-= The craserv file =- <<------------>> Written by Slip-n0t Table of Contents Disclaimer <- Important, read this Intro, Millennium Phones What is 'craserv'? How do I use it? Prompts, displays and menus Main display "Enter PIN" prompt "Enter op code" prompt "Open terminal" prompt Other prompts and displays PINs Op codes Conclusion DISCLAIMER This file is meant for information purposes only, tooling around with your local payphones probably won't have the owners of such phones and local law enforcement looking at you in a very good way. I don't suggest that you try the things in this file, and if you do and you get caught it is not my fault. INTRO If you are living in North America and are interested in telephony then the chances are that you have seen, or at least heard of the new Millennium phones from Nortel. These are the nice shiny Polished aluminum payphones, with scrolling LCD displays, and a bright yellow/orange card reader. They come in a few different flavors, card-reader only (these have no coin slots and do not accept cash), and the standard Universal phones which will accept both cash and card payment. This file will not delve too deeply into all aspects of the Millennium phones features and security as there are a few great files out there (easily found at www.hackcanada.com) which have already covered this topic much better than I could. I would highly suggest these files as a prerequisite reading to this file. WHAT IS 'CRASERV'? 'Craserv' is a command that allows a telco technician (or some punk kid with too much information) to access a menu from where op codes can be entered. Craserv is 2727378, there are rumored to be more command codes like it (read the recommended files) but some say that they are no longer working. In the earlier files 2727378 was said to have been a rumored, and untested code. Well I have tested it in the 604 area code and it does work. HOW DO I USE IT? To use craserv you must approach a Millennium phone and type 2727378 on the keypad while the phone is _hung_up_. If you have done this correctly you should see the "enter PIN" screen. PROMPTS, DISPLAYS AND MENUS MAIN DISPLAY The displays on the phones are two rows of LCD screens, each with spaces for 20 characters across, using a 5-wide by 7-high font. The normal display will be something like: " Please enter $0.25 " Followed by a scrolling line of text which will probably contain the time, date, and a gay little message from the telco that owns the phone. "Enter PIN" PROMPT If you have just typed in 2727378 then you should be prompted with a screen that says: "Enter PIN: [][][][][]" "FIX=<>,SAVE=*,STOP=#" Now you can type in a 5 digit PIN code. (More info on this later) "Enter op code" PROMPT If you have just visited the PIN screen and entered a valid PIN then you should be greeted with a screen that looks very similar to this: "Enter op code: [][][]" "FIX=<>,SAVE=*,STOP=#" Now you can type in a 3 digit op code. (More info on this later) "Open terminal" PROMPT If you entered a valid PIN that didn't prompt you for an op code then the chances are that you will be prompted with a screen saying something like this: "Please use key to open terminal" I am not exactly sure of what this does, other files have claimed that when you enter this code there is a motor noise, leading them to believe that some internal lock has been de-activated with this code. I however have not heard any noises any of the many times that I have entered one of these codes. I believe that when it says "open terminal" it means for you to open the top part of the phone that gives you access to the ports inside. And if you have read the other files you will know that all the phones are equipped with alarms to deter tampering. My educated guess is that this code does not do anything physical, but it temporarily deactivates the internal alarm so that a service technician can open the phone without having an alarm blare in his ear. (More info on "open codes" later) OTHER PROMPTS AND DISPLAYS If you enter an invalid PIN from the "Enter PIN" menu you will see: "Invalid PIN access denied" and you will be promptly booted out of the craserv menus back to the "main display" If you enter an invalid op code from the "enter op code" menu it will say: "not a valid op code, please try again" then there will be a short pause, after which you will return to the "enter op code" menu. If you have already entered 8 valid op codes and you try to enter a 9th you will see: "Maximum of 8 codes, last code not saved" after a few seconds you will be dropped back to the "main display" PINs Now, for all I know both PINs and op codes may be regionally different, so unless you live in the 604 area code this may be of little use to you. Sorry, but you will just have to wait until someone from your area gets off their ass to write a file. After you have entered 'craserv' you will see the "Enter PIN" prompt. PIN codes are 5 digits long and from what I have discovered they follow a easy pattern. Range of codes Function of codes. 00000-39999 'Enter op code' 40000-79999 'Open terminal' 80000-99999 'Invalid PIN, access denied' There are likely a few codes hidden within there that do not fit this nice little pattern, but hopefully they will do something special, so you will be glad to find it, not upset. I obviously don't have the time to test all 100,000 possible PINs to see what they do, but the pattern seems to be pretty solid, I don't think that I have found an oddball that doesn't fit in it yet. OP CODES As was stated earlier I am not sure if op codes are hard-wired into the phones circuitry, in which case they would be universal, or if they are programmable regionally. In previous files there have been rumored op codes. I have tried them on phones in my area but to little avail. This leads me to believe that the op codes are programmable regionally. I have tried random codes with little success, but have discovered that all op codes that start with 9 give the "Not a valid op code, please try again" display. These are the codes that have been displayed in earlier files. (Thanks to Syko416 and twiggy) 267 # Answer detect 274 # Display brightness control (down?) 277 # Display brightness control (up?) 349 # Unknown - Someone know this one? 636 # Memory Access 688 # Unknown - Possibly the "Out of Service" message 66666 # Motor sound, prompts to open phone - Probably coin removal 996 # "Error has occurred" As far as I know none of these codes work in my area. 66666 is a PIN and it fits in with my theory because it gives the open terminal command. 996 and any other op code that starts with 9 will say "not valid". I think that there may be a code that will give you a test line, so that technicians can test the phone even if they don't have any coins. When you punch in a 3 digit op code and press * it will save the op code. You can enter in up to 8 codes, if you try to enter a 9th code it will tell you "Maximum of 8 codes, last code not saved". After this it will put you back on the main screen. If you use craserv again and enter a PIN you will (as expected) be asked for an op code, however if you try to enter an op code you will get the "max 8 codes" message again. After a few tries you will be able to enter op codes once again. On one certain occasion while waiting for a bus I entered in a few op codes, and when I tried to enter more I kept getting the max * codes message. I kept trying to enter codes for a good 10-15 tries but it still would not let me. CONCLUSION There are quite a few things that should be possible to do using craserv, but it will take a lot of time to try them all out using brute force. If anyone manages to "acquire" an official manual on these phones please do us all a favor and post it somewhere easily accessible. I hope that this file was informative to you all, if you come up with any new developments make a file of your own. Special thanks to SPLurge, D0t, the #2600ca crew, Hack Canada and all the others who have done previous research on the Nortel Millennium Phones 10/18/1999