CABLE TV DESCRAMBLERS
FREQUENTLY ASKED QUESTIONS
follow the links at the bottom for more info....
YES! Descramblers are legal. If your cable TV company can possess & rent the box to you then you can own the box yourself. An example in time would be when ATT rented telephones to consumers. The feds directed that it was legal for consumers to own their own phone. Now you wouldn't consider buying only from ATT. The cable TV industry is in its early stages relative to this development. It is legal for you to purchase and it is legal for you to own. When you buy a cable box it is your responsibility to inform the cable TV company that you are accessing their signal. It is illegal to receive their transmission without paying for it. This holds true even if your cable box is purchased as a non-addressable, non-detectable, and "bullet proof" unit.
No. Prices can range from $15 to $400 depending on the quality and amount of features included in the equipment. Some companies offer to sell you a description of how you can build(implied), with only 7 parts from Radio Shack, a descrambler. Some sell old converters and descramblers that are barely in date and likely to be replaced by the cable companies by higher technological grades of equipment. Some cable box sellers provide systems that hardly provide any benefit to the purchaser where the quality of reception is poor, without recourse. State of the art cable box companies will provide the most recent technology in a variety of packages tailored to fit the consumer's budget. They should provide two-piece systems, all-in-one combination systems, comprehensive universal fits all model line systems, refurbished RAN Baseband boxes in conjunction with the latest tech versions. Of course, you get what you pay for. But there are some reasonable values out there.
You have two choice when purchasing your cable equipment, a single unit(one-piece) system or a system containing two units(two-piece).
The one-piece system is based on a combination of a converter and a descrambler, installed in a single box. This unit is referred to as a combination unit. The pluses:
1) Easy to hook up
The two-piece system is based on two separate units, a converter and a desrambler, that are connected together and function as one-piece system. The pluses:
1) Lower cost
An electronic tuning device that transposes all available channels from the cable company into either channel 3 or channel 4. A converter is simply a "channel changer" that cannot by itself descramble encoded premium channels. It allows you to receive all basic channels if your TV is not the cable ready type. When you add a descrambler to your converter, it allows you to view all premium channels.
A Descrambler is a device that restores the picture and sound of a scrambled channel. A Descrambler must be used with a Converter (in a two-piece configuration) to be able to descramble all the premium channels of a cable system.
A single (one-piece) unit capable of descrambling premium cable channels. This unit contains a converter and a descrambler, enclosed in a common box.
This is also the most common type of equipment supplied by
the cable company to subscribing customers. Customers usually pay a specified monthly
rental fee for such equipment.
This is a Converter/Descrambler that can be controlled by the cable company from their office location. Through remote coded messages sent via the cable system, the cable company can "address" the customer's unit to begin descrambling selected premium or pay-per view channels. An addressable unit allows the cable company to access your cable box to change the descrambling configuration or program. This function provides the cable company the ability to add or delete descrambling on the channels that come in through your cable line. A non-addressable unit does not provide the cable company access to the cable box program. The program remains stationary and is unchangable. Both cable box designs have the potential of receiving all channels, none or somewhere inbetween dependent on the box program.
Basic Cable Service:
The least expensive cable service provided by cable companies to their customers. This service usually includes Local TV channels which can be received directly from the broadcast signal of the TV stations.Premium Cable Service: Additional programming service provided by the cable company to subscribing customers. The extra fee for such additional service may be based on a per channel, per group of channels, or on any other combination of channels.
Pay Per View: Selected
channels that offer movies and special events such as sports or adult entertainment, for
an additional fee, on a per movie or per program basis. A special "addressable"
converter is furnished by the cable company to subscribers of this service. Through the
use of special equipment, the cable company can "address" the customer's
converter to descramble the program for which the fee was paid.
No. Descramblers are specific to each cable system. Different cable companies use different cable systems, characterized by the manufacturer's brand name and model number. You must use a compatable descrambler that works in your area but may not work in a different area.
Call your Converter/Descrambler box source. Let them know that there are problems. Most companies want to correct any problems you are having. If you are working with a customer oriented company, they will work dilligently to remedy your problem. Don't just let it go. They will want a satisfied customer who will refer them additional business. The company may not have a quick answer for about 5% of the problems out there. Be patient and work with your cable box company until you find the right converter/descrambler box for your area. Sometimes technology changes for your area and the source may need to do some additional research to get the desired image. Do this before the warranty/guarantee has run out. Even then there may be a solution.
Amplification may be needed to correct the problem. Whenever a cable signal is split between two or more TVs or routed to some other video components such as VCRs, the signal weakens and produces a poor quality picture. The weak signal may cause a "snowy" or gray picture, or may even result in weak color or lack of color.
Since most cable viewers use several different video
components, it is recommended that an amplifier be used to restore the signal strength and
the picture sharpness. In most cases, the amplifier brings the picture "back to
life" and restores its original quality. Consider using a 10db Amplifier to improve
signal strength.
Most Descrambler sources will carry the common brands such as Jerrold(GI), Pioneer, Scientific Atlanta, Oak, Tocom and Zenith. When your company doesn't carry your brand then you need to find out if they either have in stock or have a source for your uncommon make and model. Usually the source has another outlet or may need to do research on your request.
Bullets are nothing more than transmitted signal which effects the cable box program. It does not fry the guts of the equipment but rather may shut the box off temporarily, reprogram the box, or shut the box down in an error mode til service can rectify the problem. A non-addressable box with the appropriate filters will manage this process effectively. This is what is meant by a "bullet-proof" cable box.
1) Get the brand name & the model number of the converter/descrambler unit that was supplied to you by your cable company. The brand name is located on the front of the box. The model # is located on the bottom of the box on a tag.
Baseband signal is where audio and video scrambling is used in conjunction with coaxial (fiber optic)cable. The cable company de-synchronizes the pulse system thus moving the video/audio signal to a neutral channel(usually FM). The picture rolls and displays a wiggly white line running down the left, right or both sides of the screen. This outband type usually places the missing sinc on channels 42, 49, 50, 52 or 53. The Descrambler unit restores the pulse sinchronization making it possible for vertical and horizontal video and audio signal to stabilize.
First , of course, trust your own judgment. A company you can trust will be one that has at least a 30 day Guaranty and a 90 day warranty on their products. Offers a variety of equipment for most areas of the country and some areas of the world. A prepared company will have its staff equipped with a zip code manual which provides a list of equipment per zip code. The company will have the capability of delivering your equipment 2 day air, 4 day ground, International, or other if agreed upon. Staff are capable of answering most technical questions. An 800 number for easy calling access for the customer.
SCRAMBLING TECHNOLOGIES
The ownership of a signal descrambler does NOT give the owner the right to decode or view any scrambled signals without authorization from the proper company or individual. Use of such a device without permission will subject the to violation of state and/or federal laws. The information contained herein is intended to serve as a technical aid to those person seeking information on various scrambling techniques.
No Scrambling (Traps/Addressable Traps)
A cable system may not be scrambled at all. Some older
systems (and many apartment complexes) use "traps" or "filters" which
actually REMOVE the signals you aren't paying for from your cable. (These are negative
traps because they remove a signal.) These systems are relatively secure because the traps
are often located in locked boxes, and once a service technician finds out they're missing
or have been tampered with (by pushing a pin through a coax trap to change its frequency,
for example), it's a pretty solid piece of evidence for prosecution.Another method is
where the head-end ADDS an extraneous signal about 2.5 MHz above the normal visual carrier
which causes a tuner to think its receiving a very strong signal--the tuner then adjust
the automatic gain control and buries the real signal. If you pay for the service, the
cable company adds a "positive trap" which then REMOVES the extraneous signal so
it becomes viewable. (This system is very easy to circumvent by building your own notch
filter, so it is not very commonly used.) Advantages to a cable system with this
technology is that you don't need a cable box--all your cable-ready TVs, VCRs, etc. The
disadvantage is that pay-per-view events are not possible, and that every time someone
requests a change in service, a technician has to be dispatched to add/remove the traps.
Becoming more popular, not only because of the Cable Act of 1992 but also in an effort to stop "pirates" are addressable taps. Many cable companies may move to this technology in the near future. These are devices located at the pole, where your individual cable feed is tapped from the head-end. Similar to addressable converters, they each have a unique ID number and can be turned on/off by a computer at the head-end. Any stations which you are not paying for are filtered out by electronically switchable traps in the units. (Including the whole signal if you haven't paid your bill or had the service disconnected.) {several patents have already been issued for various methods of making sure you don't see a channel you don't pay for.} Again, these almost GUARANTEE an end to piracy and don't have any of the disadvantages of the manual traps. Plus, they provide a superior signal to those customers paying for service because they no longer need complicated cable boxes or A/B switches -- and they can finally use all of the "cable-ready" capabilities of the VCR, TV, etc. About the only known attack on this type of system is to splice into a neighbors cable, which again provides plenty of physical evidence for prosecution. The negative side of this technology is that it is VERY expensive to implement and very unreliable from weather elements.
SINE WAVE SCRAMBLING
Early Oak (and some very early Pioneer boxes) employed a
sine-wave sync suppression system. In this system, the picture would remain vertically
stable, but wiggling black bars with white on either side would run down the center of the
screen. The lines were caused by a 15,750 Hz sine-wave being injected with the original
signal, causing the sync separator in the TV to be unable to detect and separate the sync
pulses. Later, Oak came out with a "Vari-Sync" model, which also removed a
31,500 Hz sine-wave added to the signal. Oak was one of the first to use extra signals
("tags") as a counter-measure for pirate boxes -- in the normal mode, a short
burst of a 100 KHz sine-wave (the tag signal) would be sent during the VBI, along with the
AM sine-wave reference on the audio carrier and scrambled video. They would then put the
AM sine-wave reference signal onto the audio carrier, leave the video alone, and NOT send
the tag. Any box which simply looked for the AM sine-wave reference would effectively
scramble the video by adding a sine-wave to the unscrambled video! Real decoders looked
for the tag signal and still worked correctly. Other combinations of tag/no tag,
scrambled/unscrambled video were also possible.
GATED SYNC SUPRESSION
Early Jerrold boxes used in-band gated sync suppression. The
horizontal blanking interval was suppressed by 6 dB. A 15.734, 31.468 or 94.404 KHz
reference signal (conveniently all even multiples of the horizontal sync frequency) was
modulated on the sound carrier of the signal, and used to reconstruct the sync pulse. An
article in February 1984 issue of Radio-Electronics explains this somewhat-old technique.
Converters which have been known to use this system include the Scientific-Atlanta
8500-321/421, a number of Jerrold systems, Jerrold SB-#, SB-#-200, SB-#A, RCA KSR53DA,
Sylvania 4040 and Magnavox Magna 6400.
TRI MODE SCRAMBLING
A modification to the 6dB sync suppression system, dubbed
"tri-mode", allows for 0, 6 and 10 dB suppression of the horizontal sync pulse.
The three sync levels can be varied at random (as fast as once per field), and the data
necessary to decode the signal is contained in unused lines during the VBI (along with
other information in the cable data stream.) See the February 1987 issue of
Radio-Electronics for a good article (both theory and schematics) on the tri-mode system.
Converters which have been known to use this system include a number of Jerrold systems,
Jerrold SBD-#A, SBD-#DIC, Jerrold Starcom VI (DP5/DPV models), Regency, Scientific-
Atlanta 8550-321 and early Pioneer systems.
OUT BAND GATED SYNC
Out-band gated sync systems also exist, such as in early
Hamlin converters. In this system, the reference signal is located on an unused channel,
usually towards the higher end (channels in the 40's and 50's are common, but never in the
low 30's due to potential false signalling.) The signal is comprised of only sync pulse
information without any video. Tuning in such a channel will show nothing but a white
screen and will usually have no audio.
SSAVI SCRAMBLING
Syncronization Suppression and Active Video Inversion is most
commonly found on Zenith converters. ZTAC is an acronym for Zenith Tiered Addressable
Converter. Besides suppressing sync pulses in gated-sync fashion, video inversion is used
to yield four scrambling modes (suppressed sync, normal video; suppressed sync, inverted
video; normal sync, inverted video; and normal sync, normal video). The mode of scrambling
can be changed as fast as once per field. Their is no "reference signal" per-se,
but the horizontal sync pulses during the VBI are not suppressed, allowing a phased-lock
loop to be used to generate the missing sync pulses. Information on whether the video is
inverted or not is contained in the latter-half of one of the lines of video, usually line
20 or 21. The Drawing Board column of Radio-Electronics starting in August '92 and going
through early '93 described the system and provided several circuits for use on an SSAVI
system. Audio in the system can be "scrambled" - usually by burying it on a
subcarrier that's related mathematically to the IF component of the signal. Addressable
data for Zentih systems is sent in the VBI, lines 10-13, with 26 bits of data per line.
TOCOM SYSTEMS
The Tocom system is similar to the Zenith system since it
provides three levels of addressable baseband scrambling: partial video inversion, random
dynamic sync suppression and random dynamic video inversion. Data necessary to recover the
signal is encrypted and sent during lines 17 and 18 of the VBI (along with head-end
supplied teletext data for on-screen display). The control signal contains 92 bits, and is
a 53 ms burst sent just after the color burst. Up to 32 tiers of scrambling can be
controlled from the head-end. Audio is not scrambled.
PIONEER SYSTEMS
The newer 6000-series converters from Pioneer supposedly
offer one of the most secure CATV scrambling technologies from a "major" CATV
equipment supplier. From the very limited information available on the system, it appears
that false keys, pseudo-keys and both in-band and out-band signals are used in various
combinations for a secure system. From U.S. patent abstract #5,113,441 which was issued to
Pioneer in May '92 (and may or may not be used in the 6000-series converters, but could
be), "An audio signal is used on which a key signal containing compression
information and informaton concerning the position of a vertical blanking interval is
superimposed on a portion of the audio signal corresponding to a horizontal blanking
interval. In addition, a pseudo-key signal is superimposed...so that the vertical blanking
information on the 6000-series scrambling technique, please send mail!} Note that Pioneer
boxes are "booby-trapped" and opening the unit will release a spring-mechanism
which positively indicates access was gained to the interior (and sends a signal to the
head-end on a two-way system, and may disable the box completely.) {See U.S. patent
#4,149,158 for details.} The mechanism cannot be reset without a special device. Pioneer
systems transmit their addressing data on 110.0 MHz.
SCIENTIFIC ATLANTA SYSTEMS
Some of the early S-A boxes used 6 dB only sync suppression
(some of the 8500 models), and some of the 8550 boxes are tri-mode systems. The three
digit number after the model (such as 321) is a code which indicates the make of the
descrambler in the unit. Apparently some of the newer S-A boxes use a technique called
"dropfield". Scientific-Atlanta systems transmit their addressing data on
106.2 or 108.2 MHz.
OAK SIGMA
This a secure system which replaces the horizontal sync of
each line of video with a three-byte digital word. Video is switched from inverted to
non-inverted between scene changes, and the colorburst frequency is shifted
"up". This is a standard "suppressed" sync video scrambling method and
is relatively simple to defeat with the appropriate circuitry. HOWEVER, the three-byte
digital word in the area where the sync normally is contains audio and sync information.
The first two bytes contain a digitized versions of the audio, the third byte contains
sync information (and perhaps addressing data?) The two bytes of digitized audio are
encrypted; a separate carrier signal contains the decryption keys for the digital audio
datastream.
CHAMELEON
The research and development division of Fundy Cable Ltd.,
NCA Microelectronics, has a systemd dubbed "Chameleon". They claim it is a
cost-effective solution that prevents pay TV theft by digitally encrypting the video
timing information of sync suppression systems. The company claims the technology has been
proven to be effective against pirate and tampered boxes. Supposedly, existing decoders
can be upgraded to Chameleon technology with a low-cost add-in circuit, and that the
card's sealed custom IC, developed by NCA, is copy-proof.
VIDEOCIPHER
The VideoCipher system is now owned by General Instrument and
is used primarily for satellite signals at this time. VideoCipher I is the
"commercial" version which uses DES (Data Encryption Standard)-encrypted audio
AND video. A VCI descrambler is not available for "home" owners. VideoCipher II
is the now-obsolete system which used a relatively simple video encryption method with
DES-encrypted audio. (Specifically, the audio is 15 bit PCM, sampled at ~44.1 KHz. It is
mu-law companded to 10 bits before transmission.) This has recently been replaced by the
VideoCipher II+, which will be replaced by VideoCipher IIRS (a smart-card based system).
Supposedly, coded data relating to the digitized, encrypted audio is sent in the area
normally occupied by the horizontal sync pulse in the VCII system. (The Oak Sigma CATV
system uses a similar technology.) Several methods existed for pirating the VCII based
system, and some supposedly exist for the new VCII+ format.
DIGICABLE/DIGICIPHER
DigiCipher is an "upcoming" technology being
developed by General Instrument for use in both NTSC and HDTV environments. The DigiCipher
format is for use on satellites, and the DigiCable variation will address CATV needs. It
provides compression algorithms with forward error correction modulation techniques to
allow up to 10 "entertainment quality" NTSC channels in the space normally
occupied by one channel. It provides true video encryption (as opposed to the VCII-series
which only DES encrypts the audio). In a Multiple Channel Per Carrier (MCPC) application,
the data rate is ~27 MB/second via offset QPSK modulation. Audio is CD-quality through
Dolby AC-2 technology, allowing up to four audio channels per video channel. The system
uses renewable security cards (like the VCIIRS), has 256 bits of "tier"
information, copy protection capability to prevent events from being recorded, commercial
insertion capability for CATV companies, and more. The multichannel NTSC satellite version
of DigiCipher started testing in July of 1992, and went into production several months
later.
B-MAC
MAC is an acronym for Mixed Analog Components. It refers to
placing TV Horizontal-blanking interval, and then separating the color and luminance
portions of the picture signal for periods of 20 to 40 microseconds each. In the process,
luminance and chrominance are compressed during transmission and expanded during
reception, enlarging their bandwidths considerably. Transmitted as FM, this system, when
used in satellite transmission, provides considerably better TV definition and resoluton.
Its present parameters are within the existing NTSC format, but is mostly used in Europe
at this time.
.
Market Codes
Note that almost every addressable decoder in use today has a
"unique "serial number" programmed into the unit either in a PROM,
non-volatile RAM, EAROM, etc. This allows the head-end to send commands specifically to a
certain unit (to authorize a pay-per-view events, for example.) Part of this "serial
number" is what is commonly called a "market code", which can be used to
uniquely identify a certain cable company. This prevents an addressable decoder destined
for use in Chicago from being used in Houston. In most cases, when a box receives a signal
with a different market code, it will enter an "error mode" and become unusable.
This is just a friendly little note to anyone who might consider purchasing a unit from
the back of a magazine if the unit has not been "modified" in any way to prevent
such behavior, you could end up with an expensive paper weight... (see next section)
Test Chips
So-called "test chips" are used to place
single-piece converters (that is, units with both a tuner and a descrambler) into full
service. There are a number of ways to accomplish this, but in most cases, the serial
number/market code for the unit is set to a known "universal" case (RARE THESE
DAYS) or, better yet, the comparison checks to determine which channels to enable/disable
are bypassed by replacing an IC in the unit.Hence, the "descrambler" will always
be active, no matter what. This latter type of chip is superior because it cannot be
disabled and is said to be "bullet proof", even if the cable company finds out
about a "universal" serial number. (When the cable company finds out about a
universal serial number, it is easy for them to disable the converter with a variation on
the "bullet" described below.)
Cubes
A relatively new "test device" has been advertised
in magazines such as Electronics Now (formerly Radio-Electronics) and Nuts & Volts.
It's called a "cube" and it SIMULATES the addressing data signal for a cable
box. You plug the cable into one side, where it filters out the real data signal, and out
the other side comes a normal signal, with a new data stream. This new data signal tells
whatever boxes are connected after it to go into "full-service" mode (including
any cable company-provided boxes). It is usually a non-destructive signal, and if the the
"cube" is removed from the line, the real data signal gets sent to the converter
which then goes back to normal operating mode. I say "usually non-destructive"
because there are some cubes that re-program the electronic serial number in a box to a
new value. (This has the advantage that it will work with ANY converter the unit was
designed for.) The "non-destructive" versions of the "cube" usually
require that you provide the serial number from the bottom of the converter you're
interested in "testing". That way a custom IC can be programmed to address that
converter with the necessary codes. (Otherwise the converter would ignore the information
since the serial number the cube was sending and the one in converter wouldn't match.)
Bullets
First and foremost, THE "BULLET" IS NOTHING MORE
THAN THE NORMAL CABLE DATA STREAM WITH THE APPROPRIATE "CODE" TO DISABLE A
CONVERTER WHICH HAS NOT BEEN ACKNOWLEDGED BY THE CABLE COMPANY.For instance, the head end
could send a code to all converters which says "unless you've been told otherwise in
the last 12 hours, shut down." All legitimate boxes were individually sent a code to
ignore this shut down code, but the pirate decoders didn't get such a code because the
cable company doesn't have their serial number. So they shut down when the see the
"bullet" code. The "bullet" is NOT a harmful high-voltage signal or
something as the cable companies would like you to believe if it was, it would damage
anyone with a cable-ready TV or VCR connected to the cable (not something the cable
company wants to deal with!) The only way to get "caught" by such a signal is to
contact the cable company and tell them your illegal descrambler just quit working for
some reason) Not a smart thing to do, but you'd be surprised (especially if it's someone
else in the house who calls, like a spouse, child, babysitter, etc.) While we're on the
subject, it's also not a good idea to have cable service personnel come into your
residence and find an unauthorized decoder. If you have one, use common sense and tell
anyone you live with to call YOU and NOT the cable company if something goes wrong. Just
some friendly advice...
Time Domain Reflectometry / Leak Detection
The cable company can use a technique called "Time
Domain Reflectometry" (TDR) to try and determine how many devices are connected to
your cable. In simple terms, a tiny, short test signal is sent into your residence and the
time domain reflectometer determines the number of connections by the various
"echoes" returned down the cable (since each device is at a different point
along the cable, they can be counted.) Each splitter, filter, etc. will affect this count.
A simple way to avoid being "probed" is to install an amplifier just inside your
premises before any connections. This isolates the other side of the cable from the
outside, and a TDR will only show one connection (the amplifier). The cable company also
has various ways of detecting signal "leaks" in their cable. The FCC REQUIRES
them to allow only so much signal to be radiated from their cables. You may see a
suspicious looking van driving around your neighborhood with odd-looking antennas on the
roof. These are connected inside to field strength meters which help locate where the
leaks are coming from so they can be fixed (to prevent a fine from the FCC!) If you've
tampered with a connection at the pole (say, to hook up a cable that had been
disconnected) and didn't do a good job, chances are the connection will "leak"
and be easily found by such a device. This can also happen INSIDE your residence if you
use cheap splitters/amplifiers or have poorly-shielded connections. The cable company will
ask to come inside, and bring with them a portable field strength meter to help them
locate the problem. Often they will totally remove anything causing the leak, and may go
further (e.g., legal action) if they feel you're in violation of your leak level.
DSS DESCRAMBLING
THE DSS BROADCASTING SYSTEM
DirecTV’s digital broadcast systems consist of 3
satellites orbiting above the earth’s equator at 101 degrees West. Their 3
satellites transmit in high powered Ku-Band: DBS-1 has a total of 16
transponders. DBS-2 and DBS-3 have 8 transponders each. With these 32
transponders, DirecTV, USSB, and a few private networks broadcast their signals over most
of the North American continent. Any owner of a satellite system with the DSS logo
is capable of receiving and viewing their broadcast if they subscribe to DirecTV or
USSB’s programming services. In the mainland United States, most systems can pick up
their signal clearly with the standard 18 inch dish. If you are further away, like
in Canada, you can pick up the signal at a lower strength, or can substitute the 18 inch
dish with a larger dish to boost the signal strength. The 3 Satellites creates a large
one-way communication network with the 4 millions DSS systems
in North America. Only owners of the DTV/USSB DSS systems can receive the signals from the
satellites, a typical home system is not capable of transmitting information back up to
the satellites. In order for DirecTV to track your Pay Per View (PPV) usage, you must hook
up a phone line to the back of your receiver, this is the only way you can send
information about your receiver or access card to DirecTV. DirecTV’s uplink
station is located in Castle Rock, Colorado. This is where they gather broadcasts
from all the program providers like HBO, CNN, etc. and process their video before sending
them up to the 3 satellites. DirecTV owns the 3 satellites, and leases 5
transponders to USSB. DirecTV Inc. is a unit of Hughes Electronics Corp., Hughes
Electronics Corp. is owned by General Motor. News Datacom Ltd., owned by Rupert
Murdock, is the company that is contracted by DirecTV to maintain the
security of their satellite signal. News Datacom
designs and owns the access card that is in your receiver. They are also responsible
for creating ECMs (Electronic Counter Measures) to shut down any unauthorized devices that
access their satellite signal.
The 3 satellites communicate with your receiver and access
card via the datastream. The datastream is a constant stream of digital data packets
that is sent down from the satellites, somewhat similar to the Internet data communication
method where each packet has an assigned address to the intended recipient, so DirecTV can
address your card or receiver individually, but can also send out commands with global or
group addresses to reprogram multiple cards at the same time. The serial number from your
card plus the serial number from your receiver forms a unique ID. Under normal
operation , your receiver will filter out any packets that do not have your unique ID, and
will only pass commands to your card if the packets have the right
address.
THE ACCESS CARDS
The plastic access card in your DSS receiver is commonly
refer to as a H series card, or P2. It’s serial number should be at 0000 4000
0000 or higher, the range of serial numbers have been reported to be over 0012 0000
0000. Older series such as the E, F and G cards or the P1’s have been phased
out by DirecTV and are no longer fully functional on DSS systems. Those cards will
have a serial number of 0000 3999 9999 or lower. The latest H cards have the letter
"c" printed on them, it means that a minimum of 18 update codes are
preprogrammed on them. Cards that were already in use received the 18 update codes
via DirecTV’s satellite transmission. Five new additional updates codes are
being sent to regular subscribed cards, so a total of
23 updates should have been written to your H card if it is
used under a normal subscription. The term "virgin" is used to describe a
new plastic access card that has not been inserted into the receiver yet. When a card is
inserted into the receiver, it "marries" that particular receiver by storing the
receiver’s unique ID number on the H’s EEPROM. Once a card is married to a
receiver, it will not function normally when inserted into a receiver with a different ID
number. Cards can be wiped clean or reset back to virgin with the right
software. An "expired" card is a card that once had an active
subscription but has been canceled. An expired card will show only the 3 preview
channels (100, 267, 999)
The H access card consists of a Seimens 8501
microprocessor, several forms of memory: ROM, RAM, and EEPROM, an ASIC, and a few minor
electronic components. The ASIC or Application Specific Integrated Circuit is a
co-processor that helps the main CPU process the decryption algorithm at a much faster
rate than the older F series card, thus making all older F cards/hacks/emulators useless
for the video decryption of the satellite signal. The ASIC is the main reason why there is
no full hardware emulator out there for the H right now. It is very difficult and
expensive to manufacture a replacement ASIC at small quantities, and to utilize or
"enslave" the existing ASIC in a H card puts the card at a risk of getting
damaged by an ECM. The
EEPROM (Electronic Erasable Programmable Read Only Memory)
stores the most important information about your card and the decryption algorithms, it is
also the only part of the card that can be changed, other than the temporary RAM area. The
ROM (Read Only Memory) stores your card's serial number, which is not
changeable. This is why there are no true clones for the H access card. The
DSS access card communicates with your receiver via protocols that comply to the ISO 7816
standards for smartcard communications.
Electronic Counter Measures or ECMs can be defined as any changes in the datastream in an attempt to disable unauthorized devices from decrypting the satellite transmission. This can be in the form of changing the speed or the format of the packets, withhold crucial packets that the hacks need to function, adding new commands or software in the packets to change the operations of the H access cards, or other creative methods that we have not seen yet.
You cannot avoid the ECMs, most ECMs are permanent changes on the datastream. If you pull your card out of the receiver, it will delay your card form getting hit, but as soon as your put your card back in the receiver, it will be affected. The only benefit for pulling your card out is to avoid permanent damages to card until you contact your dealer for further instructions or update your card with new software to make it compatible with the ECM before it is exposed to the datastream. But repeated pulling and re-inserting your card in your receiver increases the chances of it being damaged by wear and tear.
Your receiver continues to receive the datastream even when the power button is off. It still reads the datastream and writes to your card. So the only way to avoid the datastream is to unplug the power cord or disconnect the coax cable from the back of the receiver. ECM can come in a thousand different ways, no "blockers" can anticipate what future ECMs will come or when they will come, so it is not 100% effective. Blockers are mostly useful on past ECMs, where it is intended to block known packets that will be harmful to your card, but people who make blockers can never anticipate all future ECMs.
ECMs are usually launched on days when DirecTV feels it will "frustrate" a large number of test card users. Historically, ECMs are sent right before a popular or expensive PPV event, or on Thursday nights, when the TV audience is at it’s highest. Other past ECMs were launched before popular family holidays or on just regular weeknights when people least expected them. In other words, it can hit at anytime with no warning. Results of ECM can range from your card simply resetting back to expired status showing only the 3 preview channels, to the more serious looped condition, or commonly referred to as 99.
The H access cards has many "fuse" bytes. During an ECM, DTV can send out hash code checks in the datastream to "test" the cards, a legitimate card will respond correctly and continues to run, a card with modified codes might respond differently, and writes to the fuse bytes, or "blows" the fuse, which will put the card’s microprocessor in a tight permanent loop. A looped card will not respond to any commands from the receiver or a card programmer, usually returning just a series of 99 99 99 99’s or FF FF FF FF’s. This is where the user gets the dreaded "Please Insert a Valid Access Card" message on their TV screens.
Only a handful of people are capable of unlooping H cards
right now, and the cost for such service is high, unless the service is included as part
of your purchase of your test card. A regular H access card replacement from DirecTV
is about $125, slightly lower if you buy them from a test card dealer ($75 to $120).
Unlooping a card can cost as much as $75, and the success rate is not 100%. If your access
card gets looped, it’s going to cost you money. So do everything you can to avoid
getting your cards looped! There is currently no public
information on unlooping H access cards, most of the
Net’s information on unlooping cards is for the old F series cards and is not usable
on the H cards.
THE HACKS
All currently working hacks can be put in 2 categories: Plastic Software and Hardware Wedges
THE PLASTIC SOFTWARE HACKS
A plastic software hack uses software to modify the
programming codes on a regular H plastic card, making it operate differently than what
DirecTV intended. Software hacks such as the 3M, 4M, Blazer, T3, Activator, CL5005, and
others, are changing the bytes in the EEPROM of the H to get video on your receiver.
There are 2 methods of software hacks. The safest method, used by Activator,
Blazer1, CL5005, CBA, Volcano and others add normal tiers to your cards. A tier is a
set of codes that is embedded in the datastream packets sent by DirecTV that authorizes
your access card to decrypt the channels. You can also send these packets to your card
with a ISO-7816 compatible card programmer via your PC's
serial port. It simulates the method that DirecTV uses to grant authorizations to a
legitimately subscribed card. In theory, this method will result with the least
damage to your access card in the event of an ECM. However, DirecTV can easily
send a reset
command or a rehit to all cards via their serial numbers,
resetting any cards that’s not in their subscriber’s list back to the 3 preview
channels, wiping out any unauthorized tiers. A normal tier consists of an expiration
date, so even if you keep your card out of the receiver to avoid being shut down, it will
still expire on it’s own. Normal tiers will have an expiration date less than 2
months.
If DirecTV really wants to get dirty, they can send out 99 commands also, but it’s difficult (not impossible) to do without affecting some legitimate user. Normal tiers in the hacks will only authorize your cards for the regular channels, the PPV channels requires additional tiers that change often. It is difficult to get PPV tiers on a timely basis, so you are forced to use the PPV purchase on your card to view the PPV channels. A normal access card has a limit of 25 PPV events, once the 25 PPV is used, you are either stuck with a card that can’t buy anymore PPVs, or need to have PPV cleaned, either by a card programmer or by sending it back to dealer. Currently, there is no PPV cleaning software available to the general public that will work on updated cards without changing the 23 update codes
The second method of software hacks, considered to be more
aggressive, changes some crucial operation codes on the EEPROM, making the card perform
very differently than a subscribed card. Software such as 3M, 4M, Blazer 2, Blazer 3, T3,
etc. alters the card to show all channels, including the PPVs, and in doing so, their
codes occupies a larger area of the EEPROM. EEPROM code changes are easier to be
detected and exploited for an ECM. These cards have a higher chance of being put a
in loop, or 99, from an ECM. The term "3M" is derived from the 3 Musketeer
movies’ phase "One for all and all for one" It is reference to an
old videocrypt hack that turns on all channels from a subscription to only one
channel. The term "3M" is now use loosely that describe any hacks that get
all channels, including the PPVs without making a user use the "buy"
option on the remote control. Modern DSS 3M hacks do not
require the user to subscribe to any channels at all. The company that makes Scotch
tapes and Post-It notes has nothing to do with the 3M hacks, so DO NOT go to 3M's web site
asking for test cards!
Out of these 2 methods of software hacks, they are
available in 2 different ways. The commercial software
(3M,4M,Activator,Blazers,Predator,T3) are tightly controlled
by the original authors, and are not released to the public. They usually require
you to send in your regular access card and dealer will reprogram it with their software,
average turn around time is 1 to 3 weeks. The freeware or shareware (Volcano,
CL5000, CL5005, Explorer, Merlin, Pegasus) is available for download on the internet,
usually via IRC. You then use these freewares to program your H access card with a
ISO-7816 card programmer. Popular card programmers includes Paul Maxwell King’s
MK12 and Haku’s HAKU-3. Average price of a card programmer will cost about $100 USD
pre-built, or you can build it yourself if you have the technical expertise and tools with
electronic parts for about half the price. The main thing to remember is that a card
programmer is only as useful as the software
that you can get your hands on. Without the right
software, a card programmer can not add any codes to your access cards. Up to date
tiers and programming scripts are not always available on the internet.
Here’s a few things to keep in mind when using the
freeware. Some of this software came from unknown sources, so it’s not fully
known what the software will do to your cards, or what kind of long term effect it will
have on your card’s stability. It can leave your card wide open to an ECM
attack. It can also be a Trojan horse release by somebody that wants to damage your
card. There is usually no support from the original authors. Some freeware are
formal commercial software that’s been released on the internet because the author
feels it has lost it’s commercial value or is expected to be shut down soon by an
ECM. Keep in mind that there’s no control of naming a program, so if you hear a
freeware with the same name as a commercial product, don’t get too excited. It
is most likely not the same software codes that are being use on the commercial
products. It could just be a disgruntle group of hackers renaming some dangerous
codes to undermine the name of a
competing product.
The shareware such as CL5005, Merlin, and Pegasus are a step up from the freeware files. They are supported by the original authors, if you can find them. They have more regular updates and are slightly easier to use. Regardless of which software you choose, you can still damage your card if you don’t know what you’re doing. Because freeware and shareware can easily be downloaded by DirecTV and News Datacom, an ECM can be created to target these software at a much quicker time frame than the normal development time for the commercial products. It was the freeware and shareware’s wide spread use that finally forced DirecTV to start a card swap in the fall of 1996. The card swap was completed by June 1997, and made all hacks for the F series useless overnight.
THE HARDWARE WEDGE HACKS
The Hardware wedge cards surfaced in the fall of 97, about 3 months after the first 3Ms were released. Initially, it resembled the old battery card of the F series, and gave people a false sense of reliability. Unlike the old battery card, which emulates the entire F series access card via a Dallas microprocessor, the modern wedge card does not fully emulate the processor in the H plastic card. A modern hardware wedge card is a circuit board that is inserted into the card slot of your receiver, it has a piggyback slot that sticks out of the receiver and requires a H access card to be inserted to form the complete hack. It operates by capturing packets in the datastream, makes any necessary changes to it, then passes it to your H to decrypt the video. The January 15th ECM have demonstrated that DirecTV can still put your H card in a loop even if it is isolated or protected by a wedge.
The Combo card was the first wedge to be released by the
hackers. It’s programming was stored in an EEPROM chip. The DDT came out about a
month after it, it was about 25% less in price than the COMBO but was not capable of
generating the entire authorization packets by itself, so it required the users to
subscribe to DirecTV or USSB with a small programming package. It takes authorized packets
from the subscriptions and modifies them to grant access to the non-subscribed channels.
The DDT’s code was dumped by one of their competitors and the file got circulated on
the internet. Soon, everybody was making DDT knock-offs, calling them DDT II, DDT
III, DDT Next Generation, etc. The original DDT group disappeared after the Jan 15th
ECM due to a lack of knowledge to repair the cards correctly. Most customers
were abandoned when their DDTs
and knock-offs died after less than 2 months of usage. Some
customers got less than 1 week of use on their DDT before it died.
The DATS came out about a month after the DDT. It
had some obvious advantages over the DDT. It can generate the full authorizations
packets without a subscription. It had a built-in blocker function to filter out any
harmful packets that were previously detected. It was compatible with both
subscribed and virgin cards. It also uses a less expensive Atmel microprocessor
instead of the DDT’s Dallas chip. The card’s street price was about half of the
DDT. According to the DATS group, the Atmel chip company betrayed them when the
company decided to join in on the hack business, they dumped the DATS’s codes and
sold it to other hackers. This allowed many dealers to come out with various knock-off
models selling at below the $200 street price, but without full understanding of how the
card worked. Shortly after, tens of thousands of knock-off DATS flooded the market
under various names: BOSS, Blue Baron, Blackjack, Bandit, Anonymous card, Wildcard, Red
Devil, and many others. The only authorized reproduction of the DATS was the Red Baron,
which received
support from the original group.
On January 15th, DTV launched a large ECM that wrote 17 new update codes to the H access card, 1 important one is the 09 command that closed the 09 "hole" that all wedges were using to add tiers to the H. The Combo and DDT cards stopped working, some DATS survived if it had their blocker running. Soon, all wedges were only working if it was using a non-updated H card with the blocker running to prevent the updates from closing up the hole on the H. A conversion chip later came out that converted a DDT into an unauthorized DATS knock-off.
On March 27th, DTV launched another ECM, this time with 5
new update codes, plus the original 17 codes were sent via another command that the wedges
were not capable of blocking. All currently working wedges use some kind of
modified H card where it is programmed with the 23 updates but has the 09 hole reopened to
allow the wedge to program the plastic cards. This hack method put the H at risk of being
looped. The genuine DATS are the only ones we know of that don’t use this
technique.
EVALUATING THE DEALERS
So after reading all this and you still decide to get a test card, here are some ways to find a reliable dealer. Ask around, and then ask some more, and then ask some more again. The main problem we have observed from "victims" of bad hacks/dealers is that the users were too lazy to do the research and dealer comparisons. If you have friends that own test cards, ask them about their dealers, but don’t jump at the first name or phone number they throw at you. Coming across a name just means you can then start the evaluation process to judge the dealer’s performance. Compare him with other contacts that you will come across. Other ways to find dealers is via the search engines on the Internet, but dishonest dealers are also listed on the search engines. We find the best method to find dealers is join the IRC satellite chat channels and ask other live on-line test card users about them, because it’s difficult for a dishonest dealer to hide their reputation when there are 200 critics or former customers online. Also, don’t believe everything you hear about the dealers, some dealers paid their employees to pretend to be a customer to suggest their services to new unsuspecting victims. If you come across the exact same comments over and over again, like "he’s the best, very honest", chances are it was pre-scripted. If somebody gives you a recommendation, ask them to back it up. Ask him why he recommended the dealer. Ask him to cite specific cases of how the dealer provided service. Ask them how he has dealt with the dealer. If you are just getting vague response, then don’t take that recommendation too seriously. After you have gathered a couple dozen of names and URLS, then you can start the evaluation process. Don’t be lazy and base your purchasing decision on only 1 or 2 factors. Any hasty decision will cost you in the long run. Here are some of the WRONG things people use to base their dealer’s decision on:
"I picked my dealer because..."
...he was the first one listed on the search engines
...he said he’s been in business for over 10 years
...he said his cards won’t get ECM and he offered me a
guarantee
...he was the only one I can find that takes credit cards
...he lives in my town
...he had a "@"sign in front of his nickname
on an IRC channel
...his web site looks really cool with the animated graphics
...everybody said they heard of him
...his purchase price was the lowest
...his purchase price was the highest, so he must offer the
best service.
...he has a scams page listing dishonest dealers
...he said there is only 1 fix and it is available only from
him
...his cards have real cool names
All these sentences were followed by "I got screwed by him after an ECM, now it’s going to cost me more money to get my card fixed". Anybody can make his site come up first on the search engines if he spends enough time and money. A dishonest dealer can continue to operate for over 10 years if there’s a constant supply of new customers to scam from, just as a Vampire bat can live for 10 years if there’s a new supply of blood every night. I know, it’s not fair to compare vampires to bad dealers, at least the vampires stop biting after they suck you dry. Every test card CAN and WILL get ECM, a guarantee is worthless if he can’t or won’t honor it. Even if he puts it in writing, you’ll just have a piece of paper to remind you how gullible you were. One dishonest dealer uses small fine prints to state that his guarantee is on his software, not the plastic card. This guarantee has little value since the software is intangible and it doesn't cost him to re-copy it on your card, but you wind up paying a hundred dollars for a new plastic card every time after an ECM because his weak software got your card 99. You wind up taking all the risk and paying for that risk.
Dishonest people take credit cards too, that’s why there is such a thing called credit card fraud on the Internet. If you think your credit card company will help you with an easy refund from a bad dealer, you're in for a bad surprise. Some real despicable dealer will post your real name, address, phone and credit card numbers on the internet for everyone to use if you try to reverse your charges. Some even threaten to report you to the authorities since they have written proof that you purchased an illegal card. One dishonest dealer even blackmailed his customers by making various charges on his customer’s credit card after the initial purchase, threatening to turn them in to the FBI if they protested the charges to their credit card companies.
So think long and hard before you give out your credit card number, because it might wind up costing even more than sending a blank money order to other dealers. Geographic location is not the best way to judge a dealer’s honesty. It will be more convenient to return cards for repair after and ECM, but that’s only if your local dealer can get access to the fix quickly, otherwise, you’ll just wait as long as everybody else. Stop by your local police station or jail to remind yourself that dishonest people live in your town too. Just because a person has a "@" in front of his nickname in the IRC channels doesn’t mean he’s any better or worse than the people without the OPs status. A flashy web site means the dealer is very talented at writing HTML codes or can afford somebody to write them, it doesn’t reflect his services to his customers.
A dealer that is well known doesn’t mean he’s a honest dealer, most people know their neighborhood crack dealer, but not many would send him their hard earned money. One dealer was very well known and liked by many IRC users, that was because he told the best jokes on the channel. A clown is not what you need when your cards go down after an ECM. Free jokes won’t get your TV back. If you do come across people that claim to know him, inquire more information about that dealer, ask probing and detailled questions. If a dealer has loyal customers because of his good service, they won’t mind spending the time to tell you about him. If they don’t want to spend that time, then they probably don’t have enough respect for that dealer. Do not equate a dealer’s popularity with his honesty. Don’t be tempted by a low initial purchase price, it is not the total cost of a test card, make sure you find out how much it will cost you to repair a card after each ECM, count the shipping charges also, because all cards will get hit sooner or later, and they will get hit more than once.
To find out the real cost to fix a card, don’t ask a dealer, because what he tells you in an email and what he actually charges can be very different amounts. Instead, look at his web page or old news section to see if he posted any prices to fix cards from the last ECM. If he’s charging $100 plus shipping to fix cards to his existing customers, you can probably expect to pay the same amount when your card goes down in the future. You can expect to pay this price more than once because there will be more than 1 ECM coming.
A dealer that charges the highest prices doesn’t mean he offers the best service, or he is selling "The Best" cards. It could just mean he is more greedy than the others and is preying on lazy customers that didn’t do enough comparative shopping. A dishonorable thief will betray his own mother, so he should have no problems betraying his enemies. So just because he lists a bunch of competition in his scams page doesn’t mean he’s any better than the people on that page. There are a few legitimate sites out there that do a good job listing real scams, you can easily distinguish them because they are just information sites and do not have anything to sell, so their motives for listing these scams are most likely to warn their readers.
How many times have you heard the old line, "You can’t get this anywhere else, so you must buy it from me today"? It’s impossible to keep a hack secret in this business, so if 1 dealer has it, it’s certain that somebody else will have it too. Hackers will hack each other’s work when they are desperate enough. Sometimes the second hack might be even better, but most of the time, it's worse since they don't have the full understanding of the original product. Never buy a card based on the name, no matter how "cool" it sounds, there is just no valid reason to make such a decision. Also, don’t be too impressed by a hack that bears a suffix like version 10 or Model III, it doesn’t mean it’s any better than the previous models, it just means all previous models have failed. If the hack was that great to begin with, there wouldn’t have been a need for a sequel! All the points that I just mentioned are to remind you not to base your decision lightly, it does not necessarily mean a dealer is bad if he fits some of the profiles above, he still could be a good dealer, good dealers take credit cards too, and they might have flashy web sites. You should evaluate a dealer on many factors, like his treatment to his existing customers.
EVALUATING THE HACKS
Here are some things to remember about all hacks that change the access card’s EEPROM codes. They will all die, it's just a matter of time before DTV gets around to writing an ECM for them. DTV is capable of killing all plastics, with or without a blocker. Average run time for any hacks is 3 to 4 months before it goes down with an ECM. DTV targets cards in the order that they are released. So if you buy the latest hack, chances are it will survive a few ECMs while earlier hacks gets 99ed, until it's your card's turn to get hit. There is no such thing as a "Best" hack. The main thing to look for in any hack is the SUPPORT from the dealer or group, all cards will die, but it's the dealer that will help you get it back up after an ECM. So when you read all the products on the web sites with their claim of superiority, ignore them. You should be evaluating a dealer’s performance instead. Look at their past ECM record and see what kind of responses did the dealers offer to their customers after an ECM. Look at their news section on their web sites and ask around in IRC to find out how long it really took them to return cards back to their customers and were the cards repaired properly? Find out how much they charge for the repair and consider any shipping charges that you might incur in the event of an ECM. Now multiply this 3 to 12 times to figure out the total operation cost of your test card after it’s been purchased. Your REAL cost is the total operation cost plus your initial purchase price, plus your time and energy that you will spend dealing with the ECMs and waiting for instructions from your dealers.
Now compare that to a normal legitimate subscription package for 1 year plus a realistic number of PPVs that you will watch. Then ask yourself which option is the smarter choice. The best time to evaluate a dealer is after an ECM, when the truth will come out on how he treats his customers. Any dealer that ask their customers to "Do not email us for the next 3 weeks, all emails will be trashed" is not the type that you want to buy from. While there is a huge logistic problem handling 2000 returned cards from their customers after an ECM, they should be prepared to answer 2000 emails if they were capable of taking money from 2000 people in the first place! Even if a customer is asking a question that is already answered on the web page, the dealer should still respond to all emails when their time permits. I got an email from one small dealer that has a time stamp of 3:45 A.M. because he stayed up that late to reply to his customers emails even after a long day of processing cards.
Another thing you can make your own judgment on is some
dealers will tell you that they are understaffed to handle all the phone calls or emails,
so don't contact them, and yet on the same web page, they are asking new customers to
"Place your order now, our operators are standing by". This tells you
where the dealer's loyalty lies, you're only important to them until they have your money,
then it's "No fix yet, stop calling!" Not all dealers are bad, there
are many out there breaking their backs to return cards to their customers as quickly as
they can. Some are driving cards across the border to avoid getting seized by US
Customs. Some dealers are giving freeware substitutes to their customers to ease the
long wait of over a month for the commercial cards to get reprogrammed. You should
be understanding to your dealer since sometimes it's out of their control
on the fix process, but you should also be smart enough to
take your business elsewhere if your dealer is not making an effort to repair your
card. If all this sounds like it’s too much work or hassle to buy a hack, then
you’re getting the point. Unless you are willing to commit some time and money
in researching your purchase, you will probably be more happier just getting a legitimate
subscription or stick with your cable service. If all the hack choices don’t
appeal to you or impress you, there is always the option of waiting for a better hack to
come out. But don’t hold your breath, because that wait can be long. There is
wisdom in subscribing until a better hack comes along. If you are outside the US,
the gray market dealers can help you get a "paying" subscription using a valid
US address for your monthly billing.
ADDITIONAL ADVICE
If you are in the market of buying a DSS test card please
be on alert of scammers who are out there to take your money, not only once but
again and again. There are dealers out there who are giving 1 year "free
guarantee" when the time comes to honor it they will charge you dearly by saying this
and that. Some dealers will give you false hope by saying to use a credit card and
the credit card company would back you up in case of any screw ups, It is true in some
instances but most of the time the scammers will have it delayed over 30 days and you are
back to square 1 , Credit card companies will not back you up for any purchase after 30
days and you have to take it to small claims court, which is not a good idea for
lots of people. There are some dealers who will make you sign a waiver of "no
refunds" before they charge on your card and send you product, This should be obvious
to you that if there is going to be a problem you will not get your money back
anyway. Please don’t be discourage by all this, There are lots of good dealers
out there who will go an extra mile to help their customers, all you have to do is find
one of those guys. Don’t be fooled by fancy web pages, guarantees and BS , do
your home work and get lots of information from Chat lines like MIRC and you will do fine.
Below is a list of common questions and answers that many buyers have asked:
How do I know if my receiver is compatible with a particular hack?
All software hacks are compatible with all brands of receivers. Some hardware wedges, like the DDT might not be compatible with a few newer 3rd generations receivers from Sony and RCA. The compatibility problem is usually caused by the software codes, not the actual board design, so as software gets updated, compatibility gets better. You should always ask your dealer to confirm his hack is compatible with your particular model before you place a purchase. Be sure to give him your exact brand and model number at the back of the receiver. If he doesn't know and tells you to purchase a card to find out, ask him to agree to take card back and give a full refund if it is not compatible. Do not be shy and ask for the agreement in writing.
What other problems can I expect with a hardware hack?
Most hardware hacks will work just as well as the software hacks. Main thing to keep in mind is because the board extends 4 to 6 inches out of the slot to accommodate the card socket for the plastic access card, make sure you have the space clearance in front of your receiver, especially if it is in an enclosed cabinet. Some wedges have the card socket straight out, while others have the socket at a 90 degree angle, so if you are using a wedge with a side socket, make sure the H card will not get in the way of operational buttons or infra red sensors on your receiver.
I paid over $600 for a battery card during the F series run time, is there any thing I can use this card for?
Ice scraper...sorry, old joke. As of now, only
useful thing people have used the old bats for is to get audio on their receivers. The
audio is not encrypted in the satellite signal, some receivers will broadcast the audio
without checking for permission from the access card, so you can actually listen to the
sounds on all channels, not just the music channels in the 500s. This feature is
dependent on your receiver brand, we have confirmed that Sony, Hughes, and Hitachi models
get all audio if used with a bat card that is programmed with an older main08x file.
Sometimes, the engineer channels in the 800s will broadcast PPVs for testing purposes
without any encryption, so you can view those broadcast with an old bat card, but this is
rare and on non regular times schedules. We did find 1 dealer that will convert your
old bat to a wedge card by adding a card socket and new
software, but the cost was higher than the price of a
completely new Wedge that's designed for the H.
What about the battery card programmer that plugs into the back
of my PC's parallel port, can I use it to program any of these
new wedges?
Most modern wedge hacks are a combination of hardware codes on the board and software on the plastic. We have not found any dealers that are releasing ECM fixes to their customers for self programming, due to a lack of security on the new codes and a fear of the competition getting hold of it, so for now, card programmers are not being utilized by the wedge dealers. Also, most wedge boards that use a Atmel chip for the main processor is not self programmable. In the last few ECMs, dealers required their customers to send both the wedge and plastic in to have it reprogrammed. The only person we found that utilizes the old parallel port programmer is 99King with his card condom blocker. His new codes are posted at his web site, but the file will only work on his own blocker boards, it will NOT work on any other wedges or bat cards.
I have a plastic card programmer that plugs into the serial port
of my PC, this was purchased for the old F series access cards,
are they compatible with the H series cards?
Yes, any card programmer that is ISO-7816 compatible will work with the H series cards, this includes the Haku-2, Haku-3, MK10, MK11, MK12, and many others.
I have a PC emulator board that I used during the old F series, can I upgrade it to work with the H series?
No, because there is no working H emulator board for the
PC. The F series emulator is not compatible with the H series because it lacks an ASIC on
the board, which is needed to help decrypt the H datastream. If and when an emulator board
comes out for the PC, most likely, it will be a new board design and the developers will
not waste their effort coming out with an upgrade path for your old board. The cost of
manufacturing a new board will be far less than the cost of labor to convert your
old board. Just like the bat card, you can probably still use the emulator as a
digital radio if you have the right brand of receiver.
What about all the rumors that I heard about my old bat or emulator
can be converted to use as a Dish Network hack?
That's just it, they are RUMORS. Until you see it with your own eyes, or a dealer or group makes an official announcement in writing, it's just wishful thinking.
Is there anything that I can recycle or reuse from my old F hacks?
If you have a F hardware card that uses a
socketed Dallas microprocessor, you can pop it out and reuse it on some new boards.
This situation depends on your dealer. If you have any left over F series access
cards, some dealers will give you about $5 each for them. They are using the
old F cards to upgrade to H series from DirecTV. You can also do that
yourself, but DirecTV will charge you a lot more than their authorized
dealers. On some F emulator boards, you might be able to use it to log the
datastream if it is used with the right software.
ONLINE LINKS CABLE TV If you've read the slightly technical discussion of how cable TV
signals are scrambled, you should understand that the simplistic methods of descrambling
proposed by other parties can not work properly. However, if you wish to view those
methods,
make sure you are connected to the
Internet and then CLICK HERE
If you're really interested in building your own descrambler, here's a supplier that can provide you with a parts kit, schematics, etc. Just CLICK HERE
If you want to buy a 'TEST BOX', here's a supplier. The TEST BOX connects into your cable prior to the cable going to your cable company box at your TV. The TEST BOX sends a signal to the cable company box, turning on ALL THE CHANNELS. One TEST BOX will turn on all the cable company boxes in your house. Prices are very reasonable, so you could definitely make some good profit by reselling these devices. CLICK HERE
If you want a complete, ready made combination descrambler/converter, here's a source. This unit also replaces the rental unit from your cable company and they offer quantity discounts, so you can resell. CLICK HERE
More ready made units for cable:
or
CLICK HERE
or
CLICK
HERE
Offers great deal on TEST BOX that
turns on ALL CHANNELS (WholeSale prices) DSS TV
DSS test cards - turn on all
channels! CLICK HERE
DSS test cards replace the normal
subscription card and enable viewing of all programming. When installed, you don't have to
pay any subscription payments at all.
More DSS test cards CLICK HERE
DSS card programmers & software to make your own test cards CLICK HERE
More DSS card programmers -
assembled or kit form CLICK
HERE