> Most famous in-band admin hack has to be the +++ syntax for Hayes modems which flipped the mode bit into 'command' mode serial comms mode.
Unlike this case the +++ hack did not really limit legitimate data you could send on Hayes. As far as I remember it had to be preceded and followed by pauses, so transmitting this comment wouldn't trigger it.
From what I recall (and this could very well be apocryphal), the pauses were what was patented. Non-Hayes modems still reacted to +++ but didn't need the pause. So if you could trick their software into sending "+++ATH;ATDT911" you would make them call 911.
I'd love confirmation or denial of that patent thing.
From the wikipedia page (so take it with a wikipedia sized grain of salt :-)
"Hayes had patented this concept in 1985 in patent #4,549,302, the Modem With Improved Escape Sequence With Guard Time Mechanism, generally referred to as the "Hayes '302 patent". Hayes licensed the guard time to other manufacturers for $1 a modem – a charge which competitors derisively termed the "modem tax". A number of manufacturers banded together and introduced the Time Independent Escape Sequence, or TIES, but it was not as robust as Heatherington's system and never became very successful."
Yes, the pauses were essential to the patent. As I recall they had to be a specific length and a couple of knock offs worked around the patent by making them slightly shorter.
Unlike this case the +++ hack did not really limit legitimate data you could send on Hayes. As far as I remember it had to be preceded and followed by pauses, so transmitting this comment wouldn't trigger it.