norm@tsdiag.ccur.com (Norm Sandbach) (10/24/90)
I have some questions regarding Satellite T.V. and VideoCipher II.
1) How come I never see this subject on the net ?
2) Did any of you read the articles in Electronic Eng Times on DecTec
and the new SUN decoder (Oct. 22, 1990)? Does anyone have the address
of DecTec or info on ordering the SUN decoder ?
3) Whats the latest scoop on VCII decoder hacking, anyone got the 032
type working ?
4) Can anyone explain the following : Wizard Chips, Seed Key archival,
Auto Updating units, Musketeering, what services the 900 number provides
and how is a unit modified for the 900 number codes ?
5) Which of the VCII's have been cracked (ie: 019, 029, 032) and which
ones have not.
6) What are the best sources for info on this subject, how about Telecode ?
7) How about the Oak system ?
Any information would be great! Now don't worry, I would never do any
thing thats illegal. I just want to further my knowlege on how these
things work. Thanks, Norm.
ranma@noc.arc.nasa.gov (10/24/90)
norm@tsdiag.ccur.com (Norm Sandbach) writes: > I have some questions regarding Satellite T.V. and VideoCipher II. > > 1) How come I never see this subject on the net ? Probably because most of us live in f&%$ing apartments which the f&%$ing landlords wont let us stick our satellite dishes up (I'd prefer to stick my satellite UP my landlords a$$ at this point...). My Favorite Excuse: "Insurance". :-( > 2) Did any of you read the articles in Electronic Eng Times on DecTec > and the new SUN decoder (Oct. 22, 1990)? Does anyone have the address > of DecTec or info on ordering the SUN decoder ? Never heard of it. Can you summarize any details for us??? Would be much appreciated. > 3) Whats the latest scoop on VCII decoder hacking, anyone got the 032 > type working ? I think the 032 was finally hacked, but wasn't stable. But this was about 6 months ago. > 4) Can anyone explain the following : Wizard Chips, Seed Key archival, > Auto Updating units, Musketeering, what services the 900 number provides > and how is a unit modified for the 900 number codes ? Never heard the 900 scheme. Info??? > 5) Which of the VCII's have been cracked (ie: 019, 029, 032) and which > ones have not. All except the 032 (a stable 032, that is). Always preferred is the old 018 boards. Rock solid. > 6) What are the best sources for info on this subject, how about > Telecode ? The old "Blank Box Newsletter". Can't remember what it is now. I'll try to dig up some info (ie: an old issue). > 7) How about the Oak system ? Cracked years ago (well, not really years, but a long time..), but rumors was that CANCOM was gonna drop the Oak-Orion system in favor of the VC-II-Plus. > Any information would be great! Now don't worry, I would never do any > thing thats illegal. I just want to further my knowlege on how these > things work. Thanks, Norm. 'course ... :-) More rumors: cracked B-MAC (ie: HiNet). ranma-kun
wtm@uhura.neoucom.EDU (Bill Mayhew) (10/25/90)
Receiving unauthorized programming through a modified Videocipher module is potentially unlawful, thus there is reluctance to discuss any methods in a public forum such as this. What can be said is that the Videociopher 2000 and 2100 models 018, 019 and 032 have been widely compromised by so-called "chippers". Who alter the units' firmware to simulate authorization of multiple services. The compromise is made possible by an extremely poor and short-sighted design of the DES key manangement by MA/Com, the original designers of the system. There have been significant changes incorporated in the newer Videocipher Plus which are claimed to prevent chippers from attacking with current stategies. Digicipher, reported to be compatible with HDTV, is in the works. Yes, there is a 900 number which reads numbers to you in hexadecimal format. There is no explanation of what the numbers are for or what to do with the numbers. I don't think it would be a very smart idea to call that number from your own home unless you want the FBI knocking on your door next month. There are many sources of so-called Videocipher "repair" software. The best way to find out is to get a copy of a magazine called "Satellite Watch Newsletter" and read the ads (it is virtually 100% ads). It's easy to get taken. I doubt that anybody is going to be stupid enough to go the the postal inspector complaining that he/she was ripped-off buying illegal Videocipher firmare, but only recieved a box of a few scraps of wire and some old TTL chips. Caviat emptor. ==Bill== -- Bill Mayhew NEOUCOM Computer Services Department Rootstown, OH 44272-9995 USA phone: 216-325-2511 wtm@uhura.neoucom.edu ....!uunet!aablue!neoucom!wtm via internet: (140.220.001.001)
norm@tsdiag.ccur.com (Norm Sandbach) (10/31/90)
A while back I posted for info on Satellite T.V. Video Cipher srambling. The following are three of the best mailings I received out of many. A lot of people asked me to post any info I got so here it is:
(Names of posters have been deleted)
(1)
> I have some questions regarding Satellite T.V. and VideoCipher II.
> 1) How come I never see this subject on the net ?
Touchy topic. CAN be but not necessarily illegal. I like reading about
it, but I stay away from actually doing the modifications. Kind of like
picking locks - interesting, but it can get you into some real trouble
if you go around doing it.
> 2) Did any of you read the articles in Electronic Eng Times on DecTec
> and the new SUN decoder (Oct. 22, 1990)? Does anyone have the address
> of DecTec or info on ordering the SUN decoder ?
NO. There is a unit called "Sync-A-Link" which gets the video on VCII
services. There is also a complete VCII clone available in Canada - but
it would violate too many copyrights to import into this country. Really,
as far as I'm concerned, GI has a monopoly here and that shouldn't exist!
> 3) Whats the latest scoop on VCII decoder hacking, anyone got the 032
> type working ?
032 boards work. They're a bit more difficult. They take different
software and different seed keys. They can be converted to 010s with
a $100 or so module.
> 4) Can anyone explain the following : Wizard Chips, Seed Key archival,
> Auto Updating units, Musketeering, what services the 900 number provides
> and how is a unit modified for the 900 number codes ?
Wizard (keys): These are the decryption codes for the audio stream. They
are called Wizards because one set (18 bytes) gets all audio for backyard
subscribable services. There is a new one each month. This is the key
"cheat" boxes get - actually all boxes get this number. "Cheat" boxes
ignore the service mask that accompanies the wizard code.
Seed Key Archival: Seed keys are 28 bytes of keys that come in RAM in
a cypher when you buy it. The way the sysem works is this: the vc monitors
the data stream looking for it's serial number. When it sees it, it grabs
the block of data intended for it. This data are the Wizard codes and
channel mask (usually for next month) in encrypted form. The seed keys
are used to decrypt this info. The seed keys are kept in RAM which is
backed up by a lithium battery. These batteries die in about 4 years and
then the vc becomes "brain dead" - it forgets it's seed keys and serial
number and no longer can receive the services it is subscribed to. Another
use (the reason this was done) is that if you give several boxes the same
serial number and seed keys, they will get the same services - so you
have a "cheat box". Doing this is called "Muscateering". In addition,
most Muscateer software ignores the service enable mask so that the
original board only need be subscribed to a cheap service.
Auto Update: By having the appropriate seed keys and serial #, you
never have to touch the vc and it will continue to get service.
900#: the one you want is: 1-900-HOT-SHOT. For $3.50, this call will
give you one of 3 sets of Wizard keys: 010-019, 032, or F3-18 (a service
that you can't subscribe to and thus has a different wizard key)
You won't need to make this call if you have auto updating software. To
use these numbers, you need software that allows you to enter them.
> 5) Which of the VCII's have been cracked (ie: 019, 029, 032) and which
> ones have not.
Cracked: 010-019, 032.
The VC+ (029?) has been reported to have been compromised. It is hard
to assess yet, because no (or just recenlty) VCII+ services are available.
> 6) What are the best sources for info on this subject, how about
> Telecode ?
Telecode is OK, but I don't think they sell complete software. They
do have a lot of info which could probably give you a good background.
After all - this is Educational, right?
> 7) How about the Oak system ?
Can be done. It also requires software - but I haven't taken a look
at it.
> Any information would be great! Now don't worry, I would never do any
> thing thats illegal. I just want to further my knowlege on how these
> things work. Thanks, Norm.
I had a chance about 6 months ago to take an 010 apart and see how it works.
Rather interesting - but REALLY BAD DESIGN. Easily compromised and the
VCII serices was built to fail. (Several parts go bad in 3-4 years. Maybe
GI wanted to recycle the boards every so often... but it costs the consumer)
(2)
Receiving unauthorized programming through a modified Videocipher
module is potentially unlawful, thus there is reluctance to discuss
any methods in a public forum such as this.
What can be said is that the Videociopher 2000 and 2100 models 018,
019 and 032 have been widely compromised by so-called "chippers".
Who alter the units' firmware to simulate authorization of multiple
services. The compromise is made possible by an extremely poor and
short-sighted design of the DES key manangement by MA/Com, the
original designers of the system.
There have been significant changes incorporated in the newer
Videocipher Plus which are claimed to prevent chippers from
attacking with current stategies. Digicipher, reported to be
compatible with HDTV, is in the works.
Yes, there is a 900 number which reads numbers to you in
hexadecimal format. There is no explanation of what the numbers
are for or what to do with the numbers. I don't think it would be
a very smart idea to call that number from your own home unless you
want the FBI knocking on your door next month.
There are many sources of so-called Videocipher "repair" software.
The best way to find out is to get a copy of a magazine called
"Satellite Watch Newsletter" and read the ads (it is virtually 100%
ads). It's easy to get taken. I doubt that anybody is going to be
stupid enough to go the the postal inspector complaining that
he/she was ripped-off buying illegal Videocipher firmare, but only
recieved a box of a few scraps of wire and some old TTL chips.
(3)
With respect to your questions, I don't think I can be of much help other
than on the subject of the 900 number. I "invested" some $40-50 for
something called a super chip, or something like that, and all that came
was a $0.50 ic socket, and some nearly useless directions and a data
disk that I haven't looked at yet. From what I gather, you must scrape
off some of the epoxy from one of the VCII chips and solder the ic
socket over it. You then use an eprom programmer to program an eprom
to plug into the socket (eprom not included, and no indication of
what type eprom to use). Aparently the data on the eprom must be updated
once a month via the 900 number. I have not tried this so I have no idea
if it works.
Something out there must work, cause they are offering nearly twice
the purchase price for old version VCIIs, and the manufacturer is actively
trying to get people to trade in the old units.
An interesting source of information is on satellite. I'm not
sure, but I think on S1 on Tue or Wed night, ?9 or 10pm est? Some
crazy guy tries to sell used sat equipment for 5 times what it would
cost at a hamfest or flea market, but he is interesting to listen to,
and talks a lot about the VCII situation.
(End)
Well, thats the best information I've received so far.
Does anyone have some more to add to this ?
Remember that fooling around with VCII's to receive scrambled broadcastsiis illegal and you could be fined and or sent to jail for it! But talking aboutit is not, Norm.
--
US MAIL: Norm Sandbach -WANTED- Old Radios, parts, radio related items
FAX: 201-870-5952 2 Crescent Pl. Oceanport NJ 07757 PH 201-870-4227
UUCP: rutgers!petsd!tsdiag!norm or norm@tsdiag.ccur.com