Phone Keypad Hacking: Part 1

Trimline_telephoneI’ve been on a kick tearing apart electronics. In addition to the switch I got a bunch of parts from, I’ve tore into a lamp and some old computer speakers. When I found an old telephone (it has a date of 5/30/1980 printed on it!) in my basement I knew I had to see what was inside. The previous owners left it in a storage room and I have no idea why I never pitched it. I didn’t take a picture before taking a screwdriver to it, but it looked exactly like the photo on the right.

People have been hacking phones for a long time. Perhaps the earliest and most well-known was the Steves (Jobs and Wozniak) using a blue box on payphones. I’m nowhere near that level, but you have to start somewhere right? I pulled the ringer, speaker, and microphone out of it. I haven’t messed with these yet.

A lot of parts were extremely dirty.

The part I thought would be neat to work with was this keypad.

img_8973

img_8975
With the faceplate removed you can see the date stamp in the upper right.
Back side.

It was a bit of a process figuring out how to tap into this thing. Eventually I realized what these contact switches on the sides were for.

img_8977.jpg

img_8988There are seven of them. The top has two and the bottom has one, which correspond to the 3 columns of keys on the grid. Then the left and right sides each have 2, which match up with the 4 rows of keys.

This row/column grid system is still how we reference the individual keys on keypads like this. Arduino has a Keypad library for working with modern keypads like one sold by Adafruit.

I figured out I could solder wires to the contacts points connected to each of those switches. I was in! From the way the keypad was connected to the rest of the phones circuitry I knew the screws were an important piece to tie it all back into the entire system. After some trial and error I determined which screws should be used for power (red wire) and ground (black) in order to get useable data out of the 7 switch contact points. The other 3 screws also connect to power. I was using alligator clips on those, but disconnected them for the picture.

Something isn’t quite right about the screw connections though. When I connect them the opposite way, flopping to have 1 power and 4 grounds, the backlight on the keypad works, but the readings from the soldered contact points are useless. With them connected this way, I don’t get the backlight, but I get data I can make sense of. There is probably something obvious I’m missing about how this all works together.

Unfortunately for me, the output from the contact points isn’t digital (limited to on/off), so I couldn’t use the Arduino library. It would have made things so much easier. It’s not surprising though, since this piece of technology is almost 40 years old!

I was able to get some code mostly working. Detecting the column of a button press was pretty straight forward and works great. Rows detection is another story. I’m reading in analog values and using sampling along with standard deviations to determine which row’s value is unlike the others. Well, the first row always reads a pretty high value, when a key on any row is pressed. The values for the other rows fluctuate as expected. When that first row is high, I’ve attempted to also look for a high value from another row, but it triggers the wrong row too often.

Demo time…

Even making this short little video, which took at least 5 takes, there was a false trigger for pressing 1 and many key presses not being recognized. Not useable.

I have a hunch the screw connections are responsible, at least in some part, for sending DTMF signals, also known as Touch-Tone. I don’t really care to get in the business of decoding these. This is precisely why I was hoping I could detect useful output from each of the row and column contact points.

I pulled apart the unit even more and discovered a Western Electric 557D is the brains of the operation, but it’s so old there doesn’t seem to be a datasheet online for it. What I’m going to do is remove the PCB and wire up everything on my own. Then I can easily get on/off as digital values from the columns and rows and make sure the backlight works. Stay tuned…

Update: Read Part 2

3 thoughts on “Phone Keypad Hacking: Part 1

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s