.oO Phrack 50 Oo.

                            Volume Seven, Issue Fifty

                                     14 of 16
                                                 
                     //===============================\\
                     ||  The DCO-CS Operating System  ||
                     ||              -*-              ||
                     ||                               ||
                     || by Trunkin' Fool AKA mrnobody ||
                     ||             4.1.97            ||
                     \\===============================//


	OK... this is the first part of what (hopefully) will be a little
series type thing of articles on the DCO operating system, which is from
Siemens.  DCO is run on an LLS/RLS-1000/RLS-4000 machine. It has
psychotically mad logging, but the logs are configurable from the admin
accounts.  The DCO box I was using just happened to only have a 1200 bps
dialup, so some operations (i.e. listing INWATS trunks and what they route
to) were painfully slow considering the large amount of trunks this thing
can control.  It is similar to a 4ESS in some ways, and offers some PABX
functions.  A guy can have lots of fun with one of these things...

        Some features/specifications:

        Billing Computer Interface
        --------------------------
        "The DCO-CS collects AMA data and provides direct data interface with
        your business computer, as well as 1600 BPI magnetic tape backup
        or primary data collector"

        International Callback
        ----------------------
        "Allows the system to place a return call to an international
        subscriber for the dialed domestic number originally called, either
        through a live or automated operator position."

        ISDN Transport
        --------------
        The DCO-CS is capable of switching 64 Kb/s data. This allows people
        (customers, hehe) to switch Primary and Basic Rate ISDN traffic.

        LEC Services
        ------------
        Full LEC services are offered, including POTS (duh), Centrex &
        Enhanced Centrex (combines ISDN & POTS lines in the same Centrex
        groups, direct inward dialing, call forwarding, hold, call transfer,
        intercom, conferencing, OUTWATS over line groups of any size.), CLASS
        including calling number delivery and display, selective call blocking
        and forwarding, automatic recall and call trace.


        "Hacker intrusion is detected and 'thwarted' by sophisticated pattern
recognition software.  The DCO-CS switch lets you detect abused authorization
codes and service-denied authorization codes and automatically route the
calls to your service departments.  The system also offers timed threshold
levels for both ANI and authorization codes as another form of fraud
protection.  It delivers detailed traffic and facilities usage reports to help
you plan the optimum use of your private and leased facilities."

                                --Siemens Stromberg-Carlson

        Calls are processed simultaneously with separate processors and
switching matrices.  In the event of a failure, not even calls in the process
of being switched are lost because when the failure occurs, the system simply 
switches to "its redundant processor and memory".

        I guess that before I dive straight into the commands, I should
discuss something pretty damn important.  That something is MMI. MMI
stands for Man-Machine-Interface,and is basically the 'shell' for this
system.  First off, in MMI, every command is prefixed by a '$', ie, to run
the account maintenance program, "passwm", one would type: "$PASSWM",
without the quotes. Always put a comma between parameters. For example,
say that a program ADDTFREE requires the parameters SAC(service access
code),Toll-Free Number, and the Trunk to Assign the Toll-Free number to.
The hypothetical command to add a tollfree number, 555-6969, with a SAC of
800, for example, and route it to (123)456-7890, would be: 

    "$ADDTFREE 800,5556969,1234567890" 

(without the quotes). The ';' denotes a line terminator. For example, to run 
a program PROG1, which,say, clears the terminal screen, and the INWANI
utility, one would type: "$PROG1;$INWANI", without the quotes. The ""
(quotes) are used to contain a string of one or more characters. A string
is considered anything that contains either a blank or comma not being
used as a delimiter. The '\' allows special characters to be input to
tasks (similar to linux/unix?). And finally, the ':' is synonymous to done
(whatever that means).

        Some more on MMI... The command line/response length is 65 characters,
so anything longer than 65 will be truncated.  Exit is a valid response at any
prompt.  Help is also valid and lists the valid responses with descriptions.
To automatically display the help information prior to all prompts, type
"HELP=ON" without the quotes.  "HELP=OFF" disables this function. The '^' is
used to back up a menu.  Control-P cancels a function in progress. The '&'
represents logical AND.  However, the '&&' represents a logical inclusive.
The '*' is a wildcard, and allows the user to select the entire range of
possibilities.

        'Option Words'- the option word is entered on the command line
after the task(command) name.  The Option Word can be either in octal or
ASCII.

Value   ASCII           Definition
-F1     /NODIAL         no dialogue (header or trailer msg output) to terminal
-F2     /OFFLINE        Request communication with offline CP
-F4     /NOCOMM         No user input. All input must be on the command line
-F40    /NOPAGE         Do not paginate output.
        Values may be added together to indicate multiple options, eg:
-F3 = -F1 and -F2.

        One final thing: I said that all commands must be prefixed with a '$',
however, this does not apply to input, ie when inside a program it is not
necessary.

        The next part is basically just a command list for DCO. I will do
a more detailed (tutorial even) as i learn more and as people ask for one,
or if I just feel like writing it (and I probably do, as I have read Phrack
for some time and always wanted to contribute). One last warning: the LLS/RLS
is a fairly large system, so be VERY CAREFUL as one can do about as many
bad things as good things if you're not careful.
	
	So... without further ado, heres the command list:

Command   ~   Description
-------       -----------
ABNUTL    -   perform automatic balance network (ABN) functions
ABORT     -   abort operation of an active task
ACISU     -   alarm control interface start up
ACITST    -   alarm control interface test
ACTUTL    -   display/clear/acknowledge active alarms
ADMIN     -   recent change/database administration
ALMSEN    -   switch between local and remote alarm reporting
AMA       -   configure automatic message accounting (AMA)
AMCDMP    -   administer AMA message thresholds
AMFMAU    -   verify formatted AMA tickets
AMOPT     -   administer system options
AMPRPT    -   set frequency of repeat notification of alarms
AMPUTL    -   alarm message processing utility
AUDIT     -   verify software record of hardware states match actual hardware
BKRNS     -   backup RNS disk at the host office
BLDINH    -   mask/unmask building security alarm (heh, this should be fun)
BUFDMP    -   search/clear/dump CP buffers
CANCEL    -   cancel wait timer for TID and IDN
CBUG      -   debug utility for LLS/RLS-1000 and CODC devices
CHEKER    -   compare MP memory to disk
CHKUTL    -   verify disk integrity (DCO equivalent of scandisk for dos)
CLEAR     -   initialize span error counters
CODE      -   DCO-CS customer routing
CONFIG    -   configuration control (load,switch,mask, etc.)
CONUTL    -   convert equipment numbers
COPY      -   copy databases from memory to disk
CPDMP     -   display data collected from a CP crash
CPPTCH    -   call processing patch utility
CPREST    -   online CP reset
CPSRCH    -   search CP buffer
CPSU      -   call processing startup
CSADM     -   DCO-CS administer ANI DN's and auth codes
DBADMN    -   DCO-CS change max entries in selected tables
DBUTL     -   administer MP database parameters
DBVER     -   database verifications and configuration reports
DEBUG     -   debug utility for MP
DEVMOU    -   build config file to rebuild system mount status
DIAG2     -   manually diagnose/verify fault in the MOS side of the system
DIAG3     -   manual diagnostics to test forced faults
DMPUTL    -   duplex MP utility (switchover,download,lock,etc.)
DNAUTL    -   directory number audit utility
DTIUTL    -   configure/status of DTI/DS1M for LLS/RLS-1000/RLS-4000
DUMPER    -   dump raw data records from disk
ECCRPT    -   report 1-bit parity errors corrected in MP/CP/FP
ECD       -   display error counters
EDIT      -   DCO system editor
EQCHEK    -   test access to equipped hardware
FILSYS    -   perform file or disk manipulation functions
FLSH      -   flush alarm message processing buffers
FLXANI    -   DCO-CS administer FLEX ANI tables
FPBUG     -   debug utility for FP
FPCDMP    -   display/save data collected from FP crash
FPSU      -   FP start up
FREE      -   display number of free blocks in MP memory
FXLN      -   administer/configure FX communications to an RNS
GBUG      -   generic debug utility
HEY       -   MP operating system task completion advisor
HSTUTL    -   collect/retrieve alarm message history
HOTLIN    -   DCO-CS administer hotline database
INSTAL    -   MP operating system manual task installer
INWANI    -   DCO-CS administer INWATS number routed by NPA/NXX
INWATS    -   DCO-CS administer incoming toll free (INWATS) service
ISUUTL    -   administer alarm level priorities and conditions
LLC       -   line load control of subscriber lines
LOGOFF    -   logs off the terminal
LSPT      -   light traffic tests (avoid running during heavy traffic)
MACLR     -   clear memory audit data
MANUAL    -   manual control of ports
MAUDIT    -   memory audit routine
MBI       -   report masks and errors on MBI bus
MEMCHK    -   report differences between CP memory (generic code) and disk
MEMMAP    -   display memory map
MODEM     -   administer system parameters for modem security
MOVEDB    -   DCO-CS database compress program
MSKUTL    -   temporarily mask alarm and message reporting
NITSWC    -   initiate service circuit switchover
OCC       -   DCO-CS administer system options
OPR       -   administer system operator groups
PABX      -   administer PABX groups
PARTN     -   DCO-CS administer partition number tables
PASSWM    -   administer user/password list
PATCH     -   MP operating system patcher
PATRPT    -   format patch into report
PAUDIT    -   audit patches applied to disk/system
PCOS      -   DCO-CS administer partition class of service
PED       -   administer/apply/verify patches to disk/system
POORA     -   point of origination for recorded announcements
PORTST    -   list port status; list/change lockout thresholds
PSAUTL    -   port store area (PSA) utility
REBOOT    -   reboots the maintenance processor
RECOV     -   put call processors in sync
REMOVE    -   remove a resident program from memory
RESTOR    -   restore call processor
RFRNS     -   copy files from an RNS to the host office
RGU       -   DCO-CS least cost routing/update display
RNSAMA    -   display AMA buffer status in an RNS at the host
RNSBMP    -   display RNS BMP status at the host
RNSUTL    -   configure/status/diagnostic testing of signaling links
ROTL      -   transmission/operational testing of outgoing & 2-way trunks
ROUTE     -   DCO-CS display customer routing
RRTUTL    -   reroute messages to additional terminal points
RSMUTL    -   remove/restore/mask/unmask/test RLG span
RSUTL     -   routine switchover utility
RTEST     -   routine testing
RTOPT     -   administer analog trunks and service circuits
RTR       -   administer route treatment database
SBUG      -   stop FBUG
SCTST     -   DCO-CS service circuit diagnostics
SECTTY    -   administer terminal access groups
SELMCL    -   outgoing call trace
SELNUM    -   DCO-CS administer blocked directory tables
SERV      -   DCO-CS change service circuit tables
SLUUTL    -   configure/administer/mask/test SLUS
SNCUTL    -   configure/status of SNC for LLS & RLS-1000
SPCALL    -   DCO-CS administer speed codes
STASND    -   digital alarm sending utility
STATE     -   display system state
STATE1    -   switch to system state 1
STATE2    -   switch to system state 2
STATUS    -   display system status
STOP      -   terminate execution of TEST, GBUG, DIAG2, or BTBT
SWITCH    -   manually switch tones/ringing generators/clocks (non RLS-4000)
TAPE      -   display formatted tickets on AMA tape
TASKCK    -   audits the disk database for necessary/unnecessary files
TCOS      -   administer trunk class of service
TFM       -   activate/deactive/audit/display TMRS
TFMRP     -   display specific TMRS measurements/report data/study set
TIKFM     -   DCO-CS display AMA tape format
TIME      -   display system date/time
TIMEC     -   changes system date/time
TIMER     -   administer/configure CP occupancy measurements
TKTHRS    -   administer trunk thresholds
TMAD      -   administer/configure TMRS
TMBUG     -   debugger for traffic measurement processor
TMPDMP    -   display data collected from a TMP crash
TMRPRT    -   manually display a TMRS variable report (with FP)
TRACE     -   DCO-CS call trace utility
TRACER    -   allows use of tracer board for CP
TRK       -   administer trunk group assignments
TRKUTL    -   administer trunk testing database
TSEP      -   administer/configure traffic separations
TTU       -   administer translation database
UNMASK    -   enable reporting of messages & H/W faults (non-RLS-4000)
UNSYNC    -   take call processors out of sync
UPACK     -   unpack a file
UPDATE    -   update the system state
UTL       -   mount/dismount device/feature; configure tasks
VALPC     -   DCO-CS administer validated project codes
VCHECK    -   version checker
VST       -   administer variable state timers
XDSO      -   CP message sender/debugger
XFER      -   transfer files between the DCO and another system
XRTEST    -   terminate routine testing

        Thats all for the commands... I will probably write a follow-up
explaining some of the commands usage, what a DCO looks like when you call it
(ie how you know its a DCO machine), what some defaults are, how to route
numbers using INWATS or INWANI, and whatever else i figure out... for now,
have phun & read Phrack...  Feel free to contact me:
    
                            mrnobody@pil.net

resources i used:

- an actual RLS machine running DCO siemens stromberg-carlson

- my mind 
- the minds of my phriends, to whom i give much thanks: 
    c-stone (is thatit?), lefty, port9, cyklonik (hope everything turns out 
    OK....), a guy named don in CA :), and ben (look at me now, m0f0)

sorry if i forgot anything or anyone that helped me... 
look out for "The DCO-CS part 2" soon...

EOF