Voice Inversion Descramble time/mci .. IT works

[Jammin_Jay]

I have some people emailing me asking about voice inversion how to descramble it.
For those interested in Voice inversion descramble. I can currently pick up Smithsfalls police. A voice inversion descramble program can be downloaded from www.tetrascanner.com .

Take in consideration the following 2 things:

This program works great. U must know how to use it properly

1. U must have a full duplex sound card in order for it to work or
you will here nothing.

2. Volume must be near audible limits to decipher speech on your
scanner and you must narrow down the Tone frequency to de-invert

Smithsfalls police are 7000 hz or 7khz

Once i find the other tone carrier frequencies for brockville,perth and gananoque i will have them. U can message me about them so i don'thave to keep posting on here. These are for Time/MCI radio systems carrier frequencies for Voice Inversion.

Important: FULL DUPLEX sound card MUST be in your system so u can simultaneously input from scanner and output to speaker.

Half duplex will not work. Determine what your sound card is first before u attempt this or it will not work.

 

[Jammin_Jay]

Smithsfalls police 142.305 mhz @ tonecarrier 7000 hz or 7 khz
Brockville police 142.935 mhz @ 7100 hz or 7.1 khz

 

[I_10_92]

I thought descrambling radio communications wasnt exactly legal...

 

[DaveH]

That is my understanding of the US laws, but I am a bit cloudy on the Canadian technicalities. Again, simple inversion scrambling is not "encryption" although it's often called that. Breaking a rolling-code system might fall into the "decryption" area, but not in this case.

As far as Jay's numbers, I can't argue if you say it works, but something's not quite right. If the inversion frequency was 7kHz, you wouldn't be able to pass the voice over a channel with lower bandwidth (about 3kHz). All of the voice frequencies are "inverted" around this frequency e.g. 500Hz becomes 7000-500 = 6500Hz etc. Common simple inversions are around 3-4kHz which allows the result to be sent over a normal channel (unless they have special wide-band channels, which I doubt, given the push to reduce bandwidth). Perhaps try 1/2 of the frequency you've stated i.e. 3500Hz and 3550Hz.

Dave

 

[richster]

The laws concerning decoding encrypted radio signals here in Canada is illegal just like in the states. Where the law gets kinda fuzzy is what constitutes encryption?

Industry Canada's definition of encryption and it's laws are here:

http://laws.justice.gc.ca/en/R-2/99354.html

Their definition of encryption is:

2. "encrypted" means treated electronically or otherwise for the purpose of preventing intelligible reception.

If you go further down the document, in section 9 you will find this:

9. (1) No person shall

(c) decode an encrypted subscription programming signal or encrypted network feed otherwise than under and in accordance with an authorization from the lawful distributor of the signal or feed.

(d) operate a radio apparatus so as to receive an encrypted subscription programming signal or encrypted network feed that has been decoded in contravention of paragraph (c).

Subsections C and D clearly state that decoding signals is prohibited.

The bugger is in it's definition of encryption. You can say that "voice inversion" is an electronically treated signal to make it unintelligable, so I would say it falls under it's definition. But many people feel that encryption has to involve a "cypher" or "coding" of the signal to deem it encrypted. Rolling Code Inversion would fall pretty close to a cyphered signal.

Man this law crap is giving me a headache.

My view is if the tools are out there, use them. Just keep a low profile, and keep strict adhearence to the other laws concerning divulging the information you hear from those decrypted signals. You should be fine.

Regards,
Richster.

 

[n8gni]

Try SSB

I just switch the radio to Upper Side Band and tune just a
little above or below freq. and there it is!

 

[Jammin_Jay]

Yes, It works , I narrowed it down, until i could get it perfect, turn the volume up on the scanner and it works @ 7000 hz +/- 50 hz. It works with the program I have anyway with all 3 eastern ontario police depts that have Time/mci radio systems. This is was I experimented with and came across, it wasn't easy at first. I played around with different frequency ranges until I could get it crystal clear. It's just simple voice inversion. I am not here to argue, I am just try to help those who have asked me about how to recieve the signals and de-invert them thats all. As for the laws regarding them. You are still listening to your scanner without divuldging information, regardless if you it's encrypted or not.

 

[pro92b]

Yes, It works , I narrowed it down, until i could get it perfect, turn the volume up on the scanner and it works @ 7000 hz +/- 50 hz.

Dave is right, that can't be the real inversion frequency. The program may be telling you it is, but it is technically not possible since the audio would be translated out of the 300-3000 Hz speech band.

 

[Jammin_Jay]

Your probably right , it may be an almagmation of the lower and upper to equal 7000 hz. All I know is that is the number of frequency I entered in the queing box in it works like a charm. With my scanner plugged in my sound card it works on the fly. The strange thing about the program is it will also scramble normal speech to inversion. You would have to run the program to know what i am talking about. But 7000 may be 3500 hz like u said the program is telling me that. But i like that fact that this program actually works from others i have tried. It was just a techincal challenge i wanted to pursue. I just played around, and to be honest maybe by luck i just hit the right frequency or number in que, i here the police plain as day. It would be nice to get a program that could turn on/off the descramble when u need it on/off when scanning that would be kool.

 

[CDCM]

I alrready new what all of them used before ne one else I just dident share it with ne one.the computer program sucks too much noise in the back round.and hey jammin jay dident u say they were rolling inversion???i knew all along it wasent but u said nope rolling inversion.well if ne one is interestead in descramblers let me no I no exactley were to get them for a good price

 

[Jammin_Jay]

Let me clarify something. Yes they were testing rolling code inversion at one time, cause i did here it. There was ticking in the background and the was a databurst at the beginning of the transmission, which signifies the code at which frequency to invert. The problem was that there was static and noise, so they were unable to use that type of encryption. This was a long while ago. So they switch to just normal voice inversion and voila it works with no noise to interfere with communications. I don't know how long they will use this current method before they find it's not secure enough and switch to something else. Anyways this is a forum and i just posted what I discovered and i am sharing it. I am not saying its all totally right or defintely carved in stone. Just saying this is what I discovered. Maybe it will help people , maybe it wont. If anyone has anything to add that would help others, by all means, it is a forum. I thought that's what it's all about sharing info.

 

[mciupa]

Once I find the tone carrier frequency for Perth ... I thought that's what it's all about... sharing info.

Well ,in the spirit of info sharing

Town of Perth 142.125 mHz pl 131.8 Hz

Tell us if it works.

 

[Jammin_Jay]

I have tested the program and it works for the following that i have logged


142.305 Smiths Falls PD
142.125 Perth PD
142.935 Brockville PD
155.115 St Lawrence County Sherriff, Canton, NY (when inversion is used)
155.550 Ogdensburg, NY PD (when inversion is used)

In fact what i have noticed is all of these can be heard without changing the frequency on the que box,just enter (7000). it goes up in inc/dec up 50
The program is on the tetrascanner.com called IZ8BLY Voice Descrambler, you will find it under the header scanner software. Just download the program if your interested and then u can discover things that i may not of. Its free and doesnt cost anything, why not give it try.

 

[LordJ]

Ok, then

Ok, so if the software program works, what about the Ramsey kit? Anyone have one, tried one?

http://www.ramseyelectronics.com/cgi-bin/commerce.exe?preadd=action&key=SS70C

 

[Thornhill20]

How exactly does rolling code inversion work? I can understand fixed code inversion, but what about rolling code?

Do the radios have a preassigned "codebook" of what frequencies to use, and how often to use them...or does the system send out some kind of command telling it when to switch, or how does that whole thing work?

Also, I've seen the soundcard based decoders...if I wanted to play around with using inversion scrambling for transmitting...are there any applications that would allow me to do that, instead of just decoding?

-M

 

[CDCM]

Ya I used ramsey kit and it doesent work at all for some reason I dont no why I sent it back to them waste of money big time

 

[DaveH]

How exactly does rolling code inversion work? I can understand fixed code inversion, but what about rolling code?

Do the radios have a preassigned "codebook" of what frequencies to use, and how often to use them...or does the system send out some kind of command telling it when to switch, or how does that whole thing work?

-M

Rolling-code has the inversion frequency set by a pseudo-random generator inside the transmitter and receiver. The receiver needs to be synchronized to the transmitter, which happens at the beginning (and during the transmission may be re-sync'ed). The inversion frequency "mutates" during transmissions which is why a fixed inversion-type decoder fails. The pseudo-random sequence is designed to be so long before it repeats that the chances of figuring out anything by decoding what's transmitted, is very remote. From what I understand, voice inversion causes a loss of audio quality (and range) because after inversion at the TX it needs to be filtered, then filtered again after recovery at the RX. The filters are not perfect and the audio is degraded.

I read a whole book on analog voice scrambling (about 15 years back). It mentions that people can be trained (in a matter of days) to understand inverted speech.

Another interesting type is called time-domain scrambling. Think of it like having an electronic "tape" which is cut up in short pieces (less than a syllable) and spliced out of order, transmitted; and only the RX knows how to re-order it correctly. I've heard it on low-band skip (probably military) and it sounds bizarre, human yet non-human at the same time.

Dave

 

[Thornhill20]

http://rover.wiesbaden.netsurf.de/~signals/WAV/NAFRICA.WAV

That's what came to my mind when you mentioned time domain scrambling.

Sounds to me that's what it's like. You can easily tell it's a human voice, just chopped up alot.

-M

 

[jred184]

Voice Descrambler

When I use the Voice Descrambler, what do I need to enter in the text box? I'm assuming all I have to do is plug my BC246T headphone jack into the mic jack of my computer and fire up the program and enter the correct number in the text box, right?

 

[RayAir]

Rolling-code has the inversion frequency set by a pseudo-random generator inside the transmitter and receiver. The receiver needs to be synchronized to the transmitter, which happens at the beginning (and during the transmission may be re-sync'ed). The inversion frequency "mutates" during transmissions which is why a fixed inversion-type decoder fails. The pseudo-random sequence is designed to be so long before it repeats that the chances of figuring out anything by decoding what's transmitted, is very remote. From what I understand, voice inversion causes a loss of audio quality (and range) because after inversion at the TX it needs to be filtered, then filtered again after recovery at the RX. The filters are not perfect and the audio is degraded.

I read a whole book on analog voice scrambling (about 15 years back). It mentions that people can be trained (in a matter of days) to understand inverted speech.

Another interesting type is called time-domain scrambling. Think of it like having an electronic "tape" which is cut up in short pieces (less than a syllable) and spliced out of order, transmitted; and only the RX knows how to re-order it correctly. I've heard it on low-band skip (probably military) and it sounds bizarre, human yet non-human at the same time.

Dave

I have never met anyone who can understand inverted speech. I have listened to many hours of scrambled speech including rolling code. If you try to crack rolling code, most of the time all you get is a string of words if your lucky and know what you're doing.