*SWAT MAGAZINE ISSUE NINE: SEPTEMBER 1998*
**********************************************************************
|		     .Three Digit Test Code Scanning.		     |
|                          by =The-Doh-Boy=	     		     |
-----------------------------------------------------------------------


For all you phreaks who enjoy messing with the network, you will need a
good understanding of the three digit code (or 3D Codes for short)
Most of these interesting codes begin with 1 and they may vary from 
exchange to exchange, so this in itself is a good reason to go out and 
experiment for yourself. 
One particular code which works everywhere is 175. This allows you to 
test the line for faults, find out the number of COCOTs, power down the
line if little idiots bug you at a payphone. Onion did this recently 
when a little kid harrassed him at a card phone, "You can't put money 
in that fone!" said he, Onion had a card in it. As soon as he had 
dialled the number he then got "Wannee hurry up". A quick 175 then 02 
solved this problem. He could then use the phone three minutes later.
Also in an exchange I frequently pay visits to (An Erricsson Sys Y 
exchange I think), If you dial up 176 the readout display may tell you 
"Calls to this no. are barred". I actually found a way round this out 
of frustration. My thoughts ran a bit like this:
"Stupid fone I'll sort you" Begins bashing repeatedly 176 on the 
keypad. Fone then increases its volume, and I dial 176 again.
Fone actually begins to ring even though not on hook!!!!
When placed on hook between rings and picked up again there is a dial 
tone and cuckoo tone.
I think this lets you dial more test codes, or perhaps telefone 
numbers, I've yet to see.

Another thing I discovered is dialing 1241 gives you some RayCall 
Triple-C Service. It actually asks for your account number and pin. 
God knows what it is!
Yet another trick I've come accross is when you get 175 to ring back 
(just hang up when she says: "START TEST") And then hang up for about
a second and then pickup the exchange pulses out a clear forward signal
to the line. If timed correctly (even after two levels of testing) you 
get a blank line as though you'd pressed a digit. If you have KP and ST
tones for DTMF (or a silver box) then....
175 testing goes through many levels (I'm not sure how many) the level 
of the test can be gauged from the first digit in the code 02 is on the
first level and 12 on the second.
An excellent number to try (use your tone dialler for this and others 
where possible) is 17070. This number lets you test other peoples 
lines, send tones down their fone, and even power down (or clear down) 
someone elses line!!!
Scanning for a complete map of numbers in you exchange is not hard and 
would take about an afternoon at a payfone with your tone dialler. 
Basically just dial 1xx (Staying clear of 112 which is emergency 
services) and listen. If it gives an engaged tone then its not an 
interesting number. If it does not do anything try adding more digits.
If it then rejects the number then add a different number. If you get a
result write it down (you can map the internals of the number later). 
You should end up with ten numbers and up to manipulate the exchange as
though you worked for the gestapo as an operator.
Enjoy this and don't forget to report anything you find to me at 
Babel86@Hotmail.com, I gave you the info to start with so I deserve 
some report back to further our knowledge. If the info is good it may 
end up in the magazine (with full credits).