Section G -- Television

G-01. What kinds of satellite television networks are there?

The two types of satellite television networks currently available in the United States are C-Band and Ku-Band. Ku-Band is better known as DSS (Digital Satellite System).

C-Band requires a minimum 6' dish, however it also gives you access to thousands of channels from 24 satellites. Ku-Band requires only an 18" dish and gives you access to a few hundred channels from three satellites.

C-Band dishes enable you to receive basic programming at no cost. Premium channels are encrypted using VideoCipher II RS (VCII RS).

In the United States, C-Band programming is available from National Programming Services and Ku-Band programming is available from EchoStar's Dish Network and DirecTV.

G-02. What is VideoCipher II RS (VCII RS)?

VideoCipher II RS (VCII RS) is the scrambling system that most C-Band premium satellite TV channels use. A VCII satellite receiver is required to decode VC II channels.

G-03. What is DigiCipher II (DCII)?

DigiCipher is Motorola's proprietary video distribution system. DCII is based upon MPEG-2. A Motorola 4DTV satellite receiver is required to decode DCII channels.

G-04. How do I get free DSS programming?

DSS receivers are equipped with slots for access cards called Conditional Access Modules. These are smart cards that contain RAM, ROM, and EEPROM. These cards tell the DSS receiver what channels to allow you to receive.

The two common methods of getting free DSS programming are to either reprogram an actual access card or to use a PCB (Printed Circuit Board) that emulates an access card.

Using an actual access card in your receiver opens you up for attacks from the DSS programming provider. These attacks take the forn of datastream updates, tier wipes, looping, and EEPROM corruption. Datastream updates and tier wipes can be repaired by programming the access card again. Looping requires the use of a piece of equipment called an unlooper to repair. EEPROM corruption attempts to permanently damage the access card. For these reasons, reprogramming access cards is not recommended.

Emulating an access card with a PCB is a more complex solution, but also a much more robust solution. Emulation requires emulation software, a PC to run the emulation software on, and an access card programmer/loader.

For more information on setting up emulation, visit What You Need to Begin at Nytech.

G-05. What kinds of DirecTV access cards are there?

DirecTV is now utilizing the fourth generation of ISO7816 smart access cards.

P1, also known as F cards, were used until 1997. F cards have a picture of a satellite on the front.

P2, also known as H cards, were introduced in 1996 to replace F cards. H cards look the same as F cards. H cards are were in use until 2002.

P3, also known as HU cards were introduced in 1999 and are still supported. HU cards have a picture of a football player on the front. HU cards originally shipped with receivers with serial numbers above 0001 700 000.

P4 cards were introduced in 2002 and are the current standard. P4 cards are labelled "Access Card: 4."

G-06. What do DirecTV and Dish Network do to stop signal theft?

DirecTV maintains a list of cancelled access cards. If an access card with a blacklisted CAM ID is utilized, you will receive the "Call Extension 745" error message.

DirecTV and Dish Network engineers also broadcast hostile signals that instruct the satellite receivers to cause unauthorized access cards to stop working. These attacks are commonly known as ECM (Electronic Counter Measures). Common ECM attacks are:

Datastream updates

Datastream updates are new software which is sent to the access card to attempt to close previously discovered vulnerabilities. Datastream updates can be repaired by programming the access card again.

Tier Wipes

Tier wipes are updates which are sent down to reconfigure unsubcribed access cards. Tier wipes can be repaired by programming the access card again.

Looping

Looping utilizes the ROM program in each access card. Instructions are sent down which causes unsubscribed access cards to enter an infinite loop. Which the card is stuck in this infinite loop it can not be written from or read to in a normal manner. Looping requires the use a piece of equipment called an unlooper to repair.

EEPROM corruption

EEPROM corruption is the most dangerous type of ECM. Instructions are sent down that detect unsubscribed access cards and damage the EEPROM on the access card.

G-07. What software is there to experiment with access cards?

There are many applications of this nature and the list changes frequently. Here are a few of the top applications:

WinExplorer

WinExplorer is a Win32 GUI application designed to communicate with a wide variety of smartcards. It's intended purpose is to give hobbyists and professionals a powerful tool for programming smartcards using low cost interfaces.

Many software tools for access card experimentation are actually scripts written in WinExplorer.

ExtremeHU

ExtremeHU is an excellent program for reading and writing access cards, as well as unlooping and unglitching.

G-08. What are the different types of access card hardware?

Most access card hardware available currently is multi-purpose hardware. Loaders and unloopers are basically the same hardware.

Loader

Loaders are smartcard reader/writers with Atmel chips which are used to transfer or "load" small programs onto access cards.

Unlooper

Unloopers fix cards that have been looped in an ECM.

Programmer

Programmers are smartcard reader/writers that allow you to program your access cards from your PC.

G-09. Where can I purchase hardware to experiment with access cards?

This equipment is available from vendors all over the Internet, including:

Mikobu

ViperPlus

DishToys

DssCove

For more information on access card equipment, visit Royce Dish Information and Review Site.

Note: Several hardware vendors have experienced legal trouble and have turned over their customers lists to law enforcement and to DSS broadcasters. Those customers are now being harassed by lawyers. It is not recommended to purchase this equipment utilizing a credit card.

G-10. What is this extension DirecTV is telling me to call?

Extension	Explanation
711	Customer account is set-up but the system has not been activated (which is called a partial activation)
721	Channel is not authorized, or subscription has expired
722	A "resend" is required from DirecTV to re-activate an active subscription (i.e. The receiver was off for a long period)
731	Access Card is full and has not reported to DirecTV
732	PPV has not been set-up or has been blocked due to delinquent account
733	Due to unsuccessful attempts by the receiver to download the access card, the PPV purchase ceiling has been set to 1 cent by DirecTV
734	Receiver un-sets for PPV purchases capability due to receiver malfunction
745	Card lost, stolen, or damaged (Generally it means the serial number has been added to the blacklist)
746	Possible data corruption - receiver fault
751	Access card needs to be changed out
752	Card not combatable (This is a new message only shows with the new 5th generation RCA receivers)

G-11. What can I do with a TiVo?

The TiVo is really just a PC running Linux. You can do anything with it you can do with a normal Linux system, plus interacting with it's special television hardware.

For more information, check out The TiVo FAQ and Newbies Guide to the Tivo.