ToneLoc

 < Day Day Up > 



ToneLoc is a DOS-based war dialer that simplifies the work of managing a full phone exchange of 10,000 numbers. It provides the ability to manage multiple dialing sessions, annotate specific phone numbers, launch custom programs against certain modem responses, and analyze data. Several command-line options are available, but you can also use a menu-driven interface in an ASCII-based window. Before you begin to work with ToneLoc or THC-Scan (covered later in this chapter), your system’s modem must be properly configured. One of the best features about these tools is that they do not require special drivers or hardware, simply a working modem.

Implementation: Creating the tl.cfg file

Before you can run ToneLoc, it must be configured so that it knows on what communications (COM) port to find the mode, what time delays to follow, and where to store results. Run the tlcfg.exe utility to set up these options. This launches an ASCII-based graphical user interface (GUI), as shown in Figure 18-1. Use the arrow keys to navigate between and within each menu. Press the ENTER key to open a highlighted menu, and press the ESC key to close the menu.

click to expand
Figure 18-1: ToneLoc’s configuration utility, tlcfg.exe

From the Files menu, you can specify custom names for each of the Log, Carrier, and Found files. These files contain the dialing results, including responses such as busy, timeout, or login prompts. To keep track of multiple ranges, it’s best to name these based on the exchange or an easy mnemonic. The Black List file contains a list of numbers never to dial, such as 911. The Alt Screen displays an inline help menu. These options are shown in Figure 18-2.

click to expand
Figure 18-2: ToneLoc custom file locations

Note 

ToneLoc is a DOS-based utility, so you’re limited to the 8.3 filename convention. You’ll have to use terse descriptions!

From the ModemStrings menu, you can customize the Hayes commands (also referred to as AT commands) for your modem. Change the dial prefix from ATDT to ATDT*67 to block caller ID, for example. You can also hard code other dialing prefixes, such a ATDT 9,1907, which automatically obtains an outside line (9) and dials long distance (1907). Unless you’re using an extremely nonstandard modem, accept the other default options. If you do have problems getting ToneLoc to dial a number, double-check the Init String and Tone Hangup options for your modem. A nice description of the Hayes commands can be found at http://www.modemhelp.net/basicatcommand.shtml. Figure 18-3 shows the available modem commands found on the ModemStrings menu.

click to expand
Figure 18-3: Modem commands

Use the ModemOptions menu, shown in Figure 18-4, to specify the physical settings for the modem, such as the COM port to which it is connected. The Windows Control Panel has a summary of these options under Phone And Modem Options if you are unsure of what values to use. Most of the time, you need to set only the COM port. One of ToneLoc’s drawbacks is that it cannot manage multiple modems to perform tasks such as automatically distributing phone numbers across a bank of four modems. However, if the computer has four modems, one on each COM port, you can create a semblance of load distribution by creating four configuration files whose only difference is the COM port. We’ll describe this in more detail later on in this section. The baud rate is the rate used to talk to the modem; changing this will not affect how the modem connects to remote modems.

click to expand
Figure 18-4: Modem options

Take note of the ScanOptions menu. You may have to play with the Between-Call Delay and Wait Delay settings. Both of these values are in milliseconds. Increase the Between-Call Delay if ToneLoc appears to hang the modem or does not dial sequential numbers properly—this is usually an indication that the modem needs more time to reset itself before the next call. The Wait Delay is extremely important. This is the amount of time that ToneLoc waits for an answer. It affects how long a scan will take. ToneLoc can average a little over one dial a minute with a Wait Delay setting of 45 seconds (45,000 milliseconds); this means about 16 hours to dial 1000 numbers. It’s a good idea to try a low number here, around 35,000. This catches modems that are intended to pick up on the first or second ring but misses others. However, you can always go back and dial the numbers marked as “timeout” with a longer Wait Delay.

To capture the data from discovered carriers, make sure the Save .DAT Files, Logging to Disk, and Carrier Logging options are set to Y. Refer to Figure 18-5 for an illustration of these menu options.

click to expand
Figure 18-5: ScanOptions menu options

After you’ve configured ToneLoc with your desired settings, save the file to disk. By default, tlcfg.exe saves the file as tl.cfg. You should rename this file to something more descriptive, such as 1907-com1.cfg. This makes it easier to locate.

Note 

Tlcfg.exe always operates on the filename tl.cfg. You will have to rename custom files back and forth from the default to modify them.

Implementation: Running a Scan

With the configuration file created, ToneLoc is ready to run. Its command-line options provide a high level of customization:

ToneLoc  [DataFile]  /M:[Mask] /R:[Range] /X:[ExMask] /D:[ExRange]                      /C:[Config] /#:[Number]                      /S:[StartTime] /E:[EndTime] /H:[Hours] /T /K

The DataFile contains the dial results. The filename must follow the DOS 8.3 (name.extension) naming convention. Each DataFile (*.dat) contains dial results for a full exchange. For example, 555-0000 through 555-9999 is a full exchange of 10,000 numbers. The easiest way to keep track of information about dialed numbers is to name the file based on the prefix to the exchange, such as 1907836-.dat. Also, use the /C option to specify the custom configuration file created by the tlcfg.exe program.

C:\toneloc.exe 1907836-.dat /C:836-com1.cfg
Tip 

Naming the .dat file with the phone number prefixes instructs ToneLoc to use those numbers as the default phone mask—that is, the phone exchange to dial. This eliminates the need to use Mask options on large scans.

Use the Mask, Range, ExMask, and ExRange options to focus a scan against specific portions of the exchange. The mask is formed with a seven-digit phone number with X’s for substitution placeholders. The following mask settings are all acceptable to ToneLoc:

/M:555-XXXX /M:555-1XXX /M:555-X9XX /M:555-XXX7

In each case, ToneLoc substitutes 0 through 9 for each X. If you use the /R option alone, ToneLoc assumes the name of the .dat file is the mask and uses the last four digits specified with R:

C:\toneloc.exe 1907836-.dat /C:836-com1.cfg /R:0000-9999 C:\toneloc.exe 1907836-.dat /C:836-com1.cfg /R:1000-1999 /R:3000-3999

Use /X and /D to exclude an entire range of numbers. These are useful when distributing an exchange across modems. For example, if you have four modems for the 1-907-836-xxxx exchange, you can run them concurrently against separate portions of the range. Notice in the following code listing that you can specify the /D (and /R and /X) options multiple times on the command line, to a maximum of nine times per option.

C:\toneloc.exe 1907836-.dat /C:com1.cfg /M:1907836xxxx /D:2500-9999 C:\toneloc.exe 1907836-.dat /C:com2.cfg /M: 1907836xxxx /D:0000-2499   /D:5000-9999 C:\toneloc.exe 1907836-.dat /C:com3.cfg /M: 1907836xxxx /D:0000-4999   /D:7500-9999 C:\toneloc.exe 1907836-.dat /C:com4.cfg /M:1907836xxxx /D:0000-7499

This gives each modem 2500 numbers to dial.

The /S and /E options come in handy for limiting scans to times outside of normal business hours. Make sure you use the correct syntax; otherwise, the scan won’t run at the intended time:

C:\toneloc.exe 1907836-.dat /C:836-com1.cfg /S:6:00p /E:6:00a C:\toneloc.exe 1907836-.dat /C:836-com1.cfg /S:11:00p

Figure 18-6 shows the ToneLoc interface while it dials a range of phone numbers.

click to expand
Figure 18-6: ToneLoc in action

Implementation: Navigating the ToneLoc Interface

Dialing 1000 numbers takes a long time. It is unlikely you will need to monitor ToneLoc while it dials every number. However, a few key commands can help you monitor and mark numbers as ToneLoc patiently dials through the list. Table 18-1 lists the most useful commands. The tl-ref.doc file in the ToneLoc distribution contains a complete list.

Table 18-1: Important ToneLoc Screen Commands

Command

Description

C

Mark the current number being dialed as a CARRIER. ToneLoc is pretty reliable for detecting carriers, but this option is available anyway.

F

Mark the current number being dialed as a FAX machine.

G

Mark the current number being dialed as a GIRL (that is, a voice answers the phone). You can also use V.

K

Enter and save a note for the current number.

P

Pause the scan (press any key to resume).

Q

Quit the program.

R

Redial the current

S

Toggles the modem speaker on or off. This is handy because the modem connection noise gets annoying after a while.

X

Extend the current timeout by 5 seconds.

V

Mark the current number being dialed as a Voice Mail Box (VMB).

[spacebar]

Abort the current dial and continue to the next number.

[esc]

Quit the program.

.dat File Techniques

ToneLoc acknowledges that the .dat files contain all the information and that it is necessary to retrieve and manipulate that data. Consequently, ToneLoc provides a few utilities to help you accomplish this.

A primary benefit of storing scan output in .dat files is the ability to go back and redial certain types of responses. The tlreplac.exe helper utility enables you to modify entries in the .dat file. The .dat file contains a single byte for each number in the exchange, for a total of 10,000 bytes. Each number has a value that corresponds to one of several possible results from a dial attempt:

UNDIALED

[00]

ToneLoc has not yet dialed the number.

BUSY

[1x]

A BUSY signal was detected.

VOICE

[2x]

A VOICE was detected.[*]

NODIAL

[30]

No dial tone was received.

ABORTED

[5x]

The call was aborted.

RINGOUT

[6x]

The Ringout threshold was reached (set by tlcfg.exe in ScanOptions).

TIMEOUT

[7x]

The Timeout threshold was reached (set by tlcfg.exe in ScanOptions).

TONE

[8x]

ToneLoc received a dial tone.

CARRIER

[9x]

A carrier was detected.

EXCLUDE

[100]

The number was excluded from the scan.

[*]Most of the time, this means a FAX machine.

The tlreplac.exe reads a .dat file and changes a value from one type to another. For example, you can redial each number that received a busy signal by reverting it back to undialed:

C:\tlreplac.exe 1907836-.dat BUSY UNDIALED TLReplace;  Replace ToneLoc .DAT tone responses with something else             by Minor Threat and Mucho Maas, Version 1.0 Using Data File: 1907836.DAT     Marking BUSY responses as UNDIALED. 122 responses were changed.

When you rerun toneloc.exe with this .dat file, it redials all the busy numbers—there’s no need for you to go back through logs and manually mark numbers to redial! This is useful for TIMEOUT and RINGOUT numbers as well.

Prescan.exe

The prescan.exe utility helps generate a .dat file based on a list of numbers. For example, you might have a text file with only 400 numbers to dial for a certain exchange. Rather than try to create a complicated set of include and exclude masks, use prescan.exe to generate a .dat file quickly.

First, the text file should contain only the last four digits of the phone number. The first three are assumed to be uniform for each number. Then, run prescan and mark each number as BUSY. By default, prescan will mark every other number UNDIALED. We need to start out with the BUSY description for our target numbers so that we can make a distinction between numbers that should be dialed and numbers that should never be dialed (every number outside of the range).

C:\prescan.exe num_list.txt BUSY PreScan v.04ß -- Fill a ToneLoc datafile with known exchange data Sorting "num_list.txt"... Generating Header info... Processing Data... (100%), done.

A new file, prescan.dat, is created that contains a datum for all 10,000 numbers (0000–9999) in the exchange. Remember that the numbers that we are going to dial are currently marked BUSY and the ones we will never dial are currently marked UNDIALED. However, you must convert the prescan.dat file from the old ToneLoc format that prescan uses before you can fix the BUSY/UNDIALED situation. Handily enough, a tconvert.exe file can do this:

D:\Tools\tonelocTCONVERT.EXE PRESCAN.DAT TCONVERT;  ToneLoc .DAT file conversion utility to 1.00 datafiles            by Mucho Maas and Minor Threat 1994 Converting PRESCAN.DAT to 1.00 format ... PRESCAN.DAT : 0.98 -> 1.00 Ok

Now we need to distinguish between the UNDIALED numbers, which were not included in our original list, and the BUSY numbers, which we need to dial. The tlreplac.exe file makes this easy. We mark the UNDIALED numbers as BLACK—for blacklisted. This prevents ToneLoc from dialing them, even accidentally.

C:\tlreplac.exe PRESCAN.DAT UNDIALED BLACK Using Data File: PRESCAN.DAT Marking UNDIALED responses as BLACKLIST. 9600 responses were changed.

Then we turn the BUSY numbers back to UNDIALED:

C:\tlreplac.exe PRESCAN.DAT BUSY UNDIALED Using Data File: PRESCAN.DAT Marking BUSY responses as UNDIALED. 400 responses were changed.

Finally, we have a prescan.dat file that contains the few numbers that we wish to dial and that have been correctly marked UNDIALED. Any other number will be ignored. These steps may have seemed complicated and unnecessarily obtuse, but they can be replicated in a simple batch file:

rem prep.bat rem %1 = area code, %2 = exchange, %3 = text file input PRESCAN.EXE %3 busy TCONVERT PRESCAN.DAT TLREPLAC PRESCAN undialed black TLREPLAC PRESCAN busy undialed copy PRESCAN.DAT %1%2.dat

Next we rename prescan.dat to the target area code and exchange, and then run ToneLoc and wait for a response.

C:\move prescan.dat 1907836-.dat C:\toneloc.exe 1907836-.dat /M:1907836xxxx

Even though the mask signifies xxxx, which would normally mean numbers 0000 through 9999, only the phone numbers in the .dat file that fall in this range will be dialed. Any blacklisted number will be ignored.

Analyzing .dat Files

ToneLoc also includes three utilities that generate simple statistics based on .dat file results. Tlsumm.exe gives a summary of all .dat files that it finds in the current directory.

C:\>Tlsumm.exe  * Summarizing *.DAT ... filename.dat:  tried  rings  voice  busys  carrs  tones  timeouts   spent -------------  -----  -----  -----  -----  -----  -----  --------   ----- SAMPLE8A.DAT:  10000   1432      0   1963      0      4      6575    0:00 SAMPLE8B.DAT:  10000   1659   5853    466     47      0      1973    0:00 -------------  -----  -----  -----  -----  -----  -----  --------   ----- Totals:        20000   3091   5853   2429     47      4      8548    0:00 -------------  -----  -----  -----  -----  -----  -----  --------   ----- Averages:      10000   1545   2926   1214     23      2      4274    0:00 -------------  -----  -----  -----  -----  -----  -----  --------   ----- 2   DatFiles   tried  rings  voice  busys  carrs  tones  timeouts   spent 

You can specify other wildcards in addition to the asterisk (*) to match a smaller number of files.

Tlreport.exe provides statistics on a specific .dat file. Provide the target filename on the command line:

C:\>tlreport.exe PRESCAN.DAT Report for PRESCAN.DAT: (v1.00)                   Absolute   Relative                    Percent    Percent Dialed    =10000  (100.00%) Busy      =  479  ( 4.79%)   ( 4.79%) Voice     = 2242  (22.42%)   (22.42%) Noted     =    1  ( 0.01%)   ( 0.01%) Aborted   =    2  ( 0.02%)   ( 0.02%) Ringout   = 3683  (36.83%)   (36.83%) Timeout   = 3563  (35.63%)   (35.63%) Tones     =    0  ( 0.00%)   ( 0.00%) Carriers  =   29  ( 0.29%)   ( 0.29%) Scan is 100% complete. 56:03 spent on scan so far.

The Absolute Percent column applies to the percentage of each category out of all 10,000 possible numbers. The Relative Percent column represents the percentage for each category out of the total numbers dialed.

Finally, as shown in Figure 18-7, you can display the results in a graphical format. Each square in the ToneMap represents a single phone number. Although this is a cumbersome way to go through data to identify carriers, it shows trends across the dataset. Use the tonemap.exe utility to display this graphic. When you left-click the cursor over a color spot in the ToneMap, the phone number appears in the lower right-hand corner. This enables you to match a phone number with its color-coded definition:

click to expand
Figure 18-7: A sample ToneMap

C:\tonemap.exe sample2.dat



 < Day Day Up > 



Anti-Hacker Tool Kit
Anti-Hacker Tool Kit, Third Edition
ISBN: 0072262877
EAN: 2147483647
Year: 2004
Pages: 189

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net