cable

Overview This guide has been designed as an educational aid for the enthusiast interested in Analogue Cable, Digital cable and Satellite TV technology. Contributions have been made from many different sources including www.dragonalfa.co.uk/shop/ and the editorial team gratefully acknowledge their support and assistance. The scope of the help file attempts to provide a point of reference to both the new and the experienced enthusiast. With this in mind, the documentation is constantly being updated and new versions will be released as fresh information becomes available. This documentation has been compiled from various resources on the Internet. Wherever possible the original authors have been acknowledged and credited as the source and for their contributions. Please see the Credits and the Resources sections for further information, websites and links. GO TO JAIL WARNING: Tampering with cable boxes to receive Pay TV signals without paying for them is illegal in most countries. The information here should be used for test purposes only.

Getting Started Before you start you should browse through the different sections of this help documentation and try to become familiar with the terms and expressions used throughout these pages. There is a detailed glossary which will help you understand any technical expressions and terms used within the documentation. You should also equip yourself with some basic tools, software and equipment. Most of the items you need can be purchased from www.dragonalfa.co.uk/shop/ such as card programmers and software but some tools that will be needed are as follows

Basic tools you will need: • A soldering iron, solder and flux • A De-solder gun and de-solder braid (optional) • Screwdrivers • A Pic/card Programmer • Pic Chips and/or cards • An electrical tester (optional but worthwhile). • Common Sense and patience

Digital Introduction This section covers the Cable Decoders for the Digital cable system. Most of these are manufactured by PACE. There is another section on Analogue Cable decoder systems. Please ensure you are reading the correct section for your Cable Decoder before proceeding. Before attempting to make any modifications to a decoder it is important to become familiar with the terms used and the internal mechanics of how the system works to transfer and decode/encode the transmissions.. Please read the information on Talkback and Rom Cards in order to gain some familiarity with these terms. Also use the Glossary to look up the meaning of any terms and technical jargon. Please Note: The tutorials described here are broadly similar for each different model. However each model will have subtle differences so it is recommended you consult the technical specifications for the model on which you are working before attempting to implement any modifications.

What Not To Do Never attempt to modify any decoder whilst it is connected to a mains supply!

•

• • •

There is a risk of serious electric shock which could prove fatal. Always ensure the decoder is disconnected from the mains supply and the plug removed from the wall. Do not use any tools which are not suited to the purpose of electrical work. Never allow children to connect your test equipment to a mains supply Never allow children to adapt any electrical components or decoder boxes.

Safety Precautions • If possible wear appropriate rubber soled shoes in case of surplus static current. • If possible obtain an anti-static strap and wear this whilst working on electrical components, even when the test unit is disconnected from the mains • Always earth yourself by touching a metal surface before touching any electrical components - this will remove surplus static from your body. • Only use tools which are appropriate for the task you are attempting. • Keep small children and pets away from your work area and test equipment. You should not attempt any modifications on a rented digital decoder. Only modify a box you own. They can be purchased from online auctions or through the classified adverts sections of newspapers. You should not attempt any modifications on a ROM Card without making a back-up of the original data within the card. For details on ROM and ROM cards see the Card Information section Tip: Using a digital splitter with a rented box and a modified box will mask the signal from the modified box which has had Talkback disabled.

Digital Box Types There are a number of different models for the Digital cable decoder. They are generally manufactured by Pace and all of them look similar to one another. However, the internal board layouts are somewhat different for each model. The different models are released in series and the higher the number the more recent the release of each model series. The Pace series digital decoder models are: The Pace Ditv1000 series Pace DITV1000 Pace DITV1010 The Pace Ditv2000 series

Pace DITV2000 The Pace Ditv4000 series Pace Di400N Pace Di4001N Pace Di4010N These are available from www.dragonalfa.co.uk/shop/ including some of the tools you will need, I contacted the store and they were able to email me the software.

About Digital Decoder ROM Cards The cards which come with the Digital Decoder box (or are married to the box) are called ROM cards. There are different versions of the ROM cards. UK suppliers, namely NTL and TeleWest, support Rom7, Rom10 and Rom11 cards. "ROM" is the type of card you will have if you own a digital decoder which has been supplied by either of these. The ROM cards are pre-encoded by the manufacturers using software provided by NagraVision. You can see this on the rear of the ROM card. To edit the card, a software package is available called Nagra edit. This is not provided by NagraVision but is generally available through Internet Discussion Forums. At the time of writing nagra edit software only supports Rom10 cards. Rom11 is newer and currently is not supported. Rom10 is the only card which can be MOSC'D (modified) to receive all channels. Most modern boxes will have Rom11 cards which can be MOSC'D (modified) and can be copied from the ROM11 and used in a ROM10 card.

Use of a computer, card programmer and nagra edit software will tell you the ROM version of a card. This information is very useful before thinking of making any modifications to the digital decoder. Important Note: Always take a back-up copy of your ROM Card before attempting any modifications. This can be done by using Nagra edit to back-up the card.

Understanding Talkback Talkback is a way for the cable company to be able to tell the box is online and is also used for interactive services. The box will communicate with the cable company and ask for permissions such as access to the channels. By disabling the Talkback function the box no longer communicates with the cable company and asks permission. Since the box no longer communicates with the cable company it is unlikely the cable company will know it exists. However, if a rented box stops communicating then the cable company will suspect it has been modified, since they keep an accurate log of all box communications on their system. Similarly, if a box which has been modified to receive all of the channels communicates with the cable company, they will identify it as an illegal attempt to steal their Pay TV services and trace its source. There are a few ways to modify the box to prevent Talkback. This involves cutting a track inside the tuner part of the box or lifting a leg of a component. Both methods disable the unit from using Talkback. There have been rumours of a filter which means no internal modifications are necessary. Allegedly this can be put in line with the cable which comes in from white cable box on the wall and into the back of the digital receiver. However, at the time of writing these are only rumours and are unconfirmed.

Ditv-1000 - Things you will need

There are two stages to modifying a Pace digital decoder. The first stage is to modify the hardware (the decoder itself) and the second is to modify the ROM card using a computer, a card programmer and some special software. Hardware/Tools • Pace Ditv1000 cable box • ROM 10 Card – preferably married to the box • A Digital Splitter (optional but recommended). • Smart Card Programmer - preferably with 3.68mhz crystal fitted. • Small tip Soldering Iron and solder (or sharp craft knife) • Screwdriver Software: • Lib debug software • Tw.cfg – the hex file • Nagra Edit 3 – Software • Getbox PC2 – to get the box key (Non-Rom 10/Rom 11 cards) Some Alternatives: • You can also write to your card in the box, using a modem lead straight into your computer using the RS232 Ports and a software application called cam whistler. • You will need: • A Modem cable for box to computer editing using the RS232 Ports and software • Cam Whistler Software

Ditv-1000 - Modifying the Hardware Getting Started There are two stages to modifying a Pace digital decoder. The first stage is to modify the hardware (the decoder itself) and the second is to modify the ROM card using a computer, a card programmer and some special software. Remove the Cover Remove the Tuner Disable Talkback Reassemble the Tuner Replace the Cover IMPORTANT: DO NOT CONNECT THE BOX UP TO THE MAINS YET! THIS IS ONLY THE FIRST STAGE. ONCE YOU HAVE COMPLETED THE ABOVE MODIFICATIONS YOU NEED TO COMPLETE STAGE TWO.

DiTV-1000 - Removing the Cover Clear a work surface and gather your tools. Place the Pace DiTV 1000 box on your work surface. Ensure it is not connected to the mains and if it is then disconnect it and unplug it from the wall. Unscrew the box and remove the cover.

Image (1) - Models DiTV1000 and DiTV 4001

The rear of the decoder will look different depending on the model series you are working with. The procedure for removing the screws is much the same. You will need a tamper-proof screwdriver to remove the screws or possibly an hexagonal bolt remover. Put the screws to one side in a safe place or in a plastic bag so you do not lose them. You will need them again to put it back together.

The above Image (2) illustrates the location of the screws to be removed.

Once the screws have been removed you will be presented with the internal mechanics of the decoder. You should see the tuner and main control board. Depending on the model series of the decoder the layout may be different.

Image (3) - General view of the board once the case is removed

Ditv1000 - Removing the Tuner Once the cover has been removed the next step is to remove the tuner. The first step in removing the tuner can is to gently prise up the tuner can shield with a screwdriver. The shield can be located on top of the tuner can.

Be very gentle with the screwdriver. Image 1 - prise up the tuner can shield

Identify the tuner can then identify the tuner can retaining screw - see image on the left. Unscrew the silver screw holding the tuner in place. This will allow you to easily unplug the tuner device. It should pull out very easily.

Put the screws in a safe place or in another plastic bag so you do not lose them. Carefully unplug the tuner from the side of the tuner can. When pulling out the tuner can be careful not to force it or dislodge anything. You will need to put it all back together again when the final modifications have been made. Image 2 - Tuner Retaining Screw

Next you need to take of the side of the tuner. To do this there is a little twist locking lug. (See Image 3) Carefully twist the locking lug until it allows the tuner to move freely. Use a pair of long-nosed pliers but be careful not to snap the locking lug. Image 3 - Twist the Tuner Twist Locking lug.

Top view of the Tuner can once it has been removed from the case. The images were captured and supplied by buffs

Top View of the inside of the Tuner Can with the Tuner Cover Removed. The images were captured and supplied by buffs

Disabling Talkback

The box sends and receives information from the cable company. This is known as Talkback. To disable some modifications need to be made to the tuner board. This is done after removing the tuner and gently taking off the cover. Cutting the track To disable Talkback you will need to cut a track on the board or you can lift the leg of the component above the track cut. You can use a sharp craft knife to cut the track or a soldering iron to undo the component leg and lift it up. This image shows the track to cut on a Ditv4000 Unit. Alternative to cutting the track is to lift then leg located directly above the track cut. The component is shown here and the legs are the silver bits (ten of them on the lower part of the component). Image 1 - DiTV4000 Track Cut

This image shows the track to cut on a Ditv2000 Unit. Alternative to cutting the track is to lift then leg located directly above the track cut. The component is shown here and the legs are the silver bits (ten of them on the lower part of the component). Image 2- DiTV2000 Track Cut

This image shows the track to cut on a Ditv1000 Unit. Alternative to cutting the track is to lift then leg located directly above the track cut. The component is shown here and the legs are the silver bits (ten of them on the lower part of the component).

Image 3- DiTV1000 Track Cut

This image shows the track to cut on a Ditv1000 Unit. The component leg lift on this model is not clearly identifiable so it is best to adopt the cut-track method. Image 4 - DiTV1010 Track Cut

Once the track is cut or the leg lifted the hardware modifications are almost complete. Double check to make sure you have the track lifted and or the leg lifted. Now it is time to reassemble the tuner

Ditv1000- Reassemble the Decoder Having confirmed and double checked the correct track has been cut or the leg lifted it is time to reassemble the Tuner. This is done in the same way it was taken apart but in reverse order. Use the correct screws you removed and put to one side when taking the tuner out of the box. Replace the Cover With the Talkback cut and the tuner refitted you can now replace the cover and screw it back together using the correct screws you removed and put to one side when unscrewing the cover. The next stage will be to modify the ROM card using a card programmer and Nagra-Edit software. IMPORTANT: DO NOT CONNECT THE BOX UP TO THE MAINS YET! THIS IS ONLY THE FIRST STAGE. ONCE YOU HAVE COMPLETED THE ABOVE MODIFICATIONS YOU NEED TO COMPLETE STAGE TWO.

Ditv1000-Modifying the ROM card Once the modifications have been made to the decoder hardware, the next stage is to modify the ROM card using software and a computer. The procedure for modifying the ROM card depends on the actual ROM card version. Some can be written to whereas others cannot. Different versions also use different software to perform the modifications. For example, ROM 10 uses Nagra-edit whereas ROM 7 uses a software application called Sorryshakes. A ROM 10 can be written whereas a ROM 7 and ROM 11 cannot, so can only be used to obtain the data dumps. An alternative would be to use a Fun Card which can be written to with the data from any ROM card version. These are less prone to "Zapping". Background information on ROM cards and Fun cards Determine which type of card you have using software Making the Modifications to your ROM Card Before you start Things you will Need Getting Started Edit your local area ID Get the box keys Programme the data into the card Configure the decoder

Get the Box Keys Using Libdebug You can use the Libdebug software to get the box-keys. • • • • •

Connect the computer/laptop up to the digital box, using your programmer lead. Once it is connected, load up the libdebug software. Load up the .cfg file (e.g. 'tw.cfg') using the drop down menu if necessary. FILE > OPEN RECIEVER CONFIG, then point it to the file in question. Power on your set top box.

Watch lib debug, you will see it logging data. Once it has finished, if you have your TV hooked up to the computer and decoder, the TV screen will be black and the display on the decoder box will be blank. Click on the following: 1. 'Erase SRAM (U5700)' then click : 2. Execute command, This will clear the ram, in case you need to reset the Pay Per View password. Now click on the following: 1. 'Network ID' and then 'Set Network ID', then click: 2. Execute command. This will set the id to the same as the one you put in the 'tw.cfg'. Obviously this should be your area id number taken from the list of locations and corresponding NetID numbers. Next click on the following: 1. 'Get Network ID', then click: 2. Execute command, in the box on the right It should bring up your network id number. If it does, power down the box.

Close the LibDebug Software Tip: You can also use software called alternative software such as boxget_pc to read the box keys on the card. Once you get the cam id using boxget_pc use windows calculator to convert from decimal to hex and add it as hex.

Getting Box Keys without a ROM Card If you do not have an original ROM card for the box the box keys can be obtained directly from the box. This involves using tools and some careful work with a soldering iron to remove two eeproms so you can read the box key details from them. REMOVING EEPROMS FROM THE BOX: To get the boxkey directly from the box you need to remove two eeproms. These chips are the ATMEL AT49LV1614 type. You would only need to do this if you did not have an original card with the box. You will need a programmer to read the Atmel chips such as the VX VxMulti2 8 Mode Programmer or the VxMulti2 Pro from http://www.vxtools.com To get the boxkey from the ATMEL chips do the following: Make sure you know which chip is which. This is very important so mark one with a bright marker or some nail varnish. Make sure they are clearly labelled. Next you need to read and make a dump of each chip. Imagine you labelled the chips one and two (1 being the front leftmost chip) think of the chip on the left as dump 1 and the chip on the right as dump 2. This will help you remember which chip should have which dump file. Now you have the data it looks like this: DUMP 2 = 100100000 8734 B143 BF21 8270000000000000000A1 DUMP 1 = 100100000 9653 3342 8687 000900000000000000004D You can get the boxkey and ird as follows:

Take the 8734 turn it round so it looks like this 3487 (because the 2 bytes staying together are important). next take the 9653 and switch this around also. you should get 5396. We now have 3487 5396. The whole boxkey and ird are 3487 5396 43B1 4233 21BF 8786. Another Example: Remove & read both chips ATMEL AT49LV1614 Looking at the box from the front name the dumps for left hand chip dump 2 and right hand chip dump 1. For example box Key and IRD are as follows : 1205 5996 and 155B 0F34 FAAB 5D88 Dump 1 right hand chip :1001000005125B15ABFAF8270000000000000000A1 Dump 2 left hand chip :100100009659340F885D000900000000000000004D

Programming the data into the card This stage is done using the nagra-edit software and a card programmer. If you are programming a ROM 10 card you need a card programmer with a 3.68mhz crystal. Step 1 Connect up the card programmer to the laptop/pc. Insert the card and start up the nagraedit software.

Make sure the power is on to the programmer and card is inserted firmly. Press CTRL+R on the keyboard or click on where it says Data editor in the nagraedit menu. Alternatively click the shortcut icon (circled in blue on the image below). Any of these methods will read the contents of the card.

Once the card has been read, make a back-up of the data by using the file tab at the top then selecting save image as. Give it a unique file name and keep it safe. Once the back-up file has been made it is time to edit the card. Step 2 Click in the field where it says IRD status in the open nagra-edit window. This will open the data editor box. The main keys to find are as follows: • BOXKEY (Blue arrow on the image example) • IRD KEY (Orange arrow on the image example) • CAM KEYS (Purple arrows on the image example) Using these keys any bin or card can be fully activated.

Check the IRD status of the card Click on '02 Provider Filter' to check in the IRD status and make some changes if necessary. • If irdstatus reads 80 it means the card has been switched off. • To switch the card back on again change this to the two digits zero zero (00). Click on '08 Standard Tier (31) which may or may not have more than 1 tiers. If it has more than one, start from the top tier. Change the values to the same as the following, leaving everything else the same.

Do this for each tier: IRD Status Byte Rights Identifier Expire date Rights date Min Channel Max Channel

10 00 DB BD 17 00 17 00 00 01 7F FF

Configure the Pay per View (PPV) settings On the far left (above the topmost standard tier (1), you will see a title called 0CSpending Limits (20). Click on this and the right hand side of the screen will change to another set of input fields.

• • •

Change the IRD status byte to 00. This turns on the Pay Per View. Then change the Credit in cash to 00 00 00. Finally change the Debit in Cash to 00 FF FF FF. This will put £65,000 on the viewing card.

Note: Changing these values will increase or decrease the amount of credit on the viewing card. It is likely these values will be targeted by ECM (electronic counter measures) so finding a different set of values would be prudent.

Once all this has been done the data modifications have been finished. It is time to write the modified data back to the ROM card. •

Go to "card" and select from the drop-down menu >write to card.

The software will now write the modified information to the ROM card.

Once the software has finished writing the data to the card remove the ROM card from the programmer. The card modification and writing process is now finished.

Configuring the Engineers menu Accessing the Engineers menu for the digital box. Make sure the power is OFF on the decoder and insert the modified ROM card into the vacant card slot in the digital decoder. To get into engineer menu, make sure the decoder is connected to the T.V. and the card is inserted. Boot Up the Box Take the mains power out of box and when reapplying power hold up and down on the box, and it will enter the engineers menu. Note: up/down is NOT channel up and down.

Press and hold the up and down buttons on the decoder then insert the power lead and switch it on at the mains. The engineers menu should appear on the screen. Let go of the buttons when you come to the installations menu. Set the PIN Number Once in the installations menu, go down to the bottom and set your PIN number to one of your own choosing. Use chan up,down and ok to change the digits, then press tv to store the information. It should change to **** Check the card credit Check to see if you have programmed the card up properly by going to the smart card data page and checking the credit. If it agrees with the amount you coded into the card everything is on schedule. Reset and test the decoder Move through the engineers menu to page 10 and do a soft reset. The box will re-boot. If all is well, once the box has rebooted and reset itself you will have all channels. Test this by trying to view a Pay per View Movie. (You may have to order it first) If it appears on screen the modifications were successful.

Troubleshooting If the box is from an area different from where you live On the engineers menu (page 1) change the frequency to the one required of your area. If you cannot set the password You will need to edit the .cfg file using libdebug to suit your local area ID.

DiTV - Local Area Netid Groups Key TW NTL

Location 7 Kings Ashford Basingstoke (ntl) Bedford Belfast (Ireland) Birmingham Bolton (ntl) Bournemouth Brighton (ntl) Bromley Cheltenham Glos (1) Cheltenham Glos (2) Chesham Bucks Coventry Derby Durby East London Edinburgh/Lothian (TW) Essex NTL Falkirk (TW) Fife (TW) Gateshead Glasgow (ntl) Grimsby (ntl)

Telewest Area NTL Area

NetId 41050 41052 00013 00005 00021 41011 41060 41043 41044 41041 40971 40971 41051 00019 41056 41046 41050 40981 41050 40981 40981 40969 00002 00022

Freq 666.750 803.000 755,000 755.000 643.000 666.750 666.750 666.750 433.000 651.000 666.750 811.000 666.750 666.750

619.000 619.000 571.000 755.000 755.000

High Wycombe Ipswich (ntl) Kidderminster Worcs (TW) Keighley (TW) Leeds Leicester (ntl) Lewisham Liverpool 1 - North (TW) Liverpool 2 - North (TW) Luton Maidstone Kent Manchester 1 (ntl) Manchester M46 (ntl) North Lanarkshire (TW) Norwich Nottingham 1 (ntl) Nottingham 2 (ntl) Peterborough Plymouth (TW) Portsmouth / Cosham (ntl) Solent South Herts Stafford (ntl) Stockport Stoke Surrey Sussex Solent Southampton South Yorkshire Swindon Walsall / West Midlands Warrington Washington Tyne & Wear (ntl) Watford / Herts (ntl) Wearside Wessex West Yorkshire (TW) West Yorkshire (ntl) West London / Middlesex (TW) Wigan

00013 00011 40974 40961 41053 00012 41047 40966 40965 40976 41040 41060 40984 41055 00008 00008 41049 40988 41042 41042 41051 00015 41066 41064 41045 41044 41042 41048 40964 00006 40974 41060 41054 41051 41054 41043 40961 00001 40980 40967

803.000 755.000 130.000 539.000 666.750 643.000 571.000 571.000 739.000

666.750 619.000 755.000 739.000 787.000 666.750

826.250 666.750

666.750 666.750 539.000 579.000 131.000 666.750 666.750

539.000 755.000 539.000 531.000

Wirral Merseyside CH41 Wirral Merseyside CH43 Wolverhampton (ntl) York

41048 41060 40973 41065

666.750 666.750 131.000

Using the CFG Files To use the .cfg file within this document open up the relevant file and copy all of the text below the title (without including the title) to the clipboard. Launch your favourite text editor (e.g. windows notepad) and paste the contents of the clipboard into the new untitled text file. Save the text file with the same filename as the title (e.g. tw.cfg) - remembering to change the drop-down box in the notepad "save as" menu to "all files". Editing the .cfg file with your local area ID Tip: You can get your local area ID from the local area ID table Open up tw.cfg with wordpad. find the lines where it says: :Network ID Set Network ID ntl 406141060 Set Network ID 406141060