Local / STD /IDD block control
Function 02 - Local/STD/IDD code/rate input
Function 03 - Tone/Pulse selecting
Function 04 - Duration for incoming call
Function 05 - PBX mode setting & Barred code setting
Function 06 - Warning time setting
Function 07 - Hot line program (2 sets)
Function 08 - Accumulation of coins
Function 09 - Coin recognition program (6 different coins)
Function 10 - Money or time display & metering Signal selecting
Function 11 - Owner's password program
Function 12 - Cashbox monitoring password program
Function 13 - Language Mode program (2 languages)
Function 14 - Taxed rate & rate's program for value
Function 15 - Rate's program for timing
Function 16 - Data copy program
Function 17 - Speed dial program (10 sets)
Function 18 - Auto detection (optional)
Function 19 - Real Time clock setting (optional)
Function 20 - Reduce price / periods program
Function 21 - Carrier Setting (reserve)
Function 22 - Date off & service program
Function 23 - Password program
Function 24 - Simple discount
Function 25 - 0+ program (optional)
Function 26 - RMS
Function 27 - Version no.
Function 28 - Cashbox / Volume Selecting
Function 29 - Internet Gateway Access

VT-200M Additional Information:

(a) Call cost is generally 50 cents per local call, $1 initial call to 
mobile phones.

(b) Buttons: Follow On, ReDial, Loud.

(c) Payphone line: Standard Flat 4 Core Telephone-style cable, [Austel 

(c) 50 cents must be inserted in order to place a 1800 call, the vast 
majority of VTC phones I have come across will actually charge you for 
placing that call - a few simply return the money.

(d) When attempting to dial a 1800 number without money the first digit 
registers and the DTMF for 1 is played down the line. However, the following 
7 numbers (ie. 800-xxx-x) will not register, after which the phone resets 
and asks again for 50 cents. A mobile phone used as a tone dialler will not 
work, even after one button is pressed on the keypad. The "Follow On & 
ReDial" Workaround pertaining to X2's will not work either since the VTC 
will only register the initial DTMF tone if no money is placed in.

(e) VTC payphones can be rung and the line is connected as soon as the 
receiving party lifts the handset. The ring-tone is similar to that of the 
L6 Bluephone only slightly higher-pitched and louder in some cases.

Appendix 5 - Metalwork, Heat Treatment, Tempering
I. Silver Solder Gaff

You can purchase pieces of Silver Solder from Hardware supply stores, 
particularly the larger ones as many of the regular BBC stores in your local 
area may not actually stock any of it (you'd be surprised). Silver solder is 
quite literally, solder containing silver - and is a long piece of solder 
about 3 millimeters in diameter and usually found about a metre long. It is 
easily recognisable in a brown or shiny grey-brown colour and much more 
stiffer than flimsy wire coat-hangers or other similar pieces.

A gaff, by definition, is a device for hooking fish; but in the 
phreaking sense I apply my miniaturised-gaff device to "fishing" phonelines 
out from the back of payphones, particularly the TriTel XP1230's as they are 
accessible this way (the stands are sometimes an inch off the wall). Since 
pieces of silver solder can be quite long it is effective; an accomplice can 
stand beside you and hold the gaff in place while you have access to the 
line and do what you will.

· Using a strong and larger pair of pincers bend the silver solder at a 
point no more than a few inches from one side (as you do not want to lose 
too much of its overall length). It may take some effort in straightening 
and bending (sometimes a hammer can assist in getting it to the right angle) 
so that two halves are parallel with one another and there is roughly 1 cm 
of gap between them (this provides the perfect hook shape at the bend).
· With the same pair of pincers clip off the shorter half right at the 
point where the bending stops. Make sure that any sharp edges are smoothed. 
Keep the long section as straight as possible since it can be quite 
frustrating attempting to fish for phonelines with a crooked gaff.
· A pathetic ASCII drawing is provided here for my amusement and also 
your own. Enjoy. NB. this picture is *greatly* reduced in size.

II. Lock Picks

While this topic is not entirely related to anything else in the 
article, it was put in firstly as a prelude to a future article covering 
this area; and secondly since the methods for tempering and manipulating 
metals applies to both the construction of gaffs and picks. I will attempt 
to apply the metal treatments for lockpicks to making a perfect gaff (for 
the obsessed).

Constructing a strong torque wrench is done by choosing a nail that 
suits the various locks you have been studying. Nails which are roughly .25 
cm in diameter, once turned into a torque wrench, suit a majority of locks 
you may come across. Please note that some Lock Picking articles online 
refer to the "torque" wrench as a tension wrench. Utilising a propane torch 
to heat up the nail is ideal, once it glows red gradually remove it from the 
flame and allow the air to cool it down - this basically softens the metal. 
You can apply this to the silver solder for making your gaff.

· At the point at which you intend on bending the silver solder for 
producing the "hook" tip apply a propane torch flame (or gas stove flame if 
possible) to the area until it turns red as one does when preparing the 
torque wrench. Once the silver solder has cooled in the air it is soft and 
easily manipulable.
· Bend the silver solder at the softened point so that two halves are 
parallel with one another and there is roughly 1 cm of gap between them 
(exactly as you would in the I. Silver Solder Gaff description).
· With a strong pair of pincers cut off the shorter half right at the 
point where the bending stops (exactly as you would using the more crude 
method of gaff construction detailed in I. Silver Solder Gaff above).
· To harden the hook, now that it has been neatly bent and excess silver 
solder cut off, you will have to temper it by heating the hook end with the 
propane torch or gas stove flame till it is bright orange. Once it has 
reached this state immerse the heated portion in a bucket of ice water. You 
will end up with one of the strongest and finest constructed Silver Solder 
Gaffs around.
· NB. Make sure that the hook-tip is not too sharp, grind it smooth or 
flatten it and file down the edges manually (you dont want to be "fishing" a 
line to see if it is the power source or phone cable and end up peircing the 

Resources & Links
Some of the information included in here was obviously obtained from 
online sources that I personally researched and has been mainly paraphrased, 
re-written in comprehensive terms to partially quoted. These pertain to the 
payphones that I was not able to get physical access to (particularly the 
PayTel S400 and the four new Siemens payphones).

* Siemens

* Pay·Tel Australia

* DORO Zircon

* Vector Technology Corporation

* TrendTek Australia

* Protel International

Perhaps this will serve to show neophytes entering the scene and 
wondering how they can start learning more, that the value of research is 
immeasurable. It may take hours, even days before you find what you are 
looking for, but the rewards far exceed the cost. The most useful search 
engine of them all in my own opinion is the wondrous


Until next time, Addio miei amici. I hope you enjoyed the article and 
found it as helpful as it was informative. Positive feedback is always 




Without practice one cannot prove; without proof one cannot be trusted; without trust one cannot be respected.

Post Reply