570 lines
34 KiB
Plaintext
570 lines
34 KiB
Plaintext
. + .
|
|
_______ ____ ________ ___ _______ _____/|
|
|
+ / __ // \ / ______\ / / / __ // ____!
|
|
/ /_ \// /\ \\ \ ___ / / / /_ \// /___
|
|
/ __/ / / \ \\ \ \ \/ / / __/ \____ \
|
|
\ \__/\\ \ / / \ \/ /\__\___\ \__/\.____/ / '
|
|
* \_____/ \__\/ / \____/ \__/ \_____/| _____/ |
|
|
/__/ . / _ / |/ - --+- -
|
|
USR HST Dual Standard 14400 / / \/ 285 Megs : |
|
|
_____________________ / \ ______________________ .
|
|
. \__ __ _ _ \_/ \_/ _ _ __ __/
|
|
: \___ __ _ _ Sysop: Zaphod Beeblebrox _ _ __ ___/
|
|
| \___ __ _ _ Control Team EHQ _ _ __ ___/
|
|
---+--- - \___________ ICS SHQ ___________/
|
|
| \___ : ___/
|
|
: +46-18-262804 \ | / 24 Hours/Day. '
|
|
. * \ | / .
|
|
.______ _____/ | \___/|___________
|
|
| _ \ / _/ __|__ \__! ______ /
|
|
' | | \ \/ /_\| / /|/_ \/ | | \/
|
|
| | \ \ _/ ' \___' \ | | +
|
|
| | / / \__/\____/ / | |
|
|
!__! /__/\______| _____/ !__!
|
|
|/
|
|
:
|
|
File: CT_CPIR1.TXT (Version 1.00).
|
|
----------------------------------
|
|
|
|
Control Team Scandinavia Brings you: Cable Scrambling Systems - All you wanted
|
|
to know about them, but were afraid to ask the Cable Co. How they work and how
|
|
to defeat their security and get pay-channels for free.
|
|
|
|
Part I: Salora Cable Descramblers SAHT 1006 Type 4256 and SAHT 2000 Type 4270
|
|
=============================================================================
|
|
|
|
The Salora Cable Descrambler is the most common one in Sweden and the other
|
|
Scandinavian countries. It's manufactured by Salora/Luxor, probably either in
|
|
Sweden or Finland. This is probably one of the more advanced descramblers
|
|
currently in use, and the scrambling method is one out of four possible ones
|
|
listed below. The audio signal is always left untouched (At least it appears to
|
|
be that way!!!). This textfile will concentrate on the Mark 1 Saloras, but some
|
|
of this will also be true for the Mark 2's:
|
|
|
|
1. Supressed HSYNC pulses only
|
|
2. Supressed HSYNC pulses and inverted video signal.
|
|
3. Normal Picture, inverted video signal.
|
|
4. A variation of all the above srambling techniques, for example they
|
|
can send every second picture unscrambled and inverted, and then send a
|
|
scrambled picture that is not inverted. Most pirate descramblers are
|
|
not fast enough to detect whether they use this scrambling technique or
|
|
not!!!! This is enough about how they scramble the channels for now,
|
|
let us concentrate on how the descrambler works, and how to defeat it.
|
|
|
|
Hacking Salora Mark 1 Cable Descramblers:
|
|
=========================================
|
|
|
|
First, we start with the standard Mark 1 Salora Cable Descrambler box: It's a
|
|
grey box, about the size of a HST, but about double the height. On the front
|
|
there is five pushbuttons, one for On/Off, Channel Step forward, Channel Step
|
|
Backward and then two switches concerning shifting between your in-memory
|
|
pre-programmed channels and the decoders hyperband channels. On thr right of
|
|
the box you have a key-lock that can lock the hyperband feature of the box, so
|
|
you can only watch the first 20 channels (Those you programmed in the box via
|
|
your remote control). On the back of the box you have the usual RF in and RF
|
|
out for the antenna wires from the cablenet, and then Test Signal and Antenna
|
|
amplifier On/Off. And of course, on the front you also have a few leds
|
|
indicating if you're in hyperband or normal mode, and a two-digit led display
|
|
showing the current channel you're watching (Just the channel number, no fancy
|
|
text or anything...). About opening the box: You're on your own now, most boxes
|
|
that you rent nowadays have some platic seals in the two bottom screw-holes,
|
|
and the cable company tends to get highly pissed-off if they find their seals
|
|
are not in place when you return your rented box. Although, I have looked at
|
|
the contract you sign when you get the box, and it doesn't say anywhere that
|
|
you are not allowed to open it, but in the manual it says the box will stop
|
|
working if you open it, and that you are not allowed to do that. It will *NOT*
|
|
stop working if you open it. I did that to a box we rented a long time ago, and
|
|
it worked when I put it back together, but sad enough that was before I knew
|
|
what to do with cable boxes to get free channels... Yak-Yak!!! But on the seals
|
|
that are right over the first two bottom screws are some kind of tracks that
|
|
could be for a very large screwdrives, one who has almost the same diameter as
|
|
the hole it resides in, so maybe there is a way to remove the seal without
|
|
damaging it. Or, even better, get a descrambler they don't know you have, then
|
|
you can fuck around with it as much as you like.
|
|
|
|
When you have opened the box, start with removing the large daughterboard to
|
|
the left, and put it aside. Do not unplug the leads between the main
|
|
circuitboard and the daughterboard, they will just be alot of trouble getting
|
|
them back in the right places. Now, locate IC13 and IC15, they should be down
|
|
to the left corner of the main PCB. They are very often covered with molten
|
|
glue, which we will have to remove first. Don't worry, just use a knife, but be
|
|
carefull not to damage the CPU or the ID Prom, since they are the only circuits
|
|
in the descrambler you cannot buy at an electronics part store. The CPU is
|
|
custom made for Salora, and the ID prom has to be saved for when you are going
|
|
to return your cable-box. After you have removed all of the molten glue, remove
|
|
the screws that hold the main PCB and remove the main PCB from the box, then
|
|
desolder IC15 and put a 16 pin socket where it was. (Use a good socket, not the
|
|
low-budget ones they sell for .01 cents a piece!!!). Check which pin of IC15
|
|
the circuit trace from Pin 11 of IC13 goes to. This is the data bit of the prom
|
|
containing your ID number that they decided to use on your box. The ID prom is
|
|
normally a 54S287 or N82S129 (256*4 Bits Bipolar PROM, 50 ns). Inside the
|
|
bipolar prom, only one of the four bits available are used. In the first 32 bit
|
|
segment your ID number is stored, and in segment 3 Saloras Service address,
|
|
which is 1024 is always stored. The decoders address is in fact only 20 bits,
|
|
but what's the other 12 bits then?? Well, they there just to make life hard for
|
|
us. For example if you should have ID #042424 it will be $A5B8 and in binary it
|
|
will be %00001010010110111000. This is then shifted right 11 times (Or let us
|
|
for simplicity use a multiplication with 2^11. 42424*(2^11)=86884352, $52DC000,
|
|
and binary %00000101001011011100000000000000. This ID number is then OR:ed with
|
|
the check: %10000000000000000000010001001101 and finally we get the bitstream
|
|
which the decoder CPU will read from the ID Prom. So, now we do know what we
|
|
should encode into the ID prom, now the only problem is where to obtain valid
|
|
decoder id numbers and how to program them onto the bipolar prom... Wait a
|
|
second... Doesn't the sticker on the back of the box look very similar to the
|
|
numbers I read from my ID prom?? Fuckin'A dude... The decoders ID number is
|
|
almost always written on a sticker on the back/under the decoder. There are two
|
|
stickers, one with only 6-8 digits on it, and one with both letters and digits
|
|
on it. You are only interested in the one with digits-only!!! That is the
|
|
number to process with the above method and program into a prom for the
|
|
decoder. Bipolar proms are a bit of a pain to program, so I have included some
|
|
pictures explaining how to use a standard 2764 Eprom (Yeah, I know, it's 10000
|
|
times too big, but it's easier to program one of those, right???), and how to
|
|
build a 32 bit multiplexer circuit; In other words, build your own 32 bit
|
|
eprom, but this one is programmed with 32 DIP switches which you flip low or
|
|
high manually when you need to change ID number on your box. I have tested both
|
|
designs on my own box, and they work very good. However the multiplexer is much
|
|
more complex to build, so I only recommend that one for the serious hardware
|
|
wizards!!! Oh yes, it's usually bit 3 or 4 on the bipolar prom that are used to
|
|
send data to the CPU, that is, pins 10 and 9 on IC15. Switching between the
|
|
normal address and the service address is done by cutting or closing J64 which
|
|
is a jumper between VCC and A6 on IC15. A6 is otherwise grounded via a 220 Ohm
|
|
resistor. (See the diagram over the Salora address pinout. This one was made by
|
|
Lord Canis, and some of the information in this text as well as the original
|
|
Salora Address Creator v2.0 for Pc and comaptibles were also programmed by Lord
|
|
Canis and Electronic Power. I do not know any of them, but I feel that I have
|
|
to credit them for their work, if it hadn't been for them I would never have
|
|
started hacking cable descramblers at all, and this file would never have been
|
|
written!!!! But I felt that I had to write some more-precise descriptions on
|
|
how to hack the Saloras, and how they work, and most important of all: How to
|
|
use other circuits instead of the hard to program bipolar proms. I will also
|
|
include an Atari ST compatible conversion of the Salora Address creator, but
|
|
the ST version will support 8 bit address proms, since using a 2764 eprom will
|
|
give you 8 databits, and that is 8 ID numbers for each address. You'll
|
|
understand what I am talking about if you know anything about memory chips.
|
|
|
|
Have a look at the pictures supplied in this archive for schematics for build
|
|
-ing the 2764 Eprom adaptor and the address creator multiplexer mentioned a
|
|
bit earlier in this text. Anyway, as an example, here's the dump-files from
|
|
a Salora decoder.......
|
|
|
|
|
|
Binary Dump of Salora Decoder Prom #88768 (Old Salora Decoder).
|
|
===============================================================
|
|
|
|
10011111111111111111111111111111
|
|
11111111111111111111111111111111
|
|
10111111111111111111111111111111
|
|
11111000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
10000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
10000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
10000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
10000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
10001010110101100000010001001101 = 88768 = $15AC0
|
|
00000000000000000000000000000000
|
|
10000000001000000000000000000000 = 1024 = $400
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
When you look at this dump, you will recognize that the old Salora decoders
|
|
only have one address burned on the pro except for the service address. The
|
|
original decoder address is always programmed in bit 3 or 4 at the first 32
|
|
bit segment. The service address is always at bit 3 or 4 at the third 32 bit
|
|
The old Salora is the easiest one to hack...... Now we will have a look at
|
|
the rom from a new Salora NT:....Binary ump of Salora NT Decoder Prom #134076 - B228010 (Salora NT).
|
|
====================================================================
|
|
|
|
10011111111111111111111111111111
|
|
10011111111111111111111111111111
|
|
10011111111111111111111111111111
|
|
10011111111111111111111111111111
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
10000000000000000000000000000000
|
|
10000000000000000000000000000000
|
|
10000000000000000000000000000000
|
|
10000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
10011010111101110100110001001101 = 220905 = $35EE9
|
|
00000000000000000000000000000000
|
|
10000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
10000000001000000000010000000000 = 1024 = $400
|
|
00000000000000000000000000000000
|
|
10010000010111011110010001001101 = 134076 = $20BBC
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
00000000000000000000000000000000
|
|
|
|
What can we say about the prom dump of the Salora NT decoder you see above???
|
|
Well, bits 1 and 2 are always the same on all of the Salora NT's I have dumped
|
|
the proms from. And in fact they are not even connected to anything at all if
|
|
you have a look inside the LF0101 VLSI module. Bit 4 contains the service addr
|
|
in the first 32 bit segment, and the actual cable ID in the second 32 bit
|
|
segment. The rest of bit 4 is unused. In bit 3 the first segment appears to
|
|
be connected to the CPU in the VLSI module, as far as I can see, and the first
|
|
32 bit segment is the only part that is in use in bit 3. This might or might
|
|
not be anything important, I am not 100% sure, since I have *NOT* successfully
|
|
hacked one of these new babies.... Either it's a checksum of bit 4 segment 2,
|
|
or it might be a value that is also programmed in the main CPU, to make it
|
|
impossible to replace the ID prom without reading off the checksum from it
|
|
first. That means you have to build yourself a read-device for bipolar proms
|
|
(This is not too hard, but the average lamer would probably end up destroying
|
|
both the decoder and the computer he tried to read the prom with!!!). To
|
|
desolder the prom is out of the question, since it's a surface mounted PLCC
|
|
device, which resides inside the LF0101 VLSI module. To reach the prom, you
|
|
have to open up the VLSI module, and melt a bit of the glue they used to hide
|
|
all of the goodies inside it.... I have successfully hacked one of these new
|
|
decoders now, and to hack it, you do like this: Remove the top black cover of
|
|
LF0101, and you'll see a small black chip beneath the molten glue. Remove all
|
|
of the molten glue around that chip, which is the 74S287 (256*4 Bit PROM), and
|
|
solder wire wrap wires from address pins VCC,GND,A0,A1,A2,A3,A4 to your pirate
|
|
prom. Cut the leg that is marked as D4 between the circuitboard and where it
|
|
enters the 20 pin PLCC module, and connect D4 from the pirate prom to the end
|
|
that is going to the circuitboard. (See picture schematics). First we have the
|
|
pinconfig of both the PLCC 74S287 and the DIL N82S129 chips:
|
|
|
|
V C C V
|
|
C A E E D D D D A 6 N C A
|
|
C 7 1 2 1 2 3 4 5 A C C 7
|
|
| | | | | | | | | | | | |
|
|
----------------- /----------
|
|
| | A4-| |-CE1
|
|
\ N82S129 | A3-| 74S287 |-CE2
|
|
/ | A0-| |-D1
|
|
| | A1-| |-NC
|
|
----------------- A2-| |-D2
|
|
| | | | | | | | -----------
|
|
A A A A A A A G | | | | |
|
|
6 5 4 3 0 1 2 N N G N D D
|
|
D C N C 4 3
|
|
D
|
|
|
|
Legend:
|
|
-------
|
|
|
|
"+" = Wires joined here. The two wires are connected with each other.
|
|
"=" = Wires cross each other here. *NOT* connected in any way at all!!!
|
|
"!" or "-" = This is a wire connecting two points in the circuit.
|
|
|
|
Schematics for connecting pirate PROM in Salora NT "SAHT 2000 Type 4270".
|
|
=========================================================================
|
|
|
|
Note #1: This leg must be cut off in some fashion as close to the body of the
|
|
PLCC chip. The lead from the pirate prom or address creator must be connected
|
|
to the part of the chip leg that goes down to the circuitboard, and *NOT* to
|
|
the end which goes in to the chip's body....
|
|
|
|
+-------------------------------------------+
|
|
| +-+-+----------+ |
|
|
| | | | | |
|
|
| | | | +--=--------------------------=-------+
|
|
| | | | | | | |
|
|
| | | | | | | |
|
|
| | | | | | | |
|
|
| | | | | | | | | | | | | | |
|
|
----------------- | /---------- |
|
|
| | | +---------| |- |
|
|
\ N82S129 | | | +-------| 74S287 |- |
|
|
/ (256*4) | | | | +-----| 256*4 |- |
|
|
| | | | | | +---| |- |
|
|
----------------- | | | | | +-| |- |
|
|
| | | | | | | | | | | | | | ----------- |
|
|
| | | | | | | +--+ | | | | | | | | | | |
|
|
+-+-=-=-=-=-=-+ | | | | | | | |
|
|
| | | | | +------------=-=-=-=-=----+ | |
|
|
| | | | | | | | | | +-------+ <-- See Note #1
|
|
| | | | +--------------=-=-=-=-+
|
|
| | | | | | | |
|
|
| | | +----------------=-=-=-+
|
|
| | | | | |
|
|
| | +------------------=-=-+
|
|
| | | |
|
|
| +--------------------+ |
|
|
| |
|
|
+------------------------+
|
|
|
|
This is how to connect a normal bipolar Signetics N82S129 256*4 Bit bipolar
|
|
prom to one of the new SAHT 2000 Type 4270 decoders. For the older types, just
|
|
plug in the bipolar prom in the spot marked for IC15 in the decoder. They use
|
|
bit 3 or 4 for the descrmabler address, and you can program one address at
|
|
segment 0 and another one at segment 3 of the bit used. To find out which bit
|
|
they use, get an ohm meter and check the connection between Pin 11 of IC13 and
|
|
pins 9 (Bit 4) and 10 (Bit 3) of IC15. The one that reads close to 0 ohms is
|
|
the one in use. If you do not have access to the equipment needed for prog-
|
|
-ramming bipolar memory devices, use the schematics below, which describes how
|
|
to use a standard 2764 eprom instead of a bipolar memory. The eprom thing has
|
|
been tested and works fine in the old SAHT 1006 - 4256 decoders, but I have
|
|
not at todays date tested it on the new SAHT 2000 - 4270 modells...
|
|
|
|
|
|
Pinconfig of the 2764 Eprom Chip:
|
|
=================================
|
|
|
|
V P A A
|
|
C G N A A 1 O 1 C D D D D D
|
|
C M C 8 9 1 E 0 E 7 6 5 4 3
|
|
| | | | | | | | | | | | | |
|
|
-----------------------------
|
|
| |
|
|
| |
|
|
\ 2764 EPROM CHIP |
|
|
/ |
|
|
| |
|
|
| |
|
|
-----------------------------
|
|
| | | | | | | | | | | | | |
|
|
V A A A A A A A A A D D D G
|
|
P 1 7 6 5 4 3 2 1 0 0 1 2 N
|
|
P 2 D
|
|
|
|
How to Connect the 2764 Eprom Chip instead of the bipolar prom chip:
|
|
====================================================================
|
|
|
|
+------------------------------------+
|
|
| +-----------------------------+ |
|
|
| | +--=--=-+-------------------+
|
|
| | | | | | |
|
|
+---+-+ | | | | | |
|
|
| | | +-+-+-+-+-+-+ | | | +-+-+ +---+ |
|
|
| | | | | | | | | | | | | | | | | | |
|
|
| | | | | | | | | | | | | | | | | | | | | | | | | | |
|
|
| ----------------------------- | | ----------------- | |
|
|
| | | | | | | | |
|
|
| | | | | \ N82S129 | | |
|
|
| \ 2764 EPROM CHIP | | | / (256*4) | | |
|
|
| / | | | | | | |
|
|
| | | | | ----------------- | |
|
|
| | | | | | | | | | | | | | |
|
|
| ----------------------------- | | | | | | | | | | | |
|
|
| | | | | | | | | | | | | | | +--=--=-+ | | | | | +---=---+
|
|
| | +-+-+ | | | | | | | | | | | | | | | | |
|
|
+---+ | | | | | | | | | | | | | | | | | |
|
|
| | | | | | | | +-------+--=-=-=-=-=-=-=-+ |
|
|
| | | | | | | | | | | | | | | |
|
|
| | | | | | | +-----=----------=---=-=-=-=-=-----+
|
|
| | | | | | | | | | | | | |
|
|
| | | | +-=-=-------=----------=---=-=-=-=-+
|
|
| | | | | | | | | | | |
|
|
| | | | +-=-------=----------=---=-=-=-+
|
|
| | | | | | | | | |
|
|
| | | | +-------=----------=---=-=-+
|
|
| | | | | | | |
|
|
| | | +-------------=----------=---=-+
|
|
| | | | | |
|
|
| | +---------------=----------=---+
|
|
| | | |
|
|
+-----=-----------------+ |
|
|
| |
|
|
+----------------------------+
|
|
|
|
Do remember that the decoder ID's are stored binary in the prom, but they are
|
|
stored serially; one bit at each address. Since a 2764 is 8 bits wide, you can
|
|
store 8 decoder ID's at segment 1 and another 8 at segment 3. (With the prom
|
|
hooked up like this, segment 3 really is segment 2 of the 2764...). You choose
|
|
which segment you wanna use with jumper J64 on the old Salora SAHT 1006 - 4256
|
|
and jumper Q201 on the new Salora SAHT 2000 - 4270's....
|
|
|
|
|
|
Salora Decoder 32 Bit Address Multiplexer - Construction Plans:
|
|
===============================================================
|
|
|
|
The idea behind the 32 Bit address multiplexer for the Salora decoders is
|
|
quite easy and straightforward. I use two 74150 1-of-16 multiplexers, whose
|
|
outputs are fed into one 74LS157 1-of-2 multiplexer. Then, the highest address
|
|
bit selects which of the two 16 bit multiplexors that the bit should be read
|
|
from. If this sounds complicated to you, do not worry, it is!!! Just follow
|
|
my plans and everything will be just fine. The idea is to set the address by
|
|
using four 8 bit hex switches connected to the two 16 bit multiplexers. So
|
|
multiplexer #1 will deliver the high 16 bits, and multiplexer #2 the low 16
|
|
bits. Just look at the schematic below..... For the construction of the
|
|
multiplexer you will require:
|
|
|
|
* Two 74150 (1-of-16 multiplexer)
|
|
* One 74LS157 (1-of-2 multiplexer)
|
|
* Four 8 bit hex switches (You know, DIL packagem switches)
|
|
* Four 10kOhm*8 Resistorpacks
|
|
* Two 24 Pin Sockets
|
|
* One 16 Pin Socket
|
|
* One Piece of Experiment Circuitboard
|
|
* One 16 Pin thingy to connect the Circuitboard to the socket on the
|
|
circuitboard inside the Salora decoder.
|
|
|
|
Now for the construction plans. We'll start out with the pin configurations of
|
|
the 74150 and the 74LS157:
|
|
|
|
O O
|
|
V _ U U
|
|
C C 4 4 T 3 3 T
|
|
C E A B 4 A B 3
|
|
| | | | | | | |
|
|
-----------------
|
|
| |
|
|
\ 74LS157 |
|
|
/ |
|
|
| |
|
|
-----------------
|
|
| | | | | | | |
|
|
S 1 1 O 2 2 O G
|
|
E A B U A B U N
|
|
L T T D
|
|
1 2
|
|
|
|
|
|
V " " "
|
|
C 1 1 1 1 1 1 1 2 4
|
|
C 8 9 0 1 2 3 4 5 " " "
|
|
| | | | | | | | | | | |
|
|
-------------------------
|
|
| |
|
|
| |
|
|
\ 74150 |
|
|
/ |
|
|
| |
|
|
| |
|
|
-------------------------
|
|
| | | | | | | | | | | |
|
|
7 6 5 4 3 2 1 0 _ O " G
|
|
C U 8 N
|
|
E T " D
|
|
|
|
This was the pinconfigurations of the two IC's involved in this project. Now
|
|
onto the actual construction of it... NOTE: If you are gound to make a version
|
|
that fits directly in the socket of the Saloras ID prom holder, make sure you
|
|
check for how much space you have in the decoder to put this little gizmo on
|
|
before you build it. I have tried it, and it works fine, but I carefully
|
|
designed mine to fit in the space I know is available......
|
|
|
|
VCC GND
|
|
* *
|
|
| |
|
|
+--------------------=----------------+
|
|
| | |
|
|
| Bits 8-15 | | Bits 16-31
|
|
| | |
|
|
| +-+-+-+-+-+-+-+----------------=--+-------+-+-+-+-+-+-+-+
|
|
| | | | | | | | | | | | | | | | | | |
|
|
| ----------------- | | -----------------
|
|
| |# # # # # # # #| | | |# # # # # # # #|
|
|
| ----------------- | | -----------------
|
|
| | | | | | | | | | | | | | | | | | |
|
|
| ------------------ | | -----------------
|
|
| % 10kOhm*8 Pack % +----------+ | | % 10kOhm*8 Pack % +----------+
|
|
| ------------------ | +------+ | | | ----------------- | +------+ |
|
|
| | | | | | | | | | | | +--+ | | | | | | | | | | | | | | | +--+ | |
|
|
+----+ | | | | | | | | | | | | | | +--=-+---+ | | | | | | | | | | | | | |
|
|
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
|
| ------------------------- | | | | | ------------------------- | | |
|
|
| | | | | | | | | | | | |
|
|
| | | | | | | | | | | | |
|
|
| \ 74150 | | | | | | \ 74150 | | | |
|
|
| / Multiplexer #1 | | | | | | / Multiplexer #2 | | | |
|
|
| | | | | | | | | | | | |
|
|
| | | | | | | | | | | | |
|
|
| ------------------------- | | | | | ------------------------- | | |
|
|
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
|
+--+ | | | | | | | | | | | | | | | | +-+ | | | | | | | | | | | | | | |
|
|
| | | | | | | | | | | | | +--=-=-=------+ | | | | | | | | | | | | | | | |
|
|
| ----------------- | | | | | | | | ----------------- | | | | | | |
|
|
| % 10kOhm*8 Pack % +-=-=-+ | | | | % 10kOhm*8 Pack % +-=-=-+ | | |
|
|
| ----------------- | | | | | | ----------------- | | | | | |
|
|
| | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
|
| ----------------- | | | | | | ----------------- | | | | | |
|
|
| |# # # # # # # #| | | | | | | |# # # # # # # #| | | | | | |
|
|
| ----------------- | | | | | | ----------------- | | | | | |
|
|
| | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
|
| | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
|
| +-+-+-+-+-+-+-+-+-=-=----=-=-=------+-----+-+-+-+-+-+-+-+-+-=-=-+ | | |
|
|
| | | | | | | | | | |
|
|
| | | +-=-=------------------------+-----=-=----+ | |
|
|
| | | | | | | | | |
|
|
+-------------------+ | | +-=---------------------+--=-----=-=------+ |
|
|
| | | | | | | | | |
|
|
| +--------------+--=--=-+ +------------------+--=--=-----=-=--------+
|
|
| | | | | | | | | | |
|
|
| | | | | +---------------------------=--=--=-----=-+
|
|
| | | | | | | | |
|
|
| | | | | | | | | | | +---------------------------=--=--=--+--+
|
|
----------------- | | | | | | | |
|
|
| | +--=--=-=-------------+----------+ | | | |
|
|
\ 74LS157 | | | | | | BITS! | | | | |
|
|
/ | | | | | | / | | \ | | | | |
|
|
| | | +--=-=-------+ +-+ * * * * | | | | |
|
|
----------------- | | | | | | | | | | | | | | | |
|
|
| | | | | | | | | | | ----------------- | | | | |
|
|
| | | | +--+ | | | 1 2 3 4| | | | | |
|
|
| | +-=----------------+ | \ EPROM | | | | | |
|
|
| | | | / SOCKET | | | | | |
|
|
| +---=------------------+ | | | | | | |
|
|
| | ----------------- | | | | |
|
|
| * | | | | | | | | | | | | |
|
|
| BIT | | | | | +--+ | | | |
|
|
+------------------------------------+ | | | | | | | |
|
|
| | | +-------+ | | |
|
|
| | | | | |
|
|
| | +------------+ | |
|
|
| | | |
|
|
| +-----------------+ |
|
|
| |
|
|
+----------------------+
|
|
|
|
|
|
Connect a jumper-wire between the BIT output and *ONE* of the BIT inputs, dep-
|
|
ending on which of the four bits that is used in you descrambler, check by
|
|
looking at IC13 and see where the circuitboard trace from PIN 11 goes. Should
|
|
be pin 9 or 10 (Bit 4 or Bit 3) of the PROM. Solder a socket in the place of
|
|
the prom, build the address creator according to the ASCII picture above, and
|
|
set the switches to a working decoder ID number and there you have it working
|
|
fine!!! Good luck to all ye cable pirates!!!!!!
|
|
|
|
Zaphod Beeblebrox of ICS and Control Team Scandinavia.
|
|
This has been a Beeblebrox Industries Unlimited Production '93.
|
|
|
|
P.S: This is only for information purposes, and if *YOU* screw with a cable
|
|
descrambler which you have rented from the cable company, it's entirely your
|
|
own problem, I accept no reponsibility for your actions. Also, this is only
|
|
for the advanced hardware wizards, I will not answer any questions about this,
|
|
if you don't know what this is about, you don't need to know!!!!
|
|
I have not yet written the Salora address calculator for the ST, so you'll
|
|
have to make do with the Pc version written by Electronic Power & Lord Canis.
|
|
It can be run from Pc Ditto for those of you who has got that program.
|
|
I will not release any beta versions of the ST version until I have tested
|
|
it a bit more.... So go out and hack the shit out of them decoders d00dez!!
|
|
D.S
|
|
|