383 lines
18 KiB
Plaintext
383 lines
18 KiB
Plaintext
|
|
How to connect a PC to a Videocrypt decoder
|
|
-------------------------------------------
|
|
|
|
Markus Kuhn -- 1994-06-19
|
|
|
|
|
|
The easiest way to connect your PC to a Videocrypt pay-TV decoder is to
|
|
use the card slot as an interface and connect it with a voltage
|
|
converter (MAX232) and a TTL open collector driver (74LS07) to the
|
|
RS-232 serial port. This way, you don't even have to open the decoder
|
|
and the PC can now act as a smart card.
|
|
|
|
WARNING: In order to build the adapter described below, you will at
|
|
least require some basic hobby electronics experience. If
|
|
you don't understand, how the described circuitry works,
|
|
better don't use it! Although the described procedure is
|
|
relatively secure, serious errors might in the worst case
|
|
damage both your PC and your TV system.
|
|
|
|
The chip cards used by the Videocrypt pay-TV system follow exactly the
|
|
specification ISO 7816 (you might find this international standard in a
|
|
good library, if you are interested in more details). Also, the
|
|
protocol is the "asynchronous half duplex T=0 protocol" with "active
|
|
low reset" and "inverse convention" as defined in this standard. The
|
|
following description may also be used in order to connect computers to
|
|
other ISO 7816 compatible chip card systems (e.g. GSM mobile phones or
|
|
other pay-TV decoding systems) if they also use asynchronous
|
|
transmission. For smart card systems which use synchronous transmission
|
|
(e.g. most phone cards) the interface described here will need some
|
|
modifications.
|
|
|
|
According to ISO, a chip card is 85.60 mm long, 53.98 mm high, 0.76 mm
|
|
thick and the edges are rounded with a radius of 3.18 mm. It has eight
|
|
defined contact areas (C1 - C8 in the diagram below), each of which is
|
|
at least 2 mm wide and 1.7 mm heigh:
|
|
|
|
|
|
______________________________________
|
|
/ \
|
|
| |
|
|
| |
|
|
| C1 C5 |
|
|
| C2 C6 |
|
|
| C3 C7 |
|
|
| C4 C8 |
|
|
| |
|
|
| |
|
|
| |
|
|
\________________________________________/
|
|
|
|
|
|
|
|
These contacts have the following purpose:
|
|
|
|
|
|
C1 VCC Supply voltage (+5 V, max. 200 mA)
|
|
C2 RST Reset signal
|
|
C3 CLK Clock signal
|
|
C4 - reserved
|
|
C5 GND Ground
|
|
C6 VPP Programming voltage (5-25 V)
|
|
C7 I/O Data input/output
|
|
C8 - reserved
|
|
|
|
|
|
The following table gives the precise location of the contact areas.
|
|
These areas are only minimum areas, the actual contacts might be larger
|
|
but must of course be properly isolated from each other.
|
|
|
|
In the following table,
|
|
|
|
A represents the maximum distance between the card's left
|
|
edge and the contact area's left edge,
|
|
B represents the minimum distance between the card's left
|
|
edge and the contact area's right edge,
|
|
C represents the maximum distance between the card's top
|
|
edge and the contact area's upper edge,
|
|
D represents the minimum distance between the card's top
|
|
edge and the contact area's lower edge.
|
|
|
|
|
|
A B C D
|
|
-----------------------------------------
|
|
C1 10.25 12.25 19.23 20.93
|
|
C2 10.25 12.25 21.77 23.47
|
|
C3 10.25 12.25 24.31 26.01
|
|
C4 10.25 12.25 26.85 28.55
|
|
C5 17.87 19.87 19.23 20.93
|
|
C6 17.87 19.87 21.77 23.47
|
|
C7 17.87 19.87 24.31 26.01
|
|
C8 17.87 19.87 26.85 28.55
|
|
|
|
|
|
Older card systems (defined in a French AFNOR standard) had these
|
|
contacts located higher (distance from the top between 9.07 mm and
|
|
18.39 mm, distance from the left identical). As some decoders support
|
|
both contact area alternatives, make sure that this old contact area is
|
|
properly isolated or you'll produce a short circuit when inserting your
|
|
card. You may have noticed, that the contacts are arranged in the usual
|
|
1/10 inch (= 2.54 mm) system (i.e. like the pins of a 8-pin DIL chip).
|
|
|
|
You can produce your card adapter by making a PCB with contact areas at
|
|
the above listed locations. The PCB must have precisely the thickness
|
|
and width of a real card, but it may be longer, so that you can locate
|
|
the interface electronics on the part which remains outside the slot.
|
|
Cards are inserted in most decoders with the contacts on the bottom
|
|
side. Normal PCBs are about 1.3 mm think and won't fit into the slot.
|
|
Either you get a PCB which is about 0.8 mm thick or you make it
|
|
thinner, e.g. by using a sander machine. Perhaps you find also ready to
|
|
use test cards with connectors instead of producing your own or you
|
|
simply open the decoder, clamp contacts to the resistors near the card
|
|
slot and insert a normal plastic card in order to activate the
|
|
card-presence switch (this is NOT recommended: there are unisolated 230
|
|
V parts inside the decoder and they could kill you if you are not very
|
|
carefull!!!).
|
|
|
|
The adapter will only need the card contacts I/O, GND, RST and VCC. On
|
|
the RS-232 side, the following contacts will be used:
|
|
|
|
Sub-D 25-pin Sub-D 9-pin
|
|
---------------------------------------------------------
|
|
TxD 2 3 transmit data
|
|
RxD 3 2 receive data
|
|
RTS 4 7 request to send
|
|
CTS 5 8 clear to send
|
|
DSR 6 6 data set ready
|
|
GND 7 5 ground
|
|
DCD 8 1 carrier detect (here: reset)
|
|
DTR 20 4 data terminal ready
|
|
|
|
|
|
The pins DTR, DSR and CTS are not actually needed, they are just
|
|
connected together in the adapter, so that defined levels are available
|
|
on them because some software might need this. RTS is connected to an
|
|
unused MAX232 input and the corresponding TTL output might be used for
|
|
generating the reset signal if the adapter is used for connecting a PC
|
|
to a card instead of an decoder.
|
|
|
|
The following components are necessary for the adapter
|
|
|
|
1 x 0.5-0.8 mm PCB single sided or test card
|
|
1 x IC Maxim MAX232CPE (or Linear Technology LT1081CN)
|
|
1 x IC 74LS07 (or 7407)
|
|
5 x capacitors 1 uF (or higher), 16 V
|
|
1 x female Sub-D connector (9 or 25-pin)
|
|
1 x card slot (optional)
|
|
|
|
These components cost together less than 20 DM.
|
|
|
|
The MAX232 converts the RS-232 levels (about +10 and -10 V) to TTL
|
|
voltage (0 and +5 V) and vice versa without requiring anything else
|
|
than +5 V power supply. This chip contains two TTL->RS-232 and two
|
|
RS-232->TTL drivers and needs four external 1 uF capacitors in order
|
|
to generate the RS-232 voltage internally. The adapter electronic gets
|
|
its power supply from the decoder's VCC line or you can use an external
|
|
5 V supply if you wish.
|
|
|
|
The card slot's RST line is connected using one of the TTL->RS-232
|
|
drivers in the MAX232 to DCD, so that the software and the decoder can
|
|
easily resynchronize in case of a protocol error.
|
|
|
|
The I/O line is a bidirectional half-duplex asynchronous TTL level
|
|
serial port that is operated in a Videocrypt system with 9600 bits/s.
|
|
We can connect this line to a MAX232 TTL input driver (which is
|
|
connected to RxD and sends bytes to the PC) in order to receive data
|
|
from the decoder. The TxD signal is converted in the MAX232 to TTL
|
|
level and is connected with an open collector TTL driver to I/O. This
|
|
open collector driver (one of six in the 74LS07) has a high impedance
|
|
output during idle state and 1 and is connected to GND during a 0 on
|
|
it's input. As there is already a pull-up resistor to +5 V on I/O in
|
|
the decoder, this circuitry guarantees, that the adapter is in high
|
|
impedance state if the TxD line is idle and delivers the correct
|
|
voltage if the PC sends bytes and the decoder is in reception mode. As
|
|
we don't connect totem-pole or tristate outputs to I/O, a short circuit
|
|
should be impossible in the adapter.
|
|
|
|
The following diagram describes the whole interface:
|
|
|
|
|
|
+-------------+ +
|
|
+-----------|1 V 16|---+---o +5V (VCC)
|
|
+| +| | ===
|
|
=== +5V o-||-|2 MAX232 15|---+---o GND (card & RS-232)
|
|
| | |
|
|
+-----------|3 +---14|----o DCD +-<-o DTR
|
|
+ | | | |
|
|
+---||---|4 | +-13|----o RTS +->-o DSR
|
|
| | | v | |
|
|
+--------|5 | +-12|- (unused TTL output) +->-o CTS
|
|
+ | | |
|
|
GND o-||-|6 +-<-11|----o RST
|
|
| |
|
|
RxD o----|7 ---<--- 10|-------------------+----o I/O
|
|
| | |\ |
|
|
TxD o----|8 --->--- 9|--------------| |--+
|
|
+-------------+ 1|/ 2
|
|
74LS07
|
|
At the MAX232, pin 2 delivers
|
|
+10 V and pin 6 delivers -10 V. (also connected to 74LS07:
|
|
pin 7=GND, pin 14=VCC)
|
|
|
|
|
|
Pay attention to the polarity of the capacitors (marked with a + in the
|
|
diagram next to each capacitor)! The -->-- symbols in the AX232
|
|
diagram above indicate the voltage converters inside the chip. You
|
|
might want to add an LED and a resistor (between 220 and 1k ohm)
|
|
between VCC and GND so that you can see when the decoder activates the
|
|
interface. If you can't live without blinking bits, then add a LED and
|
|
a resistor from VCC to I/O. The capacitor between VCC and GND is not
|
|
absolutely necessary, but recommended especially if you add other
|
|
circuitry on the board (e.g. the quartz oscillator described below).
|
|
|
|
As a side effect of this simple interface design, every byte sent by
|
|
the PC is at the same time also received by the PC. Consequently, you
|
|
can test the circuit with a terminal emulator and external +5 V supply
|
|
by switching of local echo: if you still see every typed character
|
|
immediately on the screen, the interface should be all right. Software
|
|
must be capable of dealing with this echo from the interface. As
|
|
specified in the ISO standard, the decoder activates VCC only shortly
|
|
before a reset and deactivates VCC again if an answer-to-reset packet
|
|
isn't received from the card in time after the reset signal.
|
|
|
|
A few additional hints:
|
|
|
|
If you have a larger distance between the PC an the decoder, then
|
|
locate the adapter electronic near the decoder, because the RS-232
|
|
interface is much more suitable for long cables than the TTL signals.
|
|
Cables of 12 m length have sucessfully been used and you shouldn't have
|
|
problems with RS-232 cables up to 25 m length and more.
|
|
|
|
You can also use this adapter circuit to allow a PC to listen to the
|
|
data traffic between a decoder and a real card. Just connect the real
|
|
card and the adapter parallel to the decoder and don't let the PC
|
|
software transmit anything. Suitable card slots are available for
|
|
little money from various manufacturers (see below for addresses).
|
|
Videocrypt uses the inverse convention data format, i.e., you have to
|
|
reverse and invert the bits in each byte in the PC software in order to
|
|
get the correct byte value. For more details about the protocol, check
|
|
ISO 7816-3.
|
|
|
|
There are many alternative ways to build this interface if you don't
|
|
have some of the components available. E.g. the MAX232 could be
|
|
replaced by the fully compatible LT1081 from Linear Technology. The
|
|
circuit still works fine if you use higher capacitors than 1 uF (e.g.
|
|
my prototype worked fine with 4 22 uF types which were left from a
|
|
previous project), but use equally sized capacitors. If you use the pin
|
|
compatible MAX220 (a low power version) instead of the MAX232, then use
|
|
capacitors with 10 uF or higher. The MAX232 should be the easiest
|
|
available one of these chips. If it is more convenient for your layout,
|
|
then you can use instead of the 1->2 driver in the 74LS07 one of the
|
|
remaining 5 drivers at the pins 3->4, 5->6, 9->8, 11->10 and 13->12. If
|
|
your local electronic store doesn't have a 74LS07 or 7407, then use
|
|
e.g. two of the six open collector inverters in a 74LS05 (same pin
|
|
assignment as the 74LS07) in series and a 2.2k pull-up resistor to VCC
|
|
between them. Peoples have also suggested quick-and-dirty designs where
|
|
the 74LS07 open-collector driver is replaced by a 100 ohm resistor and
|
|
the MAX232 by a CMOS inverter.
|
|
|
|
If you don't have the experience to etch your own PCB (it's not very
|
|
difficult) or don't know someone who does, then you could solder the
|
|
components in a universal raster PCB or plug them into an experimental
|
|
board. Then produce just a simple PCB with only the ISO card contacts
|
|
and connections to outside the decoder by mechanically removing the
|
|
thin copper layer with a good knive between the 4 contacts and lines.
|
|
|
|
Peoples have also suggested to use an empty German phone card, which
|
|
also has ISO contacts. Remove the integrated chip from the other
|
|
non-contact side, test whether the contacts are now isolated from each
|
|
other and use a special conductive ink you'll find in an electronics
|
|
store in order to draw connections to the end of the card were you
|
|
connect wires. I haven't tested this and don't know how well it works,
|
|
but you might also consider it. If you ask dealers who sell Videocrypt
|
|
clone cards, you might also get a suitable PCB with card contacts for
|
|
little money.
|
|
|
|
You can use the same circuit with a few modifications in order to
|
|
connect a PC to a smart card. This allows you to use the PC in order to
|
|
emulate a decoder from the card's point of view.
|
|
|
|
Just connect the card's RST input to pin 12 of the MAX232 so that you
|
|
can control the RST line with the RS-232 RTS signal. Add a 20k pull-
|
|
upresistor from the card's I/O line to VCC. In addition, you'll have to
|
|
generate a 3.57 MHz CLK signal for the card. If you use other
|
|
frequencies, remember that the time for one protocol bit is 372 CLK
|
|
periods and you'll have to adjust the bits/sec rate. Either you'll find
|
|
a complete 3.5 or 3.579545 MHz quartz oscillator which delivers a TTL
|
|
signal or you build one like the following circuit using a 3.579545 MHz
|
|
quartz (easily available, because each NTSC TV set contains one) and 2
|
|
of the 6 CMOS inverters in a 74HC04. I've also tried a 74HCT04 and a
|
|
4069, but they both are less suitable. And of course you'll need an
|
|
external regulated +5 V power supply (a decoder will give you only VCC
|
|
and CLK while it is talking to a card). In order to protect both the
|
|
card and the adapter, it might be a good idea to put a 10 ohm resistor
|
|
in all lines to the card (and perhaps even protection diodes to VCC and
|
|
GND). If you don't already have a VCC/GND capacitor near the 74HC04,
|
|
then add 0.1 uF between VCC and GND.
|
|
|
|
|
|
1M 2.2k 3|\4 10
|
|
+-/\/\/--+----/\/\/-----+--| o-----+-----/\/\/---o CLK
|
|
| |2 | |/ |
|
|
| -o- | |100 pF
|
|
| /_____\ | ===
|
|
| |1 | |
|
|
| | 3.579545 MHz | |
|
|
| | +--+ | - (also connect to 74HC04:
|
|
+--------+---| | | |---+ GND pin 5,7,9,11,13=GND,
|
|
| +--+ | pin 14=VCC=+5 V)
|
|
|27pF |27pF
|
|
=== ===
|
|
| |
|
|
- -
|
|
GND GND
|
|
|
|
You can easily build a universal device that can be operated in two
|
|
modes by changing the position of two jumpers:
|
|
|
|
a) In the first mode, you have a PC<->decoder adapter. The PCB is plugged
|
|
into the card slot of a decoder, and either you let the PC talk
|
|
to the decoder or you put a card into the additional slot on your
|
|
device and use the PC in order to listen to the traffic between
|
|
card and decoder. Use the jumpers in order to connect pins CLK and
|
|
RST of your card slot to those of the decoder.
|
|
|
|
b) In the second mode of operation, you have a PC<->card adapter. The
|
|
device is not connected with the decoder and you have to attach a
|
|
+5 V power supply. The jumpers are switched, so that your card slot
|
|
has its CLK pin connected to the output of the above quartz oscillator
|
|
and the RST pin to pin 12 of the MAX232. As in this mode the PCB
|
|
isn't plugged into the decoder, it is convenient to have tiny
|
|
feets attached to the PCB so that you can put it on a table.
|
|
|
|
Now you've built a cheap and flexible debugging tool for all ISO 7816
|
|
compatible smart card systems that use an asynchronous protocol. Other
|
|
ideas are to add a chip socket for a microcontroller (e.g. a PIC16C84
|
|
from Microchip or a 8032+EPROM from Intel) parallel to the additional
|
|
card slot and to add pins where you can easily connect an oscilloscope.
|
|
This allows you to debug card software for microcontrollers easily.
|
|
Feel free to produce and sell such a device, but if you do it
|
|
commercially, please be nice and don't forget to send me a free one,
|
|
too. :-)
|
|
|
|
ISO 7816 chip card connectors are e.g. available from:
|
|
|
|
Amphenol-Tuchel Electronics GmbH
|
|
August-Haeusser-Str. 10
|
|
D-74080 Heilbronn
|
|
Germany
|
|
|
|
phone +49 7131 486-0
|
|
fax +49 7131 486-323
|
|
|
|
A few final remarks about the security of the adapter:
|
|
|
|
Normally, both the RS-232 interface and the decoder slot should not be
|
|
harmed by short circuits, but be careful. Also try to avoid
|
|
electrostatic voltage (e.g. generated by walking on a suitable carpet)
|
|
near the interface, because discharges cause easily decoder or PC
|
|
crashes and could theoretically even harm the hardware (especially CMOS
|
|
chips like the 74HC04). Before connecting the decoder and the PC the
|
|
first time, you might want to check the voltage between the two GND
|
|
lines. In correct installations, the difference of the GND potentials
|
|
is very low (below 1 V), but someone has reported up to 50 V (high
|
|
impedance only). Most TV sets, VCRs, SAT receivers and decoders are not
|
|
connected with the earth line, so their GND potential is floating or
|
|
sometimes only defined by e.g. the shielding of the antenna cable. If
|
|
your antenna system is not correctly installed, the shield might also
|
|
not be grounded. One quick solution might be to switch off all
|
|
components and then connect first the RS-232 GND line to e.g. the GND
|
|
in the SCART connector or the GND at an audio connector of your decoder
|
|
before connecting anything else. You might also design the ISO contacts
|
|
on the PCB so that GND touches all pins at first when the PCB is
|
|
inserted in the card slot. The only really secure protection between
|
|
your PC and your decoder would be to use an isolating RS-232 driver
|
|
(e.g. you might want to check data sheets of Maxim's MAX250/251/252
|
|
chips which offer RS-232 protection up to 1500 V), but under normal
|
|
circumstances you won't need this.
|
|
|
|
Use this circuit at your own risk and please don't blame me if anything
|
|
doesn't work or produces only smoke and noise. Good luck ... ;-)
|
|
|