% these docs have been re-written in TeX.  If you have AmigaTeX or access
% to it on a mainframe then go ahead and TeXify it and read.  Otherwise,
% you will have to wade through the TeX commands used in the file.  For
% those not familiar with TeX, a backslash ("\") preceeds a command.
% For example: "\bh" is defined in this file to mean "BackHack".

\input cm12a.tex
\font\csc=cmcsc10 scaled \magstep1
\font\titlefont=cmdunh10 scaled \magstep3

\def\bh{{\csc BackHack}}
\def\ami{{\it Amiga\/}}
\def\ar{{\sl ARexx\/}}
\def\ver{v1.16}

{\twelvepoint
 \setbox1=\hbox{\ }
 \dimen1=\wd1
 \divide\dimen1 by 2
 \advance\dimen1 by \wd1
 \xdef\cmd#1{\medbreak\leftline{\hbox to\dimen1{\hss$\bullet$}\tt#1}\nobreak}
 \xdef\rcmd#1{\medbreak\leftline{\hbox to\dimen1{\hss$\diamond$}\tt#1}\nobreak}}

\def\Section#1 {\bigbreak\noindent\underbar{\bf#1}\nobreak\smallbreak\noindent}
\def\Entry {\textindent{$\Rightarrow$}}
\def\newacronym#1#2#3{\def#1{#3 (#2)\def#1{#2}}}

% A macro \underwiggle for drawing variable length wiggly lines horizontally
% under its argument in the same way as \underbar.
% Written by Dr. John S. Garavelli on 4 December 1987 and adapted from a routine
% by A. G. W. Cameron at Harvard University which appeared in TUGBOAT November
% 1985, vol. 6, no. 3, p. 155.
% WARNING: the computations performed by this macro can be very time consuming,
%          so use it sparingly.

\newcount\vone \newcount\vtwo \newcount\vthree \newcount\vfour
\newcount\vfive \newcount\vsix \newcount\vseven \newcount\veight
\newcount\vnine \newcount\vten
\newbox\wbox \newdimen\wbsize
\def\underwiggle#1{\ifmmode\setbox\wbox=\hbox{$#1$}
                      \else\setbox\wbox=\hbox{#1}\fi
\dp\wbox=0pt\wbsize=\wd\wbox\lower2pt\hbox to0pt
{\hss$\vone=0\vtwo=0\vthree=7000\vfive=\vtwo
\loop
\vseven=\vone \divide\vseven by 2
\vsix=\vfive \divide\vsix by 2 \multiply\vsix by -1
\veight=16384 \advance\veight by \vsix
\vnine=16384 \advance\vnine by -\vsix
\vten=\vseven \advance\vten by 32768
\hskip\vseven sp
\vrule height\veight sp width 32768 sp depth\vnine sp
\hskip-\vten sp
\ifdim\vseven sp<\wbsize \advance\vone by 20000
\advance\vtwo by \vthree
\vfour=-\vtwo \divide\vfour by 10
\advance\vthree by \vfour
\advance\vfive by \vtwo
\repeat$}\box\wbox}
% end of underwiggle macro

%Make macro `numsufix' calculate use of "st", "nd", "rd", or "th" and place
%it after day.
\def\numsufix#1{$#1^{\rm
  \count0 #1 \divide\count0 by 10 \multiply\count0 by 10
  \count2 #1 \advance\count2 by -\count0
  \count4 \count0
  \divide\count4 by 100 \multiply\count4 by 100
  \advance\count0 by -\count4
  \ifnum\count0=10
    th%
   \else
     \ifcase\count2
      th\or st\or nd\or rd\else th%
     \fi
  \fi}$}

% DEFINE TODAY MACRO
\def\today{%
 \ifcase\month
   \or January\or February\or March\or April\or May\or June%
   \or July\or August\or September\or October\or November\or December%
  \fi
 \space\numsufix{\number\day}, \number\year}

% SETUP HEADLINE
\headline={%
 \ifnum\pageno>1
  {\twelvepoint\rm\bh\ \ver\hss\bf\ami\ User's Manual\hss\tt\today}
 \else
  \hss
 \fi}

\twelvepoint
\centerline{\underwiggle{\titlefont BackHack \ver}}
\medskip
\centerline{by \sl Kombalar\/}
\bigskip

\Section{Introduction}
There have never been many hackers available for the \ami.  Of those, most
are not even worth mentioning.  They are often written in \ami{\bf GARBAGE}
and a pain to use.  Fed up with having to break out the ol' 64 to get a few
codes I decided to write a real hacker and the result is \bh.  \bh\ is
written mostly in `C' (using {\sl Lattice C v5.04\/}) and some assembly
(using {\sl CAPE v2\/}) and takes advantage of the \ami\ operating system.

\bh\ gets its name from the fact that it was designed to run as a
background job on the \ami.  When started, it will detach itself from its
starting CLI (note: \bh\ is a {\bf CLI ONLY} program) and initialize
itself.  If no errors are found it will release its hold on the CLI's
window so that {\tt EndCLI} can close it.

One of the features of \bh\ is the \ar\ port that it opens.  In fact, \ar\
is required to use \bh.  This shouldn't be much of a problem, however.  As
pirates you should be able to get a copy of \ar\ without much sweat.
Also, {\bf Commodore} has liscenced \ar\ from William Hawes and will
include it as part of the 1.4 operating system (even if it will be some
time before we see 1.4\dots).

\Section{System Requirements For BackHack}
\bh\ requires two libraries, {\tt rexxsyslib.library} and {\tt
mathieeedoubbas.library}, to be present in your {\tt LIBS:} directory.  If
it can not find either of these when started then it will print an error
message and exit.

\bh\ also makes two assumptions about your modem.  The first is that it
returns a valid carrier detect line.  This is typically set with the {\tt
AT\&C1} command on Hayes compatible modems.  The second thing it assumes
is that your modem will drop carrier when DTR goes low.  This is usually
set with the {\tt AT\&D2} command, though some modems support this but
use a different command to set DTR status (or will use a DIP switch).

\Section{How To Use BackHack}
To get \bh\ started, simply invoke it on the command line.  It will
automatically detach itself from the CLI and then perform its
initialization.  It will then wait on its \ar\ port.  At this point you
should tell it about at least one service to hack on and at least one
destination number of the type used by that service.  You can then send it a
{\tt START} command and it will enter hack mode.

Users of the pre-v1.10 versions of \bh\ will realize that the startup
procedure has changed.  \bh\ no longer reads the `{\tt S:BackHack.def}'
file.  Instead, new \ar\ commands have been added to replace this file and
the parser code (which wasn't too fancy) has been removed.

\bh\ works in ten minute periods once in hack mode.  At the start of each
period it will run through the list of services and check each to see if it
should be active during the period and sets a flag accordingly.  It will
then hack only those services that have their active flag set.  A service's
active flag is never changed during the hack period, however.  This means
that a service may hack for almost ten minutes after the end time
specified.  When you install services remember that the start and end times
are only ballpark figures.

\Section{Sending Commands To BackHack From ARexx}
\bh\ opens a public port called, you guessed it, "{\tt BackHack}".  Please
note that this is {\bf CASE SENSITIVE}.  This means that your \ar\ commands
must include quotes around the name when you issue an ADDRESS command to
prevent \ar\ from uppercasing the entire name.

\bh\ has three standard error codes that are returned by its dispatch
routine.  (Users of pre-v1.10 versions take note that these values have
changed.)  The first value is 20.  This means that you sent it a command
that it did not understand.  The second value is 21.  This is returned when
you used a command that returns a {\tt RESULT} string without first issuing
an {\tt OPTIONS RESULTS} statement.  The third and final value is 22.  You
will get this if \bh\ is currently shutting itself down and the dispatcher
is simply returning all messages without parsing them.

The following is a list of \ar\ commands that \bh\ knows.  Those
preceeded by a bullet~(`$\bullet$') return a value in {\tt RC} while those
preceeded by a diamond~(`$\diamond$') return a {\tt RESULT} string.

\cmd{WINDOWOFF} Instructs \bh\ to close its window down.  Useful if you
need that last ounce of chip memory for something or you don't care about
what its doing and want the space on the WorkBench screen for something
else.  It returns 0 if ok or 1 if the window was already closed.

\cmd{WINDOWON} Turns \bh's monitor window back on after a {\tt WINDOWOFF}
command.  Returns 0 if ok, 1 if it was already open, or 2 if it couldn't
re-open the window (possibly because of lack of chip memory, etc).  Note
that when \bh\ is started it, by default, will not open its monitor window.
Therefore, if you want to see what it is doing you must issue this command.
(Users of pre-v1.10 versions, where \bh\ would automatically open its monitor
window at startup, should note this change in the default.)

\rcmd{DIALSTRING 'destination'} This command takes one argument, a string
of characters to be used as a destination number.  \bh\ will use this to
create a dialstring, complete with {\tt ATD}, which can be sent to your
modem.  If \bh\ hasn't found any codes since it was started it will return
the string "NOCODE" instead of a dialstring.

Please note that if you include hyphens~(`--') in the destination number
then you must include quotes around it.  This will prevent \ar\ from
treating the hyphens as subtraction operands and doing some math before
passing the string to \bh.  For example, the command ``{\tt dialstring
312-938-0500}'' would be incorrect.  You would effectively be issuing the
command ``{\tt dialstring -1126}''.  Instead, you should use ``{\tt
dialstring '312-938-0500'}'' or simply drop the hyphens and use ``{\tt
dialstring 3129380500}''.

\cmd{FREEZE} This command tells \bh\ to stop in its tracks, release its
hold on the serial port, and wait until you tell it to start again.  For
example, I use JRComm and have an \ar\ script that I use to start JR which
sends a {\tt FREEZE} to \bh, runs JRComm, and then sends a {\tt RESUME} to
\bh\ when I exit JRComm.  This command always returns zero.

Please note that the freeze will not take place immediately, even though
\bh\ will respond right away.  To wait until \bh\ is truely frozen you must
use a {\tt STATUS} command inside a loop to wait on \bh.  The sample
script, \underbar{JRComm.rexx}, included in this distribution shows how to
do this.

One other thing: \bh\ will continue to dispatch while it is frozen.  It
just doesn't hack is all.  This means that a service that was active when
\bh\ was frozen may no longer be active when you tell \bh\ to resume and
{\it vice versa.}

\cmd{RESUME} This tells \bh\ to start back up after a {\tt FREEZE}.  Note:
{\tt FREEZE}s stack so \bh\ may not necessarily resume after this command
is received.  The monitor window will display the freeze count so you can
tell if someone else has \bh\ down.  This command always returns zero.

\rcmd{VERSION} This command returns a {\tt RESULT} string in the form of
`BackHack v?.?? by Kombalar'.  By checking the second word of this string a
script can determine what version of \bh\ it is talking to.

\cmd{DIE} This tells \bh\ to close up shop and go home.  Always returns zero.

\medbreak\centerline{\underbar{Commands added in v1.01}}

\cmd{SETVARS} \newacronym{\RVI}{RVI}{{\sl Rexx Variable Interface\/}} This
command will use the \RVI\ to install several compound variables in the
calling script's variable storage environment.  By doing this one can write
scripts which are easier to read as comparisons and specifications can be
made with names rather than cryptic numbers.  It also allows future
compatibility should any of these values change.  This command will return
zero if it was able to install all variables or non-zero if it could not.

The variables it installs are:
\halign{\indent\tt#\hfil&\quad#\hfil\cr
BH.NOJOBS&Status = ``No jobs this period.''\cr
BH.INTERTRYDELAY&Status = ``Waiting out inter hack delay.''\cr
BH.FROZEN&Status = ``Jobs suspended...''\cr
BH.NOSERIAL&Status = ``Unable to secure serial device.''\cr
BH.CLEARINGLINE&Status = ``Clearing Line...''\cr
BH.CODEVALID&Status = ``Code is valid!''\cr
BH.DIALING&Status = ``Dialing...''\cr
BH.CHECKING&Status = ``Checking code...''\cr
BH.BLASTDELAY&Status = ``Waiting out blast...''\cr
BH.INITSERIAL&Status = ``Initializing serial device.''\cr}
\smallbreak
These variables were added with the release of v1.10.  Except for {\tt
BH.NEEDSTART}, they are used to specify options in the new {\tt SERVICE}
and {\tt PHONE} commands (see below).
\halign{\indent\tt#\hfil&\quad#\hfil\cr
BH.NEEDSTART&Status = ``Awaiting START command.''\cr
BH.CODE&Specifies code-first order.\cr
BH.DEST&Specifies destination-first order.\cr
BH.RANDOM&Specifies random hacking.\cr
BH.SEQUENTIAL&Specifies sequential hacking.\cr
BH.CARRIER&Specifies a code is good when carrier is received.\cr
BH.NOCARRIER&Specifies a code is good when no carrier is detected.\cr
BH.BLAST&Specifies the use of blast logic to determine if a code is good.\cr
BH.TONE&Used in the {\tt PHONE} command to specify tone dialing.\cr
BH.PULSE&Used in the {\tt PHONE} command to specify pulse dialing.\cr}
\smallbreak
Version 1.12 of \bh\ adds two more variables for use with the {\tt SERVICE}
command:
\halign{\indent\tt#\hfil&\quad#\hfil\cr
BH.COMBO&Specifies `combo' hacking.\cr
BH.BUSY&Specifies a code is good when a busy signal is detected.\cr}

\rcmd{STATUS} This command will return \bh's current status.  You can use
the variables above to determine its meaning.  For example:  ``{\tt ADDRESS
'BackHack'; SETVARS; STATUS; if $result = bh.frozen$ then SAY 'BackHack is
frozen!'}'' would print out a blurb if \bh\ was currently frozen.

\medbreak\centerline{\underbar{Commands added in v1.10}}

\cmd{DEVICE <unit> '<device name>'} This command is used to specify the
device driver that handles your modem.  It is provided for people with
multiport serial boards that use a different driver.  Note that device
names are case sensitive and must be included in quotes to prevent \ar\
from uppercasing them.

This command is only valid \underbar{before} you issue a {\tt START}
command.  If used after a {\tt START} command has been received \bh\ will
return a value of one.  Otherwise it will return zero.

If no device command is used, \bh\ will default to unit zero of
serial.device (aka, ``{\tt ADDRESS 'BackHack' DEVICE 0 'serial.device'}'').

\cmd{WAITSTRING <string>} This command will set the waitstring that \bh\
places between the dialup number and the start of the code/destination
string.  By default, this is ``,,''.  You can change the waitstring at any
time.  This returns zero if ok or one if the string was too long.

\cmd{WAITTIME <time in seconds>} This command will set the time that \bh\
will wait while checking to see if a code is valid.  Its default value is
fifteen seconds.  This command always returns zero.

If you use pulse dialing then you will probably need to increase the
waittime.  This is because it will take the modem more time to dial then it
would when tone dialing.  Since you can change the waittime at any time you
can experiment with it a bit while \bh\ is hacking to find a setting that
works best for you.

\cmd{DELAY <low time in seconds> <high time in seconds>} This command will
set the time that \bh\ will wait between trying codes.  With the release of
v1.11, \bh's logic has been changed to support fluxuating delay periods.
\bh\ will randomly generate the amount of time to delay within the bounds
set by the low and high values.  Note that you can still specify an
absolute time to delay by setting the low and high values equal to each
other.

The default range is a low time of five seconds and a high time of ten
seconds.  This command returns zero if ok or one if the range is invalid
(i.e., you specified a high time that was less than the low time).

\cmd{PHONE <phone type>} This command tells \bh\ what dialing method to
use, pulse or tone.  It defaults to tone.  Valid arguments to this command
are the variables {\tt BH.TONE} and {\tt BH.PULSE}.  It will return zero if
ok or one if you specified a value it didn't know.  To tell \bh\ to use
pulse dialing, for example, you would use ``{\tt ADDRESS 'BackHack';
SETVARS; PHONE $ph.phone$}''.

\cmd{MODEMINIT <string>} This command will set the modem init string that
\bh\ sends out when it initializes the modem.  It defaults to `{\tt ATZ}'.
You might use ``{\tt MODEMINIT AT\&C1\&D2}'', for instance.  This command
returns zero if ok or one if the string is too long.

\cmd{CODEFILE <path/name>} This command tells \bh\ where to write codes
when it finds a good one.  It defaults to ``{\tt S:BackHack.codes}''. This
command returns zero if ok or one if the string is too long.

When \bh\ finds a good code, it first checks to see if this file exists.
If not, it will create it for you.  It will then try and write the code to
this file.  If all this fails then it simply gives up and your only
knowledge of the code will be through the monitor window.

You should specify a full path with this command.  If you plan to have
spaces or lower-case characters in the path or filename then you must put
the whole string in quotes.  If you only have floppies (get a harddrive!)
and change disks alot then you might consider placing this file in RAM: to
prevent a requestor from popping up.  If you do specify a file on a disk
that will be removed then use the disk's \underbar{VOLUME} name.  {\bf Do
not use a device name like ``DF0:''!}  This will cause the system to try
and write to whatever disk happens to be in that device at the time,
regardless of whether or not it is the correct one.

Please note that no checking is done to determine if this is a valid path
or not.  If you specify something that doesn't exist and can't be created
with a simple {\tt Open(path, MODE\_NEWFILE)} call then you are doomed to
never writing out your codes.

\cmd{CDEST '<destination number>'} This command will add a destination
number to the carrier destinations list.  Destinations added with this
command will be used for services that use {\tt BH.CARRIER} or {\tt
BH.BLAST} for their type specification.  This command always returns zero.
Please note that this command also suffers from the same problem that the
{\tt DIALSTRING} command has with \ar\ treating hyphens as subtraction
operands.

\cmd{NDEST '<destination number>'} This command is exactly like the {\tt
CDEST} command, except that it is used to add destinations that will be
used for services that have a type specification of {\tt BH.NOCARRIER} or
(as of v1.12) {\tt BH.BUSY}.

\cmd{SERVICE '$\lbrace$<name>$\rbrace$ <dialup>' <order> <mode> <type>
'<make> <start> <time>'} This command is used to add a service to \bh's
list.  It returns zero if it was added ok, one if it had a memory
allocation failure, two if you were missing a terminator characer
(`$\lbrace$', `$\rbrace$', or `:'), three if one of your arguments was
invalid (such as using {\tt BH.RANDOM} in the {\tt <order>} field), or four
if you tried to add a service for which no destination number(s) of the
appropriate type have been defined.

\Entry The {\tt <name>} field specifies the name of the service.  This will
be displayed by \bh\ in the monitor window when it is hacking on it.  It is
also written to the code file to tell you what service the code found was
for.  Therefore, it would be to your advantage to make sure you always use
a different name.  However, doing so is not required.  Also, the name must
be enclosed in braces.  This allows for you to have spaces in the name
without causing \bh\ to hickup.

\Entry The {\tt <dialup>} field is the number that \bh\ should dial to
reach the service.

\Entry The {\tt <order>} field specifies whether to dial the code or
destination first.  It takes either {\tt BH.CODE} or {\tt BH.DEST} for an
argument.

\Entry The {\tt <mode>} field specifies the method of hacking to use.  It
takes as its argument {\tt BH.RANDOM}, {\tt BH.SEQUENTIAL}, or (as of
v1.12) {\tt BH.COMBO}.  Random and sequential hacking are easy enough to
figure out.  Combo hacking is both random and sequential at the same time.
When this mode is selected, the hacker will increment the code
sequentially.  However, instead of always incrementing the code by one, as
with sequential hacking, it will increment it by a randomly generated
number in the range of one to twenty-five.

\Entry The {\tt <type>} field specifies what \bh\ should look for to
determine if a code is good.  If it is {\tt BH.CARRIER} then \bh\ will
report a code when it detects carrier.  If it is {\tt BH.NOCARRIER} then
\bh\ will determine a code as good when it doesn't detect carrier within
the specified waittime.  If it is {\tt BH.BLAST} then it \underbar{must} be
followed by a blast time, which is in seconds.  When \bh\ gets carrier on a
blast service it will first wait out the specified blast time and then
check for carrier again.  If it still detects carrier then it assumes the
code is good.  If, on the other hand, it does not detect carrier anymore
then it figures the code was bad.  As of v1.12, \bh\ now supports another
type:  {\tt BH.BUSY} speicifes that a code is good when a busy signal is
detected.

Please note that you must have at least one destination number of the type
required by the service you are adding already installed in \bh\ before you
can use this command.  If you try to add a service that does not have any
destination numbers for it then \bh\ will return an error code of four, as
mentioned above, and the service will not be added.

\Entry The {\tt <make>} field tells \bh\ how to make the code.  Where a `?'
is found, \bh\ will install a random number from 0 to 9.  \bh\ will also
replace all occurances of `*' with a random number between 1 and 9.  All
other characters are treated as literals.

For example, to dial a completely random six digit number you would use
`??????'.  To get a five digit code that never starts with zero you would
use `*?????'.  If you wanted to hack a 9 digit code, but always have the
second and third digits be `48' you would use `?48??????'.

Please note than when using sequential or combo hacking {\bf you must still
use a template}!  The very first code \bh\ hacks on a sequential service is
generated randomly.  After that, \bh\ will increment the code by one,
following the rules of the template.  Therefore, if you specified a
starting number \bh\ would treat it as a string of literals and hack on
that one code endlessly!

\Entry The {\tt <start>} field tells what time of day \bh\ should start
hacking on this service.  It is in the format of `hh:mm' and is a 24 hour
clock.  To start at 10:30pm, for example, you would use `22:30'.

\Entry The {\tt <time>} field tells \bh\ how long to hack on the service.
It is in the same format as the {\tt <start>} field --- `hh:mm'.  Please
note that this is \underbar{not} a clock time, but a number of hours and
minutes since the start time.  For example, if you wanted to hack from
10:30pm to 4:00am you would use a {\tt <start>} of `22:30' (as shown above)
and a {\tt <time>} of `5:30'.

\Entry Please note the use of quotes on the command line.  Their position
and use is important.  When using a blast type service, you should put the
blast time inside the opening quote found before the {\tt <make>} field.
So, instead of ``{\tt\dots<type> '<make>\dots}'' you would have
``{\tt\dots<type> '<blast time> <make>\dots}''.

\medbreak\centerline{\underbar{Commands added in v1.12}}

\cmd{BUSY <busy string>}
This command lets you specify the string of characters your modem will
return when it detects a busy signal.  It returns zero if ok, or one if the
string was too long.  The default value for \bh's busy string is ``BUSY''.
If you are using terse return codes then you would want to use a ``{\tt
BUSY 7}'' command.  Note that the busy string is case insensitive.

\rcmd{LISTSERVICES <separator value>}
This command will return a list of all the services that \bh\ currently
knows about.  The list is returned as a series of names with an occurance
of the separator value between each.

The separator value is specified as a decimal number.  However, it is often
more convient to say I want to use, for example, a pipe (`{\tt |}') as a
separator than know that a pipe has an ASCII value of 124.  Therefor, you
might consider using the built-in \ar\ command {\tt c2d()}.  Using this, one
could issue the command ``{\tt ADDRESS 'BackHack' LISTSERVICES c2d('|')}''
rather than having to use ``{\tt ADDRESS 'BackHack' LISTSERVICES 124}''.

Often you will probably want to use a space (ASCII 32) as the separator
value.  However, since \bh\ allows spaces in service names, it is possible
to get a space from a service name instead of as a true separator.  That is
the reason for specifying the separator.  By using some non-printable
character your scripts can tell true separators from those in service
names.

\cmd{KILLSERVICE <service name>}
This command allows a service to be removed from \bh's lists.  It returns
zero if ok, one if it couldn't find the service, or (as of v1.15) two if
the service already has its expunge flag set.  Note that service names are
case sensitive so you must use quotes if the service you want to remove has
lowercase letters in it.

You do not need to put braces around the service name with this command, as
is required by the {\tt SERVICE} command.  However, note that \bh\ will
keep track of trailing spaces in a service name and for the name to match
you must include the same number of trailing spaces when using this
command.

This command was seriously broken in v1.12.  One could issue a kill command
while the service was being hacked on which lead to some rather bizarre
results.  This command has, of course, been fixed in v1.13.  Instead of
trying to kill the service right away it simply sets an expunge flag for
the service and returns.  The main hack loop has been modified to detect
this flag and kill the service off at a point when no harm will be done. 
The end result is that a service will not be deleted immediately and will
still show up in the list returned by the {\tt LISTSERVICES} command for a
short time.

\bh\ v1.15 has been modified to allow one to delete all occurances of a
service more easily.  With previous versions, one had to send the {\tt
KILLSERVICE} command, wait for \bh\ to get around to deleteing it (which
could take a while if several services were currently active), and
\underbar{then} send another {\tt KILLSERVICE} to knock out the next
occurance.  Now repeated calls to {\tt KILLSERVICE} will flag each
subsequent occurance of the service for deletion without having to wait for
any to actually be deleted.  A new return code (value of two) has been
added to denote that all occurances of a service have been flagged.  With a
simple \ar\ script (\underbar{KillAll.rexx}, included with this
distribution) one can now remove multiple occurances with ease.

\medbreak\centerline{\underbar{Commands added in v1.13}}

\cmd{SPEAKERON}
This command tells \bh\ to turn your modem's speaker on.  It returns zero if
ok or one if the speaker was already on.  \bh\ defaults to having the
speaker off so you must issue this command if you want it on.

\cmd{SPEAKEROFF}
This command tells \bh\ to turn your modem's speaker off.  It returns zero
if ok or one if it was already off.

\medbreak\centerline{\underbar{Commands added in v1.15}}

\cmd{VOICEON}
This command tells \bh\ to announce when a code has been found using the
\ami's narrator device.  This command returns zero if ok or one if the
voice is already turned on.

You must have two files present on your system disk for this command to
have any noticable effect:  {\tt LIBS:translator.library} and {\tt
DEVS:narrator.device}.  If either of these files is missing then \bh\ will
be unable to announce that a code has been found.  It will not harm \bh\ in
any way, though.

Note that \bh\ only opens the translator and narrator when it is ready to
speak a code and will release them as soon as it is done speaking.  This
helps prevent resources from being tied up.

\cmd{VOICEOFF}
This command tells \bh\ not to use its speak logic when a code is found.
This is the default condition when \bh\ is first started.  This command
returns zero if ok or one if the voice is already turned off.

\medbreak\centerline{\underbar{Commands added in v1.16}}

\cmd{PRIORITY <task priority>}
\bh\ sets itself up with a task priority of two when it kicks itself into
the background.  Generally this should not cause problems as \bh\ spends
most of its time {\tt Wait()}ing and thus uses very little CPU time.  In
fact, using {\it XOper v1.3\/} with the {\tt usage} option selected, I have
never seen \bh's total CPU usage go over 2.2\% on \underbar{\ \ MY\ \ }
system.

This command is provided for those cases when a priority of two does
interfear with something.  Issuing this command will cause \bh\ to change
its task priority rather than requiring you to use a program such as {\it
XOper\/} or {\it TaskX\/}, etc.  This command returns zero if the priority
was succesfully set, one if you specified a priority greater than that of
{\sl RexxMast}, or two if \bh\ was unable to locate {\sl RexxMast\/}.  Note
that {\sl RexxMast\/} installs itself at a priority of four so unless you
have changed its priority values of five and above are illegal in this
command.

If you try a command such as ``{\tt ADDRESS 'BackHack' PRIORITY -1}'' you
will be treated to an arithmetic conversion error.  This is due to the way
\ar\ parses an argument list.  To avoid this error you should either place
the -1 in quotes ({\tt PRIORITY '-1'}) or use \underbar{0}-1 ({\tt PRIORITY
0-1}).  Selecting task priorities that are positive do not suffer from this
problem.

\Section{Creating A Startup Script For BackHack}
If you are not familiar with \ar\ you might be wondering how to use these
commands effectly.  More importantly, you might be wondering how to even
get \bh\ up and going at all.  This section is designed to help you get
started on making your own startup script for \bh.  This can be placed in
your {\tt REXX:} directory and a simple ``{\tt rx backhack}'' command can
be used to load \bh, send it the needed startup commands, and get it
running.

For this discussion, we will assume a hypothetical situation where you are
using a mythical multiport serial board which has a device driver by the
name of `mythical.device' and for which your modem is connected to port
two, thus requiring that you specify unit two when accessing the serial
device.  We will figure that this is a floppy based system and put the
codefile in {\tt RAM:} to eliminate a requestor popping up asking you to
insert the disk with your {\tt S:} directory on it.  From previous
experimentation, you determined that a waittime of 25 seconds worked best
when hacking.  We will install one mythical service.  It has a name of
`Miroc' (don't ask how I got that one\dots) with a dialup of 950--0990.
This service requires that you dial the destination number first and
returns carrier on a good code.  It uses codes that are seven digits long
and can never have a zero as the last digit.  We want to hack randomly on
this service from 9:00pm to 5:00am.

To begin the script we must first have a comment, even if it says nothing.
This is required by \ar\ and it will return a `program not found' message
if the initial comment is missing.  We will also make the script check for
the presence of \bh\ and start it if it can't find it.  If it is unable to
start \bh\ then it exits with an error.
{\smallbreak\hrule\smallbreak\baselineskip=12pt\tenrm
\obeylines {\tentt /* A script to load BackHack and get it running */}
\vskip\baselineskip
{\tenbf options results} \quad {\tentt /* so we can get result strings */}
{\tenbf options failat} $30$ \quad {\tentt /* prevent ARexx from dying on errors 20, 21, and 22 */}
\vskip\baselineskip
{\tenbf if showlist}$('Ports','BackHack')=0$ {\tenbf then do}
\quad {\tenbf address command}
\quad 'c:BackHack'
\quad {\tenbf WaitForPort} 'BackHack'
{\tenbf end}
{\tenbf if showlist}$('Ports','BackHack')=0$ {\tenbf then do}
\quad {\tenbf say} 'Unable to load BackHack'
\quad {\tenbf exit} $10$
{\tenbf end}
\smallbreak\hrule\smallbreak}

We now have \bh\ started in the system.  Currently it is waiting for a {\tt
START} command and is not hacking.  We use an address command to specify
\bh\ as the host port and call {\tt SETVARS} to install the compound
variables.  We then set up the codefile and device, etc, to be used while
hacking.  Those settings where the default is acceptable we do not include
commands for.
{\smallbreak\hrule\smallbreak\baselineskip=12pt\tenrm
\obeylines {\tenbf address} 'BackHack'
{\tenbf setvars}
\vskip\baselineskip
{\tenbf device} $2$ 'mythical.device'
{\tenbf waittime} $25$
{\tenbf codefile} 'RAM:Codes'
\smallbreak\hrule\smallbreak}

We will now define a couple of destination numbers to be used.  Please note
that these are not real destination numbers\dots
{\smallbreak\hrule\smallbreak\baselineskip=12pt\tenrm
\obeylines {\tenbf cdest} '415-272-9462'
{\tenbf cdest} '912-345-3252'
{\tenbf cdest} '704-938-1199'
\smallbreak\hrule\smallbreak}

Now we have our actual service definition.  Note the use of the compound
variables installed by {\tt SETVARS} to specify options for the service.
{\smallbreak\hrule\smallbreak\baselineskip=12pt\tenrm
{\tenbf service} '{Miroc} 9500990' $bh.dest\ bh.random\ bh.carrier$ '??????* $21$:$00$ $8$:$00$'
\smallbreak\hrule\smallbreak}

Finally we will tell \bh\ it is ok to hit hack mode.  We will also tell it
to open its monitor window so we can see what it is doing.
{\smallbreak\hrule\smallbreak\baselineskip=12pt\tenrm
\obeylines {\tenbf start}
{\tenbf windowon}
\smallbreak\hrule\smallbreak}

At this point we are done.  The script ends and \bh\ is up and running.  I
hope this provides a suitable example for creating a startup script of your
own.  If you still need help find someone who is more familiar with \ar\
and ask them to give you a hand.

\Section{A Little About The Monitor Window}
The monitor window is divided into upper and lower regions, seperated by a
bar.  The upper region tells you about the current service and what \bh\ is
currently up to.  You will notice that the upper region contains a `{\tt
Last Code Found:}' field.  \bh\ keeps track of the last code found for each
individual service and will display it here.

The lower region is an over-all status of \bh's accomplishments.  The `{\tt
Last Code Found:}' field here refers to the most recent code found out of
all the services.  It also tells you the total number of tries \bh\ has
made between all the services.

With the release of v1.16, \bh's monitor window has been updated to include
a few menu options.  All options correspond to the \ar\ command by the same
name.  Please note that when you select speaker on/off the state of the
checkmark will change but the effect will not be seen until the next hack
attempt.

\Section{Closing Notes}
Unlike many hackers I have seen, BackHack will re-seed its random number
generator at startup, using the system time as the seed value.  From that
point on, as part of the dispatch routine, it will randomly re-seed itself
from time to time.  How long it will be between re-seeds can range from
zero minutes to twenty-four hours later (taking into account that the
dispatcher only runs every 10 minutes, of course).

As of v1.13, \bh\ will verify that a code is valid before reporting it.
The verification will occur the next time the service is up for hacking.
If the code is deemed invalid the second time around it is not recorded.
This is particularily useful for services with a type specification of {\tt
BH.BLAST}.  \bh\ will give special treatment to a service that has a verify
pending.  First off, say \bh\ thinks a code is valid and sets the verify
flag.  Before it can get around to the service again to perform the verify
it dispatches and determines that the service should now be in-active.  It
will still carry out the verify, even though the service is in-active,
instead of waiting to do it first thing the next time the service is
re-activated.  Secondly, a service with its verify flag set will not be
killed if it's delayed expunge flag is set until after the code has been
verified.

OK, then.  This is \ver.  I haven't heard much from anybody about what they
think should be done to the hacker.  If you have any suggestions or (god
forbid) bug reports then leave me mail on {\it ESI New York
(516)/794-1473\/}, {\it ESI California (213)/836-1346\/}, or {\it The Inner
City (312)/462-8067.}

\bye