Copy Link
Add to Bookmark
Report
Old MFers Union of X-Bar Switchmen 03
[E2S / 0MFuXS] [Old MF'ers Union of X-Bar Switchmen] - April '95
----------------------------------------------------
Numb 3
----------------------------------------------------
What ever happened to Willie Nelson anyway?
============================================================================
3. Hacking Electronic Road Signs - [TCP]
----------------------------------------
Ever see those large signs on the highway that say "road slippery
ahead" or "bizzard conditions.." etc? Well, we were wondering if they
were hackable, so one night we went on out and gave it a gnu. And huzzah,
it worked! Here's what we found. (Remember, though. This was what I
gathered by standing in the cold at 3:30am off of US 285 entering the
mountains. I was only there for 3-5 minutes, so I may not be 100%.)
1. We bilched open the box on the side of the post of the sign. It opened
easily, lame little metal latch that popped with a screwdriver. Of course,
your box may vary.
2. Inside was telco connections (remote access? Alarms? We tried ANIing it,
but we didn't get a dtone), a heater with thermostat (to maintain temp
of the electronics), a power supply block, and the control console.
The box looked like this:
_____________________________________________________
| Power |_____| |Thermo- | |
| Supply| |\ | Stat | |
|_______| | | | ||||| | |
| 120V Outlets| | | | |
|_____________| | |________| |
| ________ \_ __________________________________|
| | Phone | __| [ ] ## ## ## ### ### |
| | jack | | o| ## ## ## ### ### |
| |________| | | Control ## ## ## ### ### |
| ||| || | o| Console ## ## ## ### ### |
| // || |__| ## ## ## ## ## | _____
| /-----\ || |__________________________________| / \
| |phone| || | |
| |trmnl| ||___________________________ | \__0__/
| \-----/ ||| | | -+-
| ||| Heater | | |
|_________|||___________________________|_____________| / \
JeR0ME!!
3. The control console in our unit was a Burr-Brown TM25-300HT. It was
about 6-8 inches long, 4 inches high, and 2 inches deep, with a red
LED display and a keypad with some other LEDs on it.. Looked like this:
_______________________________________________________________
_____| _______________________ ----------- ----- ----- |
| req || DISPLAY | | D | E | F | |F 6| |F 7| |
| ctl ||_______________________| ----------- ----- ----- |
| o | | A | B | C | |F 4| |F 5| |
| | ----------- ----- ----- |
| | | 1 | 2 | 3 | |F 2| |F 3| |
| | ----------- ----- ----- |
|reset| | 4 | 5 | 6 | |F 1| |
| o | ----------- ------------ |
| | | 7 | 8 | 9 | |Ent.||Clr.| |
| | ----------- ------------ |
|_____| | . | 0 | - | |
|_______________________________________________________________|
Or something like it :)
4. The procedure: (Note: ONLY tested on this model...)
1. Press the "RESET button NEXT TO the terminal, and then
press the "CLEAR" key ON the terminal. (display should read "0")
This will also clear any message on the screen.
2. Press the "REQUEST CONTROL" button NEXT TO the Terminal.
3. Display should read "CODE"
4. Enter the 3 digit code (ours was 0,0,3. Whee) and press ENTER.
Note: Our unit had a 3-digit passcode. We're not sure about
others. Again, more testing to do!
5. The terminal should read "LOAD". It is now ready to be
programmed.
6. Enter 6 two digit numbers from the library, one two digit number
for each line of the message. (I.E. XX for the first line, XX for
the second, etc..) Press the enter key after entering each two
digit number.
7. The sign should display the message entered.
8. If the message didn't come up on the Sign, press the reset
button and start over.
9. Get out the midget with the Casio and dance.
The following text was an additional "step" we found in a manual we got for
the thing (basic programming.) The rest of the procedure is the same.
----------------------------------------------------------------------------
If the message is to be a three line message, repeat the first
three, two digit numbers entered by keypad.
(for a total of six two-digit numbers)
----------------------------------------------------------------------------
I'm not to sure as to what this'll do.. Kinda unclear to me! :) Since it
already is a 3-line message.. Hmm..
5. The Code Library: (may vary from sign to sign. I'm not sure if the first
few are standard and some are custom messages, or if they're entirely
DOT programmed.. I'm sure they'll vary from area to area, but this will
give you an idea. And if you're like me, it'll give your hair a
velvety sheen.
00 Time 34 On I-70 5 Miles
01 Adverse Conditions 35 On I-70 7 Miles
02 Ahead 36 On I-70 10 Miles
03 Ground Blizzard 37 Poor Visibility
04 Blizzard Conditions 38 Ride the Skilift Bus
05 High Winds 39 Call 398-LIFT
06 Blowing Snow 40 Drive with Care
07 Snowtires or Chains 41 This Holiday
08 Required 42 Arrive Alive
09 Closed 43 All Vehicles Over
10 Congested Traffic 44 10,000 GVW and Towed
11 Icy Conditions 45 Must Use Chains
12 May Exist 70 Kenosha Pass US 285
13 Open 71 Blowing Sand/Dust
14 Road Closed 72 US 285 at Bailey
15 Road Icy 73 US 285 at Webster
16 Road Icy in Spots 74 Crow Hill - US 285
24 Speed Limit 75 US 285 at Aspen Park
25 55 MPH 76 US 285 at Conifer
26 Strictly Enforced 77 US 285 at Fairplay
27 Traffic Delay 78 ON US 285 1 Mile
28 Vail Pass I-70 79 ON US 285 3 Miles
29 Windy 80 ON US 285 5 Miles
30 Watch for rocks 81 ON US 285 7 Miles
31 Temporarily Closed 82 ON US 285 10 Miles
32 Chains Only Required 83 Construction Ahead
33 On I-70 3 Miles 84 Blasting Ahead
17 Road Wet 85 Beginning Monday
18 Snow Slide 86 Beginning Tuesday
19 Snowing 87 Beginning Wednesday
20 Snowing Hard 88 Beginning Thursday
21 Snow Packed 89 Beginning Friday
22 [SPACE][BLANK] 90 Blasting Delays
23 Snow Packed in Spots 91 8:00 AM TO 3:30PM
So, for example, to display
ROAD CLOSED
GROUND BLIZZARD
WATCH FOR ROCKS
you'd enter:
[RESET]
[CLEAR]
[REQ CTL]
[003]
[14]
[ENTER]
[03]
[ENTER]
[30]
[ENTER]
[22]
[ENTER]
[22]
[ENTER]
[22]
[ENTER]
And that's it. As for customized messages, I haven't figured that out
yet. I guess that means another 3:30am trip to the sign :)
=============================================================================
---------------------------------------------------------------------------
E2S/0MFuXS is as big as Lou Ferrigno's Balls.
---------------------------------------------------------------------------
If you really like Neil Diamond, call:
20MNN: [HQ]: (303)932-1195/8404 28,800 BPS V.FC
Empire of the Dragon : (303)932-1308/1309 28,800 BPS V.34
---------------------------------------------------------------------------
