Dialtone

Decompile the program with Ghidra, we learned that

Take a look at function r.

local_58 is using high frequencies [1209, 1336, 1477, 1633] local_78 is using low frequencies [697, 770, 852, 941]

The big switch to check the state and the index of selected frequencies, r results in succeeded if the correct combination is found.

According to keypad frequency

DTMF keypad frequencies (with sound clips) 1209 Hz 1336 Hz 1477 Hz 1633 Hz 697 Hz 1 2 3 A 770 Hz 4 5 6 B 852 Hz 7 8 9 C 941 Hz * 0 # D

local_c = local_20 << 2 | local_c;

The lower two bits represent high frequency, the higher two bits represent low freqency.

Take a look at the switch block

high = [1209, 1336, 1477, 1633]
low = [697, 770, 852, 941]

position 0: local_c should be 9(0b1001), (low[0b10],high[0b01]) = (852Hz,1336Hz) = 8
position 1: local_c should be 5(0b0101), (low[0b01],high[0b01]) = (770Hz,1336Hz) = 5
position 2: local_c should be 10(0b1010), (low[0b10],high[0b10]) = (852Hz,1477Hz) = 9
position 3: local_c should be 6(0b0110), (low[0b01],high[0b10]) = (770Hz,1477Hz) = 6
position 4: local_c should be 9(0b1001), (low[0b10],high[0b01]) = (852Hz,1336Hz) = 8
position 5: local_c should be 8(0b1000), (low[0b10],high[0b00]) = (852Hz,1209Hz) = 7
position 6: local_c should be 1(0b0001), (low[0b00],high[0b01]) = (697Hz,1336Hz) = 2
position 7: local_c should be 0xd(0b1101), (low[0b11],high[0b01]) = (941Hz,1336Hz) = 0
position 8: 0 is invalid, make it 1

So the key sequence is 859687201.

TOP