Reversing A Pay Phone For Fun But No Profit

The speaker set out to reverse engineer a decommissioned payphone from the 1990s, a rugged unit built to resist vandalism. Public manuals were scarce, so the device was obtained secondhand, and its pin lock was opened with help from a lockpicking enthusiast. Later, a junkyard offered several more units, which had to be drilled free from their poles.

Inside, the main board carried an uncommon CMOS processor from a family used in spacecraft. The firmware was read from a flash chip, and its strings showed phone-related text and the original developers' names. No disassembler supported the chip, so the speaker wrote a processor module for Ghidra from text definitions, covering opcodes, registers and an unusual rule where call arguments sit after the opcode. Hebrew text needed a code page conversion script. Logic analyzer captures failed to reveal which of thirteen branches printed the out-of-service message, so the firmware was patched with hooks that drew custom text on the LCD.

The project then turned toward reusing the chassis, with an Arduino driving the display and a caller ID module considered as a modern replacement. Work stalled during the pandemic and other commitments, and it resumed after a conversation at a conference, leading to a Hebrew blog post that drew far more readers than expected. The main lesson is that routine knowledge is new to others, so sharing findings is worthwhile.