|
Keeping with tradition, and seeing that this is the first article inPhrack on cable TV descrambling, any illegal box for use in descramblingcable television signals is now known as a PORNO BOX. There are many methods that cable companies use to insure that you getwhat
you pay for - and _only_ what you pay for. Of course, there arealways methods
to get 'more than you pay for'. This file will discussthe most important
aspects of these methods, with pointers to moredetailed information, including
schematics and
Part I. How the cable company keeps you from getting signals A brief history ---Older Systems--- Most scrambling methods are, in theory, simple. The original methodused to block out signals was the trap method. All traps remove signalsthat are sent from the CATV head end (the CATV company's station). The first method, which is rarely used anymore was the negative trap.Basically, every point where the line was dropped had these traps, whichremoved the pay stations from your signal. If you decided to add a paystation, the company would come out and remove the trap. This method was pretty secure - you would provide physical evidence of tampering if you climbed the pole to remove them or alter them (sticking a pin throughthem seemed to work randomly, but could affect other channels, as itshifts the frequency the trap removes.) This was a very secure system, but did not allow for PPV or other services, and required a lot of physical labor (pole-climbers aren't cheap). The only places this isused anymore is in an old apartment building, as one trip can serviceseveral programming changes. Look for a big gray box in the basementwith a lot of coax going out. If you are going to give yourself free service, give some random others free service to hide the trail. The next method used was termed a positive trap. With this method, thecable company sends a _very_ strong signal above the real signal. Atuner sees the strong signal, and locks onto the 'garbage' signal. Aloud beeping and static lines would show up on the set. For the CATVcompany to enable a station, they put a 'positive' trap on the line,which (despite the name) removes the garbage signal. Many text fileshave been around on how to descramble this method (overlooking theobvious, buying a (cheap) notch filter), ranging from making a crudevariable trap, to adding wires to the cable signal randomly to remove thesignal. This system is hardly used anymore, as you could just put a trapinside your house, which wouldn't be noticed outside the house. ---Current Systems--- The next advent in technology was the box. The discussion of differentboxes
follows, but there is one rather new technology which should bediscussed
with the traps. The addressable trap is the CATV's dream. Itcombines the
best features of the negative trap (very difficult to tamperwith without
leaving evidence) with features of addressable boxes (nolineman needs to
go out to add a service, computers can process Pay PerView or other services).
Basically, a 'smart trap' sits on the pole andremoves signals at will.
Many systems require a small amp inside thehouse, which the cable company
uses to make sure that you don't hook upmore than one TV. I believe that
the new CATV act makes this illegal,and that a customer does not have to
pay for any extra sets (which do notneed equipment) in the house. Of course,
we all know that the cable TVcompany will do whatever it
Cable boxes use many different methods of descrambling. Most are not
inuse anymore, with a few still around, and a few around the corner in
thefuture. The big thing to remember is sync suppression. This method ishow
the cable companies make the picture look like a really fucked up,waving
Dali painting. Presently the most popular method is the Tri-modeIn-band
Sync suppression. The sync signal is suppressed by 0, 6, or 10dB. The sync
can be changed randomly once per field, and the informationnecessary for
the box to rebuild a sync signal. This very
The other common method currently used is SSAVI, which is most common on Zenith boxes. It stands for Sync Suppression And Video Inversion. Inaddition to sync suppression, it uses video inversion to also 'scramble' the video. There is no sync signal transmitted separately (or referencesignal to tell the box how to de-scramble) as the first 26 lines (blank,above the picture) are not de-synched, and can be re-synched with aphased lock loop - giving sync to the whole field. The data on inversionis sent somewhere in the 20 or 21st line, which is outside of thescreen. Audio can be scrambled too, but it is actually just moved to adifferent frequency. Radio Electronics August 92 on has circuits andother info in the Drawing Board column. ---Future Systems- For Pioneer, the future is now. The system the new Pioneers use ispatented
and Pioneer doesn't want you to know how it works. From thepatent, it appears
to use combinations of in-band, out-band, and keys(also sending false keys)
to scramble and relay info necessary todescramble. These boxes are damn
slick. The relevant
Other systems are the VideoCipher + (used on satellites now - this isscary shit.) It uses DES-encrypted audio. DigiCable and DigiCipher aresimilar, with Digi encrypting the video with DES also (yikes)... Andthey all use changing keys and other methods. Oak Sigma converters usesimilar methods which are available now on cable. (digital encryption ofaudio, etc...) Part II. How the cable company catches you getting those signals There are many methods the CATV company can use to catch you, or atleast keep you from using certain methods. Market Code: Almost _all_ addressable decoders now use a market code. This is part of the serial number (which is used for pay per view addressing) which decodes to a general geographic region. Most boxes contain code which tell it to shut down if it receives a code (which can be going to any box on the cable system) which is from a different market area. So if you buy a converter that is say, market-coded for Los Angeles, you won't be able to use it in New York. Bullets: The bullet is a shut down code like above - it will make your box say 'bAh' and die. The method used most is for the head end to send messages to every box they know of saying 'ignore the next shutdown message' ... and once every (legit) box has this info, it sends the bullet. The only boxes that actually process the bullet are ones which the CATV system doesn't know about. P.S. Don't call the cable company and complain about cable if you are using an illegal converter - and be sure to warn anyone you live with about calling the CATV co. also. Leak Detection: The FCC forces all cable companies to drive around and look for leaks - any poor splice jobs (wiring your house from a neighbors without sealing it up nice) and some descramblers will emit RF. So while the CATV is looking for the leaks, they may catch you. Free T-Shirts: The cable company can, with most boxes, tell the box to display a different signal. So they can tell every box they know of (the legit box pool) to display a commercial on another channel, while the pirate boxes get this real cool ad with an 1800 number for free t-shirts... you call, you get busted. This is mostly done during PPV boxing or other events which are paid for - as the company knows exactly who should get that signal, and can catch even legit boxes which are modified to receive the fight. Your Pals: Programs like "Turn in a cable pirate and get $100" let you know who your friends _really_ are.Part III: How to get away with it. I get a lot of questions about opening a box that you own. This is nota good idea. Most, if not ALL boxes today have a tamper sensor. If youopen the box, you break a tab, flip a switch, etc... This disables thebox and leaves a nice piece of evidence for the CATV co. to show that youplayed with it. I also have had questions about the old "unplug the box when it is enabled, then plug it back in later"... The CATV company periodicallysends a signal to update all the boxes to where they should be. If you want to do this, you'll need to find out where the CATV sends the address information, and then you need to trap it out of the signal. So as soon as the fraudulent customer (let's call him Chris) sees his box get the signal to receive the PPV porn channel, he installs the trap and now hisbox will never get any pay per view signals again... but he'll always have whatever he was viewing at the time he put the trap in. Big problem here is that most _newer_ systems also tell the box how long it candescramble that channel - i.e. "Watch SPICE until I tell you not to, or 3 hours have passed"... Where to make/buy/get porno boxes: You can order a box which has been modified not to accept bullets. Thismethod
is pretty expensive. You can also get a 'pan' descrambler - it isa separate
piece that takes whatever goes in on channel 3 (or 2 or 4) and descrambles
it. These boxes can't be killed by the bullets, and work pretty well. There
are some pans which
There are two basic ideas for modifying a box (provided you get detailed
instructions on how to get it open, or how to fix it once you open it).You
can change the S/N to something which is known as 'universal' ordisassemble
the code and remove the jump to the shutdown code.The universal codes are
rare, and may be extinct. Besides, if the cablecompany finds out your code,
they can nuke it. This happens when someone who makes (err made) 'universal'
chips gets busted. The modification of the actual code is the best way
to do it, just forcing a
A 'cube' is not a NeXT, it's a device which removes the data signal fromthe cable line, and inserts a 'nice' data signal which tells your box toturn everything on. A 'destructive' cube actually re-programs all the boxes below it to a new serial number and gives that number full privileges, while a 'non-destructive' cube needs to know your boxes serial number, so it can tell your box (without modifications) that itcan view everything. You have to get a new IC if you change boxes, butthe plus is that you can remove the cube and the box functions as normal. Then again, you have to trust the place you are ordering the cube from to not be working for the cable company, as you have to give them your box serial number - which the CATV cable has in their records.Cubes have been seen for sale in the back of Electronics Now (formerly Radio Electronics). Of course, you could check in the above mentioned articles and buildcircuitry, it would be a lot cheaper. The only problem is that you haveto be good enough not to fuck it up - TV signals are very easy to fuck up. Then there is the HOLY GRAIL. Most scrambling systems mess with the
syncpulse. This pulse is followed by the colorburst signal on NTSC video.
Basically, the grail finds the colorburst and uses it as a referencesignal.
In
|