Make your own free website on Tripod.com



CABLE TV DESCRAMBLERS

FREQUENTLY ASKED QUESTIONS

follow the links at the bottom for more info....

Are Descramblers legal ?

YES! Descramblers are legal. If your cable TV company can possess & rent the box to you then you can own the box yourself. An example in time would be when ATT rented telephones to consumers. The feds directed that it was legal for consumers to own their own phone. Now you wouldn't consider buying only from ATT. The cable TV industry is in its early stages relative to this development. It is legal for you to purchase and it is legal for you to own. When you buy a cable box it is your responsibility to inform the cable TV company that you are accessing their signal. It is illegal to receive their transmission without paying for it. This holds true even if your cable box is purchased as a non-addressable, non-detectable, and "bullet proof" unit.  


Are all Descramblers and Converters alike ?

No. Prices can range from $15 to $400 depending on the quality and amount of features included in the equipment. Some companies offer to sell you a description of how you can build(implied), with only 7 parts from Radio Shack, a descrambler. Some sell old converters and descramblers that are barely in date and likely to be replaced by the cable companies by higher technological grades of equipment. Some cable box sellers provide systems that hardly provide any benefit to the purchaser where the quality of reception is poor, without recourse. State of the art cable box companies will provide the most recent technology in a variety of packages tailored to fit the consumer's budget. They should provide two-piece systems, all-in-one combination systems, comprehensive universal fits all model line systems, refurbished RAN Baseband boxes in conjunction with the latest tech versions. Of course, you get what you pay for. But there are some reasonable values out there.  


Which Descrambler System is best ?

You have two choice when purchasing your cable equipment, a single unit(one-piece) system or a system containing two units(two-piece).

Combination Box Advantages:

The one-piece system is based on a combination of a converter and a descrambler, installed in a single box. This unit is referred to as a combination unit. The pluses:

Separate Component Advantages:

The two-piece system is based on two separate units, a converter and a desrambler, that are connected together and function as one-piece system. The pluses:


What is a Converter ?

An electronic tuning device that transposes all available channels from the cable company into either channel 3 or channel 4. A converter is simply a "channel changer" that cannot by itself descramble encoded premium channels. It allows you to receive all basic channels if your TV is not the cable ready type. When you add a descrambler to your converter, it allows you to view all premium channels.  


What is a Descrambler ?

A Descrambler is a device that restores the picture and sound of a scrambled channel. A Descrambler must be used with a Converter (in a two-piece configuration) to be able to descramble all the premium channels of a cable system.  


What is a Converter/Descrambler ?

A single (one-piece) unit capable of descrambling premium cable channels. This unit contains a converter and a descrambler, enclosed in a common box.

This is also the most common type of equipment supplied by the cable company to subscribing customers. Customers usually pay a specified monthly rental fee for such equipment.


What is an Addressable Converter/Descrambler ?

This is a Converter/Descrambler that can be controlled by the cable company from their office location. Through remote coded messages sent via the cable system, the cable company can "address" the customer's unit to begin descrambling selected premium or pay-per view channels. An addressable unit allows the cable company to access your cable box to change the descrambling configuration or program. This function provides the cable company the ability to add or delete descrambling on the channels that come in through your cable line. A non-addressable unit does not provide the cable company access to the cable box program. The program remains stationary and is unchangable. Both cable box designs have the potential of receiving all channels, none or somewhere inbetween dependent on the box program.


Cable terms: Basic Cable, Premiun Cable, Pay Per View Services ?

Basic Cable Service: The least expensive cable service provided by cable companies to their customers. This service usually includes Local TV channels which can be received directly from the broadcast signal of the TV stations.

Premium Cable Service: Additional programming service provided by the cable company to subscribing customers. The extra fee for such additional service may be based on a per channel, per group of channels, or on any other combination of channels.

Pay Per View: Selected channels that offer movies and special events such as sports or adult entertainment, for an additional fee, on a per movie or per program basis. A special "addressable" converter is furnished by the cable company to subscribers of this service. Through the use of special equipment, the cable company can "address" the customer's converter to descramble the program for which the fee was paid.


Can your Descrambler work anywhere ?

No. Descramblers are specific to each cable system. Different cable companies use different cable systems, characterized by the manufacturer's brand name and model number. You must use a compatable descrambler that works in your area but may not work in a different area.


What do you do if your Converter/Descrambler doesn't work ?

Call your Converter/Descrambler box source. Let them know that there are problems. Most companies want to correct any problems you are having. If you are working with a customer oriented company, they will work dilligently to remedy your problem. Don't just let it go. They will want a satisfied customer who will refer them additional business. The company may not have a quick answer for about 5% of the problems out there. Be patient and work with your cable box company until you find the right converter/descrambler box for your area. Sometimes technology changes for your area and the source may need to do some additional research to get the desired image. Do this before the warranty/guarantee has run out. Even then there may be a solution.


How can you improve the quality of your Converter/Descrambler reception?

Amplification may be needed to correct the problem. Whenever a cable signal is split between two or more TVs or routed to some other video components such as VCRs, the signal weakens and produces a poor quality picture. The weak signal may cause a "snowy" or gray picture, or may even result in weak color or lack of color.

Since most cable viewers use several different video components, it is recommended that an amplifier be used to restore the signal strength and the picture sharpness. In most cases, the amplifier brings the picture "back to life" and restores its original quality. Consider using a 10db Amplifier to improve signal strength.


What happens when there isn't a replacement for your cable company box ?

Most Descrambler sources will carry the common brands such as Jerrold(GI), Pioneer, Scientific Atlanta, Oak, Tocom and Zenith. When your company doesn't carry your brand then you need to find out if they either have in stock or have a source for your uncommon make and model. Usually the source has another outlet or may need to do research on your request.  


What are "bullets" and can the cable company destroy my box ?

Bullets are nothing more than transmitted signal which effects the cable box program. It does not fry the guts of the equipment but rather may shut the box off temporarily, reprogram the box, or shut the box down in an error mode til service can rectify the problem. A non-addressable box with the appropriate filters will manage this process effectively. This is what is meant by a "bullet-proof" cable box.


How do you determine the replacement for your cable box ?

    1) Get the brand name & the model number of the converter/descrambler unit that was supplied to you by your cable company. The brand name is located on the front of the box. The model # is located on the bottom of the box on a tag.
    2) Look at the companies list of cable box products and their corresponding replacement descriptions(your equipment model number) in their catalog. From this you can determine what you will need or consult in conjunction with your cable box source for the right replacement.


What is Baseband ?

Baseband signal is where audio and video scrambling is used in conjunction with coaxial (fiber optic)cable. The cable company de-synchronizes the pulse system thus moving the video/audio signal to a neutral channel(usually FM). The picture rolls and displays a wiggly white line running down the left, right or both sides of the screen. This outband type usually places the missing sinc on channels 42, 49, 50, 52 or 53. The Descrambler unit restores the pulse sinchronization making it possible for vertical and horizontal video and audio signal to stabilize.


How can you determine if you are dealing with a professional Descrambler company?

First , of course, trust your own judgment. A company you can trust will be one that has at least a 30 day Guaranty and a 90 day warranty on their products. Offers a variety of equipment for most areas of the country and some areas of the world. A prepared company will have its staff equipped with a zip code manual which provides a list of equipment per zip code. The company will have the capability of delivering your equipment 2 day air, 4 day ground, International, or other if agreed upon. Staff are capable of answering most technical questions. An 800 number for easy calling access for the customer.


For More Information on the Telecommunications Act & the Law: Go to: 
Telecommunications Act of 1996 See sections 304 and 629


SCRAMBLING TECHNOLOGIES

The ownership of a signal descrambler does NOT give the owner the right to decode or view any scrambled signals without authorization from the proper company or individual. Use of such a device without permission will subject the to violation of state and/or federal laws. The information contained herein is intended to serve as a technical aid to those person seeking information on various scrambling techniques.

No Scrambling (Traps/Addressable Traps)
A cable system may not be scrambled at all. Some older systems (and many apartment complexes) use "traps" or "filters" which actually REMOVE the signals you aren't paying for from your cable. (These are negative traps because they remove a signal.) These systems are relatively secure because the traps are often located in locked boxes, and once a service technician finds out they're missing or have been tampered with (by pushing a pin through a coax trap to change its frequency, for example), it's a pretty solid piece of evidence for prosecution.Another method is where the head-end ADDS an extraneous signal about 2.5 MHz above the normal visual carrier which causes a tuner to think its receiving a very strong signal--the tuner then adjust the automatic gain control and buries the real signal. If you pay for the service, the cable company adds a "positive trap" which then REMOVES the extraneous signal so it becomes viewable. (This system is very easy to circumvent by building your own notch filter, so it is not very commonly used.) Advantages to a cable system with this technology is that you don't need a cable box--all your cable-ready TVs, VCRs, etc. The disadvantage is that pay-per-view events are not possible, and that every time someone requests a change in service, a technician has to be dispatched to add/remove the traps.

Becoming more popular, not only because of the Cable Act of 1992 but also in an effort to stop "pirates" are addressable taps. Many cable companies may move to this technology in the near future. These are devices located at the pole, where your individual cable feed is tapped from the head-end. Similar to addressable converters, they each have a unique ID number and can be turned on/off by a computer at the head-end. Any stations which you are not paying for are filtered out by electronically switchable traps in the units. (Including the whole signal if you haven't paid your bill or had the service disconnected.) {several patents have already been issued for various methods of making sure you don't see a channel you don't pay for.} Again, these almost GUARANTEE an end to piracy and don't have any of the disadvantages of the manual traps. Plus, they provide a superior signal to those customers paying for service because they no longer need complicated cable boxes or A/B switches -- and they can finally use all of the "cable-ready" capabilities of the VCR, TV, etc. About the only known attack on this type of system is to splice into a neighbors cable, which again provides plenty of physical evidence for prosecution. The negative side of this technology is that it is VERY expensive to implement and very unreliable from weather elements.

SINE WAVE SCRAMBLING
Early Oak (and some very early Pioneer boxes) employed a sine-wave sync suppression system. In this system, the picture would remain vertically stable, but wiggling black bars with white on either side would run down the center of the screen. The lines were caused by a 15,750 Hz sine-wave being injected with the original signal, causing the sync separator in the TV to be unable to detect and separate the sync pulses. Later, Oak came out with a "Vari-Sync" model, which also removed a 31,500 Hz sine-wave added to the signal. Oak was one of the first to use extra signals ("tags") as a counter-measure for pirate boxes -- in the normal mode, a short burst of a 100 KHz sine-wave (the tag signal) would be sent during the VBI, along with the AM sine-wave reference on the audio carrier and scrambled video. They would then put the AM sine-wave reference signal onto the audio carrier, leave the video alone, and NOT send the tag. Any box which simply looked for the AM sine-wave reference would effectively scramble the video by adding a sine-wave to the unscrambled video! Real decoders looked for the tag signal and still worked correctly. Other combinations of tag/no tag, scrambled/unscrambled video were also possible.

GATED SYNC SUPRESSION
Early Jerrold boxes used in-band gated sync suppression. The horizontal blanking interval was suppressed by 6 dB. A 15.734, 31.468 or 94.404 KHz reference signal (conveniently all even multiples of the horizontal sync frequency) was modulated on the sound carrier of the signal, and used to reconstruct the sync pulse. An article in February 1984 issue of Radio-Electronics explains this somewhat-old technique. Converters which have been known to use this system include the Scientific-Atlanta 8500-321/421, a number of Jerrold systems, Jerrold SB-#, SB-#-200, SB-#A, RCA KSR53DA, Sylvania 4040 and Magnavox Magna 6400.

TRI MODE SCRAMBLING
A modification to the 6dB sync suppression system, dubbed "tri-mode", allows for 0, 6 and 10 dB suppression of the horizontal sync pulse. The three sync levels can be varied at random (as fast as once per field), and the data necessary to decode the signal is contained in unused lines during the VBI (along with other information in the cable data stream.) See the February 1987 issue of Radio-Electronics for a good article (both theory and schematics) on the tri-mode system. Converters which have been known to use this system include a number of Jerrold systems, Jerrold SBD-#A, SBD-#DIC, Jerrold Starcom VI (DP5/DPV models), Regency, Scientific- Atlanta 8550-321 and early Pioneer systems.

OUT BAND GATED SYNC
Out-band gated sync systems also exist, such as in early Hamlin converters. In this system, the reference signal is located on an unused channel, usually towards the higher end (channels in the 40's and 50's are common, but never in the low 30's due to potential false signalling.) The signal is comprised of only sync pulse information without any video. Tuning in such a channel will show nothing but a white screen and will usually have no audio.

SSAVI SCRAMBLING
Syncronization Suppression and Active Video Inversion is most commonly found on Zenith converters. ZTAC is an acronym for Zenith Tiered Addressable Converter. Besides suppressing sync pulses in gated-sync fashion, video inversion is used to yield four scrambling modes (suppressed sync, normal video; suppressed sync, inverted video; normal sync, inverted video; and normal sync, normal video). The mode of scrambling can be changed as fast as once per field. Their is no "reference signal" per-se, but the horizontal sync pulses during the VBI are not suppressed, allowing a phased-lock loop to be used to generate the missing sync pulses. Information on whether the video is inverted or not is contained in the latter-half of one of the lines of video, usually line 20 or 21. The Drawing Board column of Radio-Electronics starting in August '92 and going through early '93 described the system and provided several circuits for use on an SSAVI system. Audio in the system can be "scrambled" - usually by burying it on a subcarrier that's related mathematically to the IF component of the signal. Addressable data for Zentih systems is sent in the VBI, lines 10-13, with 26 bits of data per line.

TOCOM SYSTEMS
The Tocom system is similar to the Zenith system since it provides three levels of addressable baseband scrambling: partial video inversion, random dynamic sync suppression and random dynamic video inversion. Data necessary to recover the signal is encrypted and sent during lines 17 and 18 of the VBI (along with head-end supplied teletext data for on-screen display). The control signal contains 92 bits, and is a 53 ms burst sent just after the color burst. Up to 32 tiers of scrambling can be controlled from the head-end. Audio is not scrambled.

PIONEER SYSTEMS
The newer 6000-series converters from Pioneer supposedly offer one of the most secure CATV scrambling technologies from a "major" CATV equipment supplier. From the very limited information available on the system, it appears that false keys, pseudo-keys and both in-band and out-band signals are used in various combinations for a secure system. From U.S. patent abstract #5,113,441 which was issued to Pioneer in May '92 (and may or may not be used in the 6000-series converters, but could be), "An audio signal is used on which a key signal containing compression information and informaton concerning the position of a vertical blanking interval is superimposed on a portion of the audio signal corresponding to a horizontal blanking interval. In addition, a pseudo-key signal is superimposed...so that the vertical blanking information on the 6000-series scrambling technique, please send mail!} Note that Pioneer boxes are "booby-trapped" and opening the unit will release a spring-mechanism which positively indicates access was gained to the interior (and sends a signal to the head-end on a two-way system, and may disable the box completely.) {See U.S. patent #4,149,158 for details.} The mechanism cannot be reset without a special device. Pioneer systems transmit their addressing data on 110.0 MHz.

SCIENTIFIC ATLANTA SYSTEMS
Some of the early S-A boxes used 6 dB only sync suppression (some of the 8500 models), and some of the 8550 boxes are tri-mode systems. The three digit number after the model (such as 321) is a code which indicates the make of the descrambler in the unit. Apparently some of the newer S-A boxes use a technique called "dropfield".  Scientific-Atlanta systems transmit their addressing data on 106.2 or 108.2 MHz.

OAK SIGMA
This a secure system which replaces the horizontal sync of each line of video with a three-byte digital word. Video is switched from inverted to non-inverted between scene changes, and the colorburst frequency is shifted "up". This is a standard "suppressed" sync video scrambling method and is relatively simple to defeat with the appropriate circuitry. HOWEVER, the three-byte digital word in the area where the sync normally is contains audio and sync information. The first two bytes contain a digitized versions of the audio, the third byte contains sync information (and perhaps addressing data?) The two bytes of digitized audio are encrypted; a separate carrier signal contains the decryption keys for the digital audio datastream.

CHAMELEON
The research and development division of Fundy Cable Ltd., NCA Microelectronics, has a systemd dubbed "Chameleon". They claim it is a cost-effective solution that prevents pay TV theft by digitally encrypting the video timing information of sync suppression systems. The company claims the technology has been proven to be effective against pirate and tampered boxes. Supposedly, existing decoders can be upgraded to Chameleon technology with a low-cost add-in circuit, and that the card's sealed custom IC, developed by NCA, is copy-proof.

VIDEOCIPHER
The VideoCipher system is now owned by General Instrument and is used primarily for satellite signals at this time. VideoCipher I is the "commercial" version which uses DES (Data Encryption Standard)-encrypted audio AND video. A VCI descrambler is not available for "home" owners. VideoCipher II is the now-obsolete system which used a relatively simple video encryption method with DES-encrypted audio. (Specifically, the audio is 15 bit PCM, sampled at ~44.1 KHz. It is mu-law companded to 10 bits before transmission.) This has recently been replaced by the VideoCipher II+, which will be replaced by VideoCipher IIRS (a smart-card based system). Supposedly, coded data relating to the digitized, encrypted audio is sent in the area normally occupied by the horizontal sync pulse in the VCII system. (The Oak Sigma CATV system uses a similar technology.) Several methods existed for pirating the VCII based system, and some supposedly exist for the new VCII+ format.

DIGICABLE/DIGICIPHER
DigiCipher is an "upcoming" technology being developed by General Instrument for use in both NTSC and HDTV environments. The DigiCipher format is for use on satellites, and the DigiCable variation will address CATV needs. It provides compression algorithms with forward error correction modulation techniques to allow up to 10 "entertainment quality" NTSC channels in the space normally occupied by one channel. It provides true video encryption (as opposed to the VCII-series which only DES encrypts the audio). In a Multiple Channel Per Carrier (MCPC) application, the data rate is ~27 MB/second via offset QPSK modulation. Audio is CD-quality through Dolby AC-2 technology, allowing up to four audio channels per video channel. The system uses renewable security cards (like the VCIIRS), has 256 bits of "tier" information, copy protection capability to prevent events from being recorded, commercial insertion capability for CATV companies, and more. The multichannel NTSC satellite version of DigiCipher started testing in July of 1992, and went into production several months later.

B-MAC
MAC is an acronym for Mixed Analog Components. It refers to placing TV Horizontal-blanking interval, and then separating the color and luminance portions of the picture signal for periods of 20 to 40 microseconds each. In the process, luminance and chrominance are compressed during transmission and expanded during reception, enlarging their bandwidths considerably. Transmitted as FM, this system, when used in satellite transmission, provides considerably better TV definition and resoluton. Its present parameters are within the existing NTSC format, but is mostly used in Europe at this time.
.
Market Codes
Note that almost every addressable decoder in use today has a "unique "serial number" programmed into the unit either in a PROM, non-volatile RAM, EAROM, etc. This allows the head-end to send commands specifically to a certain unit (to authorize a pay-per-view events, for example.) Part of this "serial number" is what is commonly called a "market code", which can be used to uniquely identify a certain cable company. This prevents an addressable decoder destined for use in Chicago from being used in Houston. In most cases, when a box receives a signal with a different market code, it will enter an "error mode" and become unusable. This is just a friendly little note to anyone who might consider purchasing a unit from the back of a magazine if the unit has not been "modified" in any way to prevent such behavior, you could end up with an expensive paper weight... (see next section)

Test Chips
So-called "test chips" are used to place single-piece converters (that is, units with both a tuner and a descrambler) into full service. There are a number of ways to accomplish this, but in most cases, the serial number/market code for the unit is set to a known "universal" case (RARE THESE DAYS) or, better yet, the comparison checks to determine which channels to enable/disable are bypassed by replacing an IC in the unit.Hence, the "descrambler" will always be active, no matter what. This latter type of chip is superior because it cannot be disabled and is said to be "bullet proof", even if the cable company finds out about a "universal" serial number. (When the cable company finds out about a universal serial number, it is easy for them to disable the converter with a variation on the "bullet" described below.)

Cubes
A relatively new "test device" has been advertised in magazines such as Electronics Now (formerly Radio-Electronics) and Nuts & Volts. It's called a "cube" and it SIMULATES the addressing data signal for a cable box. You plug the cable into one side, where it filters out the real data signal, and out the other side comes a normal signal, with a new data stream. This new data signal tells whatever boxes are connected after it to go into "full-service" mode (including any cable company-provided boxes). It is usually a non-destructive signal, and if the the "cube" is removed from the line, the real data signal gets sent to the converter which then goes back to normal operating mode. I say "usually non-destructive" because there are some cubes that re-program the electronic serial number in a box to a new value. (This has the advantage that it will work with ANY converter the unit was designed for.) The "non-destructive" versions of the "cube" usually require that you provide the serial number from the bottom of the converter you're interested in "testing". That way a custom IC can be programmed to address that converter with the necessary codes. (Otherwise the converter would ignore the information since the serial number the cube was sending and the one in converter wouldn't match.)

Bullets
First and foremost, THE "BULLET" IS NOTHING MORE THAN THE NORMAL CABLE DATA STREAM WITH THE APPROPRIATE "CODE" TO DISABLE A CONVERTER WHICH HAS NOT BEEN ACKNOWLEDGED BY THE CABLE COMPANY.For instance, the head end could send a code to all converters which says "unless you've been told otherwise in the last 12 hours, shut down." All legitimate boxes were individually sent a code to ignore this shut down code, but the pirate decoders didn't get such a code because the cable company doesn't have their serial number. So they shut down when the see the "bullet" code. The "bullet" is NOT a harmful high-voltage signal or something as the cable companies would like you to believe if it was, it would damage anyone with a cable-ready TV or VCR connected to the cable (not something the cable company wants to deal with!) The only way to get "caught" by such a signal is to contact the cable company and tell them your illegal descrambler just quit working for some reason) Not a smart thing to do, but you'd be surprised (especially if it's someone else in the house who calls, like a spouse, child, babysitter, etc.) While we're on the subject, it's also not a good idea to have cable service personnel come into your residence and find an unauthorized decoder. If you have one, use common sense and tell anyone you live with to call YOU and NOT the cable company if something goes wrong. Just some friendly advice...

Time Domain Reflectometry / Leak Detection
The cable company can use a technique called "Time Domain Reflectometry" (TDR) to try and determine how many devices are connected to your cable. In simple terms, a tiny, short test signal is sent into your residence and the time domain reflectometer determines the number of connections by the various "echoes" returned down the cable (since each device is at a different point along the cable, they can be counted.) Each splitter, filter, etc. will affect this count. A simple way to avoid being "probed" is to install an amplifier just inside your premises before any connections. This isolates the other side of the cable from the outside, and a TDR will only show one connection (the amplifier). The cable company also has various ways of detecting signal "leaks" in their cable. The FCC REQUIRES them to allow only so much signal to be radiated from their cables. You may see a suspicious looking van driving around your neighborhood with odd-looking antennas on the roof. These are connected inside to field strength meters which help locate where the leaks are coming from so they can be fixed (to prevent a fine from the FCC!) If you've tampered with a connection at the pole (say, to hook up a cable that had been disconnected) and didn't do a good job, chances are the connection will "leak" and be easily found by such a device. This can also happen INSIDE your residence if you use cheap splitters/amplifiers or have poorly-shielded connections. The cable company will ask to come inside, and bring with them a portable field strength meter to help them locate the problem. Often they will totally remove anything causing the leak, and may go further (e.g., legal action) if they feel you're in violation of your leak level.
  DSS DESCRAMBLING  

THE DSS BROADCASTING SYSTEM

DirecTV’s digital broadcast systems consist of 3 satellites orbiting above the earth’s equator at 101 degrees West.  Their 3 satellites transmit in high powered Ku-Band:  DBS-1 has a total of 16 transponders.  DBS-2 and DBS-3 have 8 transponders each.  With these 32 transponders, DirecTV, USSB, and a few private networks broadcast their signals over most of the North American continent.  Any owner of a satellite system with the DSS logo is capable of receiving and viewing their broadcast if they subscribe to DirecTV or USSB’s programming services. In the mainland United States, most systems can pick up their signal clearly with the standard 18 inch dish.  If you are further away, like in Canada, you can pick up the signal at a lower strength, or can substitute the 18 inch dish with a larger dish to boost the signal strength. The 3 Satellites creates a large
one-way communication network with the 4 millions DSS systems in North America. Only owners of the DTV/USSB DSS systems can receive the signals from the satellites, a typical home system is not capable of transmitting information back up to the satellites. In order for DirecTV to track your Pay Per View (PPV) usage, you must hook up a phone line to the back of your receiver, this is the only way you can send information about your receiver or access card to DirecTV.  DirecTV’s uplink station is located in Castle Rock, Colorado.  This is where they gather broadcasts from all the program providers like HBO, CNN, etc. and process their video before sending them up to the 3 satellites.  DirecTV owns the 3 satellites, and leases 5 transponders to USSB.  DirecTV Inc. is a unit of Hughes Electronics Corp., Hughes Electronics Corp. is owned by General Motor.  News Datacom Ltd., owned by Rupert Murdock, is the company that is contracted by DirecTV to maintain the
security of their satellite signal.  News Datacom designs and owns the access card that is in your receiver.  They are also responsible for creating ECMs (Electronic Counter Measures) to shut down any unauthorized devices that access their satellite signal.

The 3 satellites communicate with your receiver and access card via the datastream.  The datastream is a constant stream of digital data packets that is sent down from the satellites, somewhat similar to the Internet data communication method where each packet has an assigned address to the intended recipient, so DirecTV can address your card or receiver individually, but can also send out commands with global or group addresses to reprogram multiple cards at the same time. The serial number from your card plus the serial number from your receiver forms a unique ID.   Under normal operation , your receiver will filter out any packets that do not have your unique ID, and will only pass commands to your card if  the packets have the right
address.

THE ACCESS CARDS

The plastic access card in your DSS receiver is commonly refer to as a H series card, or P2.  It’s serial number should be at 0000 4000 0000 or higher, the range of serial numbers have been reported to be over 0012 0000 0000.  Older series such as the E, F and G cards or the P1’s have been phased out by DirecTV and are no longer fully functional on DSS systems.  Those cards will have a serial number of 0000 3999 9999 or lower. The latest H cards have the letter "c" printed on them, it means that a minimum of 18 update codes are preprogrammed on them.  Cards that were already in use received the 18 update codes via DirecTV’s satellite transmission.  Five new additional updates codes are being sent to regular subscribed cards, so a total of
23 updates should have been written to your H card if it is used under a normal subscription.  The term "virgin" is used to describe a new plastic access card that has not been inserted into the receiver yet. When a card is inserted into the receiver, it "marries" that particular receiver by storing the receiver’s unique ID number on the H’s EEPROM.  Once a card is married to a receiver, it will not function normally when inserted into a receiver with a different ID number.  Cards can be wiped clean or reset back to virgin with the right software.   An "expired" card is a card that once had an active subscription but has been canceled.  An expired card will show only the 3 preview channels (100, 267, 999)

The H access card consists of a Seimens 8501 microprocessor, several forms of memory: ROM, RAM, and EEPROM, an ASIC, and a few minor electronic components.  The ASIC or Application Specific Integrated Circuit is a co-processor that helps the main CPU process the decryption algorithm at a much faster rate than the older F series card, thus making all older F cards/hacks/emulators useless for the video decryption of the satellite signal. The ASIC is the main reason why there is no full hardware emulator out there for the H right now. It is very difficult and expensive to manufacture a replacement ASIC at small quantities, and to utilize or "enslave" the existing ASIC in a H card puts the card at a risk of getting damaged by an ECM.  The
EEPROM (Electronic Erasable Programmable Read Only Memory) stores the most important information about your card and the decryption algorithms, it is also the only part of the card that can be changed, other than the temporary RAM area. The ROM  (Read Only Memory) stores your card's serial number, which is not changeable.  This is why there are no true clones for the H access card.  The DSS access card communicates with your receiver via protocols that comply to the ISO 7816 standards for smartcard communications.

Electronic Counter Measures or ECMs can be defined as any changes in the datastream in an attempt to disable unauthorized devices from decrypting the satellite transmission.  This can be in the form of changing the speed or the format of the packets, withhold crucial packets that the hacks need to function, adding new commands or software in the packets to change the operations of the H access cards, or other creative methods that we have not seen yet.

You cannot avoid the ECMs, most ECMs are permanent changes on the datastream.  If you pull your card out of the receiver, it will delay your card form getting hit, but as soon as your put your card back in the receiver, it will be affected. The only benefit for pulling your card out is to avoid permanent damages to card until you contact your dealer for further instructions or update your card with new software to make it compatible with the ECM before it is exposed to the datastream.  But repeated pulling and re-inserting your card in your receiver increases the chances of it being damaged by wear and tear.

Your receiver continues to receive the datastream even when the power button is off.  It still reads the datastream and writes to your card.  So the only way to avoid the datastream is to unplug the power cord or disconnect the coax cable from the back of the receiver.  ECM can come in a thousand different ways, no "blockers" can anticipate what future ECMs will come or when they will come, so it is not 100% effective.  Blockers are mostly useful on past ECMs, where it is intended to block known packets that will be harmful to your card, but people who make blockers can never anticipate all future ECMs.

ECMs are usually launched on days when DirecTV feels it will "frustrate" a large number of test card users.  Historically, ECMs are sent right before a popular or expensive PPV event, or on Thursday nights, when the TV audience is at it’s highest.  Other past ECMs were launched before popular family holidays or on just regular weeknights when people least expected them. In other words, it can hit at anytime with no warning. Results of ECM can range from your card simply resetting back to expired status showing only the 3 preview channels, to the more serious looped condition, or commonly referred to as 99.

The H access cards has many "fuse" bytes.  During an ECM,  DTV can send out hash code checks in the datastream to "test" the cards, a legitimate card will respond correctly and continues to run, a card with modified codes might respond differently, and writes to the fuse bytes, or "blows" the fuse, which will put the card’s microprocessor in a tight permanent loop.  A looped card will not respond to any commands from the receiver or a card programmer, usually returning just a series of 99 99 99 99’s or FF FF FF FF’s. This is where the user gets the dreaded "Please Insert a Valid Access Card" message on their TV screens.

Only a handful of people are capable of unlooping H cards right now, and the cost for such service is high, unless the service is included as part of your purchase of your test card.  A regular H access card replacement from DirecTV is about $125, slightly lower if you buy them from a test card dealer ($75 to $120).  Unlooping a card can cost as much as $75, and the success rate is not 100%. If your access card gets looped, it’s going to cost you money. So do everything you can to avoid getting your cards looped!  There is currently no public
information on unlooping H access cards, most of the Net’s information on unlooping cards is for the old F series cards and is not usable on the H cards.
 

THE HACKS

All currently working hacks can be put in 2 categories: Plastic Software and Hardware Wedges

THE PLASTIC SOFTWARE HACKS

A plastic software hack uses software to modify the programming codes on a regular H plastic card, making it operate differently than what DirecTV intended. Software hacks such as the 3M, 4M, Blazer, T3, Activator, CL5005, and others, are changing the bytes in the EEPROM of the H to get video on your receiver.  There are 2 methods of software hacks.  The safest method, used by Activator, Blazer1, CL5005, CBA, Volcano and others add normal tiers to your cards.  A tier is a set of codes that is embedded in the datastream packets sent by DirecTV that authorizes your access card to decrypt the channels. You can also send these packets to your card with a ISO-7816 compatible card programmer via your PC's serial port.  It simulates the method that DirecTV uses to grant authorizations to a legitimately subscribed card.  In theory, this method will result with the least damage to your access card in the event of an ECM.   However, DirecTV can easily send a reset
command or a rehit to all cards via their serial numbers, resetting any cards that’s not in their subscriber’s list back to the 3 preview channels, wiping out any unauthorized tiers.  A normal tier consists of an expiration date, so even if you keep your card out of the receiver to avoid being shut down, it will still expire on it’s own.  Normal tiers will have an expiration date less than 2 months.

If DirecTV really wants to get dirty, they can send out 99 commands also, but it’s difficult (not impossible) to do without affecting some legitimate user. Normal tiers in the hacks will only authorize your cards for the regular channels, the PPV channels requires additional tiers that change often. It is difficult to get PPV tiers on a timely basis, so you are forced to use the PPV purchase on your card to view the PPV channels. A normal access card has a limit of 25 PPV events, once the 25 PPV is used, you are either stuck with a card that can’t buy anymore PPVs, or need to have PPV cleaned, either by a card programmer or by sending it back to dealer. Currently, there is no PPV cleaning software available to the general public that will work on updated cards without changing the 23  update codes

The second method of software hacks, considered to be more aggressive, changes some crucial operation codes on the EEPROM, making the card perform very differently than a subscribed card. Software such as 3M, 4M, Blazer 2, Blazer 3, T3, etc. alters the card to show all channels, including the PPVs, and in doing so, their codes occupies a larger area of the EEPROM.  EEPROM code changes are easier to be detected and exploited for an ECM.  These cards have a higher chance of being put a in loop, or 99, from an ECM.  The term "3M" is derived from the 3 Musketeer movies’ phase "One for all and all for one"  It is reference to an old  videocrypt hack that turns on all channels from a subscription to only one channel.  The term "3M" is now use loosely that describe any hacks that get all channels, including the PPVs without making a user use the "buy"
option on the remote control. Modern DSS 3M hacks do not require the user to subscribe to any channels at all.  The company that makes Scotch tapes and Post-It notes has nothing to do with the 3M hacks, so DO NOT go to 3M's web site asking for test cards!

Out of these 2 methods of software hacks, they are available in 2 different ways. The commercial software
(3M,4M,Activator,Blazers,Predator,T3) are tightly controlled by the original authors, and are not released to the public.  They usually require you to send in your regular access card and dealer will reprogram it with their software, average turn around time is 1 to 3 weeks.   The freeware or shareware (Volcano, CL5000, CL5005, Explorer, Merlin, Pegasus) is available for download on the internet, usually via IRC. You then use these freewares to program your H access card with a ISO-7816 card programmer.  Popular card programmers includes Paul Maxwell King’s MK12 and Haku’s HAKU-3. Average price of a card programmer will cost about $100 USD pre-built, or you can build it yourself if you have the technical expertise and tools with electronic parts for about half the price.  The main thing to remember is that a card programmer is only as useful as the software
that you can get your hands on.  Without the right software, a card programmer can  not add any codes to your access cards. Up to date tiers and programming scripts are not always available on the internet.

Here’s a few things to keep in mind when using the freeware.  Some of this software came from unknown sources, so it’s not fully known what the software will do to your cards, or what kind of long term effect it will have on your card’s stability.  It can leave your card wide open to an ECM attack. It can also be a Trojan horse release by somebody that wants to damage your card.  There is usually no support from the original authors. Some freeware are formal commercial software that’s been released on the internet because the author feels it has lost it’s commercial value or is expected to be shut down soon by an ECM.  Keep in mind that there’s no control of naming a program, so if you hear a freeware with the same name as a commercial product, don’t get too excited.  It is most likely not the same software codes that are being use on the commercial products.  It could just be a disgruntle group of hackers renaming some dangerous codes to undermine the name of a
competing product.

The shareware such as CL5005, Merlin, and Pegasus are a step up from the freeware files.  They are supported by the original authors, if you can find them. They have more regular updates and are slightly easier to use.  Regardless of which software you choose, you can still damage your card if you don’t know what you’re doing. Because freeware and shareware can easily be downloaded by DirecTV and News Datacom, an ECM can be created to target these software at a much quicker time frame than the normal development time for the commercial products.  It was the freeware and shareware’s wide spread use that finally forced DirecTV to start a card swap in the fall of 1996. The card swap was completed by June 1997, and made all hacks for the F series useless overnight.

THE HARDWARE WEDGE HACKS

The Hardware wedge cards surfaced in the fall of 97, about 3 months after the first 3Ms were released. Initially, it resembled the old battery card of the F series, and gave people a false sense of reliability.  Unlike the old battery card, which emulates the entire F series access card via a Dallas microprocessor, the modern wedge card does not fully emulate the processor in the H plastic card.  A modern hardware wedge card is a circuit board that is inserted into the card slot of your receiver, it has a piggyback slot that sticks out of the receiver and requires a H access card to be inserted to form the complete hack.  It operates by capturing packets in the datastream, makes any necessary changes to it, then passes it to your H to decrypt the video. The January 15th ECM have demonstrated that DirecTV can still put your H card in a loop even if it is isolated or protected by a wedge.

The Combo card was the first wedge to be released by the hackers. It’s programming was stored in an EEPROM chip. The DDT came out about a month after it, it was about 25% less in price than the COMBO but was not capable of generating the entire authorization packets by itself, so it required the users to subscribe to DirecTV or USSB with a small programming package. It takes authorized packets from the subscriptions and modifies them to grant access to the non-subscribed channels. The DDT’s code was dumped by one of their competitors and the file got circulated on the internet.  Soon, everybody was making DDT knock-offs, calling them DDT II, DDT III, DDT Next Generation, etc.  The original DDT group disappeared after the Jan 15th ECM due to a lack of knowledge to repair the cards correctly.  Most  customers were abandoned when their DDTs
and knock-offs died after less than 2 months of usage. Some customers got less than 1 week of use on their DDT before it died.

The DATS came out about a month after the DDT.  It had some obvious advantages over the DDT.  It can generate the full authorizations packets without a subscription.  It had a built-in blocker function to filter out any harmful packets that were previously detected.  It was compatible with both subscribed and virgin cards.  It also uses a less expensive Atmel microprocessor instead of the DDT’s Dallas chip. The card’s street price was about half of the DDT.  According to the DATS group, the Atmel chip company betrayed them when the company decided to join in on the hack business, they dumped the DATS’s codes and sold it to other hackers. This allowed many dealers to come out with various knock-off models selling at below the $200 street price, but without full understanding of how the card worked.  Shortly after, tens of thousands of knock-off DATS flooded the market under various names: BOSS, Blue Baron, Blackjack, Bandit, Anonymous card, Wildcard, Red Devil, and many others. The only authorized reproduction of the DATS was the Red Baron, which received
support from the original group.

On January 15th, DTV launched a large ECM that wrote 17 new update codes to the H access card, 1 important one is the 09 command that closed the 09 "hole" that all wedges were using to add tiers to the H.  The Combo and DDT cards stopped working, some DATS survived if it had their blocker running.  Soon, all wedges were only working if it was using a non-updated H card with the blocker running to prevent the updates from closing up the hole on the H.  A conversion chip later came out that converted a DDT into an unauthorized DATS knock-off.

On March 27th, DTV launched another ECM, this time with 5 new update codes, plus the original 17 codes were sent via another command that the wedges were not capable of blocking.  All currently working  wedges use some kind of modified H card where it is programmed with the 23 updates but has the 09 hole reopened to allow the wedge to program the plastic cards. This hack method put the H at risk of being looped.  The genuine DATS are the only ones we know of that don’t use this technique.
 
 

EVALUATING THE DEALERS

So after reading all this and you still decide to get a test card, here are some ways to find a reliable dealer.  Ask around, and then ask some more, and then ask some more again. The main problem we have observed from "victims" of bad hacks/dealers is that the users were too lazy to do the research and dealer comparisons. If you have friends that own test cards, ask them about their dealers, but don’t jump at the first name or phone number they throw at you.  Coming across a name just means you can then start the evaluation process to judge the dealer’s performance. Compare him with other contacts that you will come across.   Other ways to find dealers is via the search engines on the Internet, but dishonest dealers are also listed on the search engines.  We find the best method to find dealers is join the IRC satellite chat channels and ask other live on-line test card users about them, because it’s difficult for a dishonest dealer to hide their reputation when there are 200 critics or former customers online.  Also, don’t believe everything you hear about the dealers, some dealers paid their employees to pretend to be a customer to suggest their services to new unsuspecting victims.  If you come across the exact same comments over and over again, like "he’s the best, very honest", chances are it was pre-scripted. If somebody gives you a recommendation, ask them to back it up. Ask him why he recommended the dealer. Ask him to cite specific cases of how the dealer provided service.  Ask them how he has dealt with the dealer.  If you are just getting vague response, then don’t take that recommendation too seriously. After you have gathered a couple dozen of names and URLS, then you can start the evaluation process.  Don’t be lazy and base your purchasing decision on only 1 or 2 factors.  Any hasty decision will cost you in the long run.  Here are some of the WRONG things people use to base their dealer’s decision on:

 "I picked my dealer because..."

...he was the first one listed on the search engines
...he said he’s been in business for over 10 years
...he said his cards won’t get ECM and he offered me a guarantee
...he was the only one I can find that takes credit cards
...he lives in my town
...he had a "@"sign  in front of his nickname on an IRC channel
...his web site looks really cool with the animated graphics
...everybody said they heard of him
...his purchase price was the lowest
...his purchase price was the highest, so he must offer the best service.
...he has a scams page listing dishonest dealers
...he said there is only 1 fix and it is available only from him
...his cards have real cool names

All these sentences were followed by  "I got screwed by him after an ECM, now it’s going to cost me more money to get my card fixed".  Anybody can make his site come up first on the search engines if he spends enough time and money.  A dishonest dealer can continue to operate for over 10 years if there’s a constant supply of new customers to scam from, just as a Vampire bat can live for 10 years if there’s a new supply of blood every night.  I know, it’s not fair to compare vampires to bad dealers, at least the vampires stop biting after they suck you dry. Every test card CAN and WILL get ECM, a guarantee is worthless if he can’t or won’t honor it. Even if he puts it in writing, you’ll just have a piece of paper to remind you how gullible you were. One dishonest dealer uses small fine prints to state that his guarantee is on his software, not the plastic card.  This guarantee has little value since the software is intangible and it doesn't cost him to re-copy it on your card, but you wind up paying a hundred dollars  for a new plastic card every time after an ECM because his weak software got your card 99.  You wind up taking all the risk and paying for that risk.

Dishonest people take credit cards too, that’s why there is such a thing called credit card fraud on the Internet.  If you think your credit card company will help you with an easy refund from a bad dealer, you're in for a bad surprise.  Some real despicable dealer will post your real name, address, phone and credit card numbers on the internet for everyone to use if you try to reverse your charges.  Some even threaten to report you to the authorities since they have written proof that you purchased an illegal card.  One dishonest dealer even blackmailed his customers by making various charges on his customer’s credit card after the initial purchase, threatening to turn them in to the FBI if they protested the charges to their credit card companies.

So think long and hard before you give out your credit card number, because it might wind up costing even more than sending a blank money order to other dealers. Geographic location is not the best way to judge a dealer’s honesty.  It will be more convenient to return cards for repair after and ECM, but that’s only if your local dealer can get access to the fix quickly, otherwise, you’ll just wait as long as everybody else.  Stop by your local police station or jail to remind yourself that dishonest people live in your town too. Just because a person has a "@" in front of his nickname in the IRC channels doesn’t mean he’s any better or worse than the people without the OPs status. A flashy web site means the dealer is very talented at writing HTML codes or can afford somebody to write them, it doesn’t reflect his services to his customers.

A dealer that is well known doesn’t mean he’s a honest dealer, most people know their neighborhood crack dealer, but not many would send him their hard earned money.  One dealer was very well known and liked by many IRC users, that was because he told the best jokes on the channel. A clown is not what you need when your cards go down after an ECM.  Free jokes won’t get your TV back.  If you do come across people that claim to know him, inquire more information about that dealer, ask probing and detailled questions.  If a dealer has loyal customers because of his good service, they won’t mind spending the time to tell you about him.  If they don’t want to spend that time, then they probably don’t have enough respect for that dealer. Do not equate a dealer’s popularity with his honesty.  Don’t be tempted by a low initial purchase price, it is not the total cost of a test card, make sure you find out how much it will cost you to repair a card after each ECM, count the shipping charges also, because all cards will get hit sooner or later, and they will get hit more than once.

To find out the real cost to fix a card, don’t ask a dealer, because what he tells you in an email and what he actually charges can be very different amounts.  Instead, look at his web page or old news section to see if he posted any prices to fix cards from the last ECM.  If he’s charging $100 plus shipping to fix cards to his existing customers, you can probably expect to pay the same amount when your card goes down in the future.  You can expect to pay this price more than once because there will be more than 1 ECM coming.

A dealer that charges the highest prices doesn’t mean he offers the best service, or he is selling "The Best" cards.  It could just mean he is more greedy than the others and is preying on lazy customers that didn’t do enough comparative shopping.  A dishonorable thief will betray his own mother, so he should have no problems betraying his enemies.  So just because he lists a bunch of competition in his scams page doesn’t mean he’s any better than the people on that page. There are a few legitimate sites out there that do a good job listing real scams, you can easily distinguish them because they are just information sites and do not have anything to sell, so their motives for listing these scams are most likely to warn their readers.

How many times have you heard the old line, "You can’t get this anywhere else, so you must buy it from me today"?  It’s impossible to keep a hack secret in this business, so if 1 dealer has it, it’s certain that somebody else will have it too.  Hackers will hack each other’s work when they are desperate enough.  Sometimes the second hack might be even better, but most of the time, it's worse since they don't have the full understanding of the original product.  Never buy a card based on the name, no matter how "cool" it sounds, there is just no valid reason to make such a decision. Also, don’t be too impressed by a hack that bears a suffix like version 10 or Model III,  it doesn’t mean it’s any better than the previous models, it just means all previous models have failed.  If the hack was that great to begin with, there wouldn’t have been a need for a sequel!   All the points that I just mentioned are to remind you not to base your decision lightly, it does not necessarily mean a dealer is bad if he fits some of the profiles above, he still could be a good dealer, good dealers take credit cards too, and they might have flashy web sites.  You should evaluate a dealer on many factors, like his treatment to his existing customers.

EVALUATING THE HACKS

Here are some things to remember about all hacks that change the access card’s EEPROM codes.  They will all die, it's just a matter of time before DTV gets around to writing an ECM for them.  DTV is capable of killing all plastics, with or without a blocker.  Average run time for any hacks is 3 to 4 months before it goes down with an ECM.  DTV targets cards in the order that they are released. So if you buy the latest hack, chances are it will survive a few ECMs while earlier hacks gets 99ed, until it's your card's turn to get hit.  There is no such thing as a "Best" hack.  The main thing to look for in any hack is the SUPPORT from the dealer or group, all cards will die, but it's the dealer that will help you get it back up after an ECM.  So when you read all the products on the web sites with their claim of superiority, ignore them.  You should be evaluating a dealer’s performance instead.  Look at their past ECM record and see what kind of responses did the dealers offer to their customers after an ECM.  Look at their news section on their web sites and ask around in IRC to find out how long it really took them to return cards back to their customers and were the cards repaired properly?  Find out how much they charge for the repair and consider any shipping charges that you might incur in the event of an ECM.  Now multiply this 3 to 12 times to figure out the total operation cost of your test card after it’s been purchased.  Your REAL cost is the total operation cost plus your initial purchase price, plus your time and energy that you will spend dealing with the ECMs and waiting for instructions from your dealers.

Now compare that to a normal legitimate subscription package for 1 year plus a realistic number of PPVs that you will watch.  Then ask yourself which option is the smarter choice.   The best time to evaluate a dealer is after an ECM, when the truth will come out on how he treats his customers.  Any dealer that ask their customers to "Do not email us for the next 3 weeks, all emails will be trashed"  is not the type that you want to buy from.  While there is a huge logistic problem handling 2000 returned cards from their customers after an ECM,  they should be prepared to answer 2000 emails if they were capable of taking money from 2000 people in the first place!  Even if a customer is asking a question that is already answered on the web page, the dealer should still respond to all emails when their time permits.   I got an email from one small dealer that has a time stamp of 3:45 A.M. because he stayed up that late to reply to his customers emails even after a long day of processing cards.

Another thing you can make your own judgment on is some dealers will tell you that they are understaffed to handle all the phone calls or emails, so don't contact them, and yet on the same web page, they are asking new customers to "Place your order now, our operators are standing by".  This tells you where the dealer's loyalty lies, you're only important to them until they have your money, then it's "No fix yet, stop calling!"   Not all dealers are bad, there are many out there breaking their backs to return cards to their customers as quickly as they can.  Some are driving cards across the border to avoid getting seized by US Customs.  Some dealers are giving freeware substitutes to their customers to ease the long wait of over a month for the commercial cards to get reprogrammed.  You should be understanding to your dealer since sometimes it's out of their control
on the fix process, but you should also be smart enough to take your business elsewhere if your dealer is not making an effort to repair your card.  If all this sounds like it’s too much work or hassle to buy a hack, then you’re getting the point.  Unless you are willing to commit some time and money in researching your purchase, you will probably be more happier just getting a legitimate subscription or stick with your cable service.  If all the hack choices don’t appeal to you or impress you, there is always the option of waiting for a better hack to come out. But don’t hold your breath, because that wait can be long.  There is wisdom in subscribing until a better hack comes along.  If you are outside the US, the gray market dealers can help you get a "paying" subscription using a valid US address for your monthly billing.

ADDITIONAL ADVICE

If you are in the market of buying a DSS test card please be on alert of  scammers who are out there to take your money, not only once but again and again.  There are dealers out there who are giving 1 year "free guarantee" when the time comes to honor it they will charge you dearly by saying this and that.  Some dealers will give you false hope by saying to use a credit card and the credit card company would back you up in case of any screw ups, It is true in some instances but most of the time the scammers will have it delayed over 30 days and you are back to square 1 , Credit card companies will not back you up for any purchase after 30 days and you have to take it to small claims court,  which is not a good idea for lots of people.  There are some dealers who will make you sign a waiver of "no refunds" before they charge on your card and send you product, This should be obvious to you that if there is going to be a problem you will not get your money back anyway.  Please don’t be discourage by all this, There are lots of good dealers out there who will go an extra mile to help their customers, all you have to do is find one of those guys.  Don’t be fooled by fancy web pages, guarantees and BS , do your home work and get lots of information from Chat lines like MIRC and you will do fine.
 
 

Below is a list of common questions and answers that many buyers have asked:

How do I know if my receiver is compatible with a particular hack?

All software hacks are compatible with all brands of receivers.  Some hardware wedges, like the DDT might not be compatible with a few newer 3rd generations receivers from Sony and RCA.  The compatibility problem is usually caused by the software codes, not the actual board design, so as software gets updated, compatibility gets better. You should always ask your dealer to confirm his hack is compatible with your particular model before you place a purchase. Be sure to give him your exact brand and model number at the back of the receiver.  If he doesn't know and tells you to purchase a card to find out, ask him to agree to take card back and give a full refund if it is not compatible. Do not be shy and ask for the agreement in writing.

What other problems can I expect with a hardware hack?

Most hardware hacks will work just as well as the software hacks.  Main thing to keep in mind is because the board extends 4 to 6 inches out of the slot to accommodate the card socket for the plastic access card, make sure you have the space clearance in front of your receiver, especially if it is in an enclosed cabinet. Some wedges have the card socket straight out, while others have the socket at a 90 degree angle, so if you are using a wedge with a side socket, make sure the H card will not get in the way of operational buttons or infra red sensors on your receiver.

I paid over $600 for a battery card during the F series run time, is there any thing I can use this card for?

Ice scraper...sorry, old joke.  As of now, only useful thing people have used the old bats for is to get audio on their receivers. The audio is not encrypted in the satellite signal, some receivers will broadcast the audio without checking for permission from the access card, so you can actually listen to the sounds on all channels, not just the music channels in the 500s.  This feature is dependent on your receiver brand, we have confirmed that Sony, Hughes, and Hitachi models get all audio if used with a bat card that is programmed with an older main08x file.  Sometimes, the engineer channels in the 800s will broadcast PPVs for testing purposes without any encryption, so you can view those broadcast with an old bat card, but this is rare and on non regular times schedules.  We did find 1 dealer that will convert your old bat to a wedge card by adding a card socket and new
software, but the cost was higher than the price of a completely new Wedge that's designed for the H.
 

What about the battery card programmer that plugs into the back of my PC's parallel port, can I use it to program any of these
new wedges?

Most modern wedge hacks are a combination of hardware codes on the board and software on the plastic.  We have not found any dealers that are releasing ECM fixes to their customers for self programming, due to a lack of security on the new codes and a fear of the competition getting hold of it, so for now, card programmers are not being utilized by the wedge dealers. Also, most wedge boards that use a Atmel chip for the main processor is not self programmable.  In the last few ECMs, dealers required their customers to send both the wedge and plastic in to have it reprogrammed.  The only person we found that utilizes the old parallel port programmer is 99King with his card condom blocker.  His new codes are posted at his web site, but the file will only work on his own blocker boards, it will NOT work on any other wedges or bat cards.

I have a plastic card programmer that plugs into the serial port of my PC, this was purchased for the old F series access cards,
are they compatible with the H series cards?

Yes, any card programmer that is ISO-7816 compatible will work with the H series cards, this includes the Haku-2, Haku-3, MK10, MK11, MK12, and many others.

I have a PC emulator board that I used during the old F series, can I upgrade it to work with the H series?

No, because there is no working H emulator board for the PC. The F series emulator is not compatible with the H series because it lacks an ASIC on the board, which is needed to help decrypt the H datastream. If and when an emulator board comes out for the PC, most likely, it will be a new board design and the developers will not waste their effort coming out with an upgrade path for your old board. The cost of manufacturing a new board will be far  less than the cost of labor to convert your old board.  Just like the bat card, you can probably still use the emulator as a digital radio if you have the right brand of receiver.
 
What about all the rumors that I heard about my old bat or emulator can be converted to use as a Dish Network hack?

That's just it, they are RUMORS.  Until you see it with your own eyes, or a dealer or group makes an official announcement in writing, it's just wishful thinking.

Is there anything that I can recycle or reuse from my old F hacks?

If you have a F hardware card that uses a socketed Dallas microprocessor, you can pop it out and reuse it on some new boards.  This situation depends on your dealer.  If you have any left over F series access cards, some dealers will give you about $5 each for them.   They are using the old F cards to upgrade to H series from DirecTV.  You can also do that yourself,  but DirecTV will charge you a lot more than their authorized dealers.  On some F emulator boards, you might be able to use it to log the datastream if it is used with the right software.
 
  ONLINE LINKS CABLE TV If you've read the slightly technical discussion of how cable TV signals are scrambled, you should understand that the simplistic methods of descrambling proposed by other parties can not work properly. However, if you wish to view those methods,
make sure you are connected to the Internet and then CLICK HERE

If you're really interested in building your own descrambler, here's a supplier that can provide you with a parts kit, schematics, etc. Just CLICK HERE

If you want to buy a 'TEST BOX', here's a supplier. The TEST BOX connects into your cable prior to the cable going to your cable company box at your TV. The TEST BOX sends a signal to the cable company box, turning on ALL THE CHANNELS. One TEST BOX will turn on all the cable company boxes in your house. Prices are very reasonable, so you could definitely make some good profit by reselling these devices. CLICK HERE

If you want a complete, ready made combination descrambler/converter, here's a source. This unit also replaces the rental unit from your cable company and they offer quantity discounts, so you can resell. CLICK HERE

More ready made units for cable:

CLICK HERE

or
CLICK HERE

or
CLICK HERE
Offers great deal on TEST BOX that turns on ALL CHANNELS (WholeSale prices) DSS TV

DSS test cards - turn on all channels! CLICK HERE
DSS test cards replace the normal subscription card and enable viewing of all programming. When installed, you don't have to pay any subscription payments at all.

More DSS test cards CLICK HERE

DSS card programmers & software to make your own test cards CLICK HERE

More DSS card programmers - assembled or kit form CLICK HERE