393 lines
17 KiB
Plaintext
393 lines
17 KiB
Plaintext
------------------------------------------------
|
||
VOYAGER -- MS-DOS Videocrypt smart card emulator
|
||
------------------------------------------------
|
||
|
||
INTRODUCTION
|
||
------------
|
||
Voyager is named after the new StarTrek 'Voyager' series.
|
||
Most of the information about the videocrypt protocol is found in
|
||
details.txt written by Markus Kuhn.
|
||
This new file (VOYAGER.DOC) is a container for additional information
|
||
about the videocrypt system (cards series 09, 0a and further) and
|
||
also some additional information about the eurocrypt system.
|
||
|
||
The archive file contains the voyager.exe program, which is compatible
|
||
with season programs.
|
||
Voyager currently emulates a BskyB 07/09-series smartcard, The Adult-Channel
|
||
smartcard, Eurotica smartcard, RedHot smartcard and EuroCrypt smartcards
|
||
with all ECM's until release date included.
|
||
|
||
ATTENTION
|
||
---------
|
||
We are now using two version numbers (1.3i) that is Voyager/Season71 release,
|
||
and Key release (1.1) that will be used to know if Eurocrypt keys had been
|
||
updated.
|
||
|
||
Channel list: (VIDEOCRYPT 1)
|
||
-------------
|
||
The Children's Channel, The Family Channel, The Discovery Channel,
|
||
The Learning Channel, Sky Sports, Sky Sports 2, Sky Soap, U.K. Gold,
|
||
Sky Travel, Bravo, Nickelodeon, U.K. Living, Sky One, Sky Movies,
|
||
The Movie Channel, Sky Movies Gold, VH-1, CMT Europe, MTV Europe,
|
||
Disney Channel, Racing Channel, Playboy Channel, EBN,
|
||
Zee TV (TV Asia), TVX The fantasy channel, The Adult Channel and TV Eurotica.
|
||
Currently only The Adult Channel and TV Eurotica are decrypted.
|
||
|
||
Channel list: (EUROCRYPT M)
|
||
-------------
|
||
Filmnet 1, Filmnet 2, TV1000, TV1000 Cinema, TV3 Norway, TV3 Sweden,
|
||
TV3 Denmark, MTV Nordic, CNN Nordic, Eurosport Nordic,
|
||
Discovery Nordic, Children Channel Nordic, BBC Prime, Canal+ 16/9,
|
||
Cin‚Cin‚ma 16/9 and TV Plus.
|
||
Please mail us infos and any Eurocrypt key that you could get. Thanks !
|
||
|
||
Channel list: (EUROCRYPT S)
|
||
-------------
|
||
Not yet implemented. Eurocrypt-S will be on the next voyager release.
|
||
Please mail us infos and any Eurocrypt key that you could get. Thanks !
|
||
|
||
|
||
D2Mac CARD
|
||
----------
|
||
This version is supporting both Eurocrypt and Videocrypt.
|
||
Selection is done automaticaly. Various keys are implemented.
|
||
|
||
SKY 0A CARD
|
||
-----------
|
||
Sky has send out some new cards, decoem say it's card issue 10.
|
||
Read commands for the 09 are failing.
|
||
|
||
LAST D2MAC Key changes
|
||
----------------------
|
||
21-12-95 TV3 Sweden switched back to key 0a
|
||
20-12-95 TV3 Denmark switched back to key 0a
|
||
06-12-95 TV3 Sweden/Denmark changed to key 0b
|
||
04-12-95 TV3 Norway changed to key 0b
|
||
24-09-95 Filmnet and TV1000 changed keys
|
||
28-04-95 TV3 changed the key
|
||
01-02-95 TV1000 changed keys
|
||
|
||
LAST SKY ECM's
|
||
--------------
|
||
31-10-95 The big change from card 09 to card 10.
|
||
18-09-95 Code change, nanocommands are gone again.
|
||
Sky is sending some strange '85' packets, card 10 commands ??
|
||
16-09-95 Sky tested some codes, resulting in 'no key fits'.
|
||
Is Sky testing 0a cards or have they found something new...
|
||
15-09-95 Code change, nanocommands are back, (old) nanosequence 0x09, 0x28,
|
||
0x39,0x46. Several other programs got defeated, many old versions
|
||
started to work again, Voyager survived once again.
|
||
It took some time but the change of 12-09-95 was for this ECM.
|
||
12-09-95 Code change, no nanocommands are being send anymore.
|
||
Also some changes to the sub-id's: Nickelodeon was added to the
|
||
tables.
|
||
The last few times this happend it was for short periods
|
||
and followed by an actual ECM.
|
||
If no nanocommand are being send, all clonecards and programs
|
||
are working.
|
||
01-09-95 Code change, Voyager could handle it so no changes needed.
|
||
Several others where defeated once again.
|
||
Now subnano 0xbf, 0xc0 and 0xaa are in use.
|
||
15-08-95 Code change, fixed (changing the nanopointer 0xee, subnano without
|
||
effect 0x88 because it's used by the kernel)
|
||
skip 30 00 after 11 0A 00 EE
|
||
01-08-95 Code change, fixed (new nanocommand 0x0f and subnano's 0xbf, 0xc0)
|
||
28-06-95 Code change, Sky cleaned-up the nanocommand code.
|
||
now only nanocommand 0x28 is in use.
|
||
Voyager was allready prepared for this ECM.
|
||
MTV also started to transmit VC encoded.
|
||
15-06-95 Code change, fixed 0xE7.. is ram not rom.
|
||
pick up data byte 0xE7 from rom.
|
||
17-05-95 Code change, fixed nano-command switching between rompages.
|
||
new nano subcommand for the nano 11h command: subcommand 08
|
||
means: switching between rompage 1 and rompage 2
|
||
06-04-95 Code change, Nanocommands are back
|
||
15-03-95 Code change, no Nanocommands are being send anymore.
|
||
Bit 5 in the channel-id is set.
|
||
08-03-95 Code change, adressing of packets is changed.
|
||
03-02-95 Code change, Rom-Page 0 is being used, 10 sec. picture,
|
||
2.5 sec. no picture.
|
||
25-01-95 Code change, 7.5 sec. picture, 5 sec. no picture.
|
||
18-01-95 Code change
|
||
16-01-95 Code change
|
||
|
||
LAST TAC/EUROTICA ECM's
|
||
-----------------------
|
||
29-11-95 Code change, Eurotica changed but is still decoded.
|
||
01-09-95 Code change, The Adult Channel changed but is still decoded.
|
||
14-06-95 Code change, The Adult Channel switched back to the old keys.
|
||
Voyager gets switch key 'J' to protect against PS ECM and a larger
|
||
key table.
|
||
Also autoswitch funtion implemented.
|
||
24-05-95 Code change, the ECM of 24-5-95 is called Perry Smith ECM
|
||
last 64 itteration with constant 0x0d as input.
|
||
15-05-95 Code change
|
||
16-02-95 Code change
|
||
18-01-95 Code change
|
||
|
||
SUB-CHANNEL I.D.
|
||
----------------
|
||
The information below is only for Sky 09/07 cards:
|
||
The sub-id is found in the low nibble (4 bits) of indata[5], if indata[3]+0x02
|
||
not equals indata[7] and indata[7]+0x02 not equals indata[3] or indata[3]+0x08.
|
||
equals indata[7].
|
||
The MultiChannels ID is now only for Sky One, Sky Soap and The Travel Channel.
|
||
Sky sports 2 uses the Sky sports ID.
|
||
All other channels are correctly identified using this method.
|
||
|
||
New id-f is used for all 'open videocrypt' channels like Sky News, CNE,
|
||
TVX freeview block, Hour of Power and non-decoded announcements like Showcase.
|
||
QVC still uses its own sub-id in the multichannels package.
|
||
|
||
AUTO DELAYS
|
||
-----------
|
||
By detecting the CPU type inside voyager and combining the results of many
|
||
reactions from Voyager users, Voyager has now an automatic delay.
|
||
It's still possible that the standard settings don't work, in that case
|
||
the auto delay can be overruled by setting the wa/wb/wc parameters on startup.
|
||
The auto delay detection can be activated with the 'A' parameter at start-up.
|
||
|
||
Most common settings are:
|
||
|
||
XT's 86/88/V20/V30 : Voyager 1 wa50 wb0
|
||
286 up to 16 MHz : Voyager 1 wa50 wb0
|
||
386 up to 40 MHz : Voyager 1 wa50 wb1
|
||
486 up to 100 MHz : Voyager 1 wa50 wb2
|
||
Pentium : Voyager 1 wa50 wb2
|
||
|
||
All settings are also checked on old and new videocrypt chipsets.
|
||
|
||
ZKT
|
||
---
|
||
VideoCrypt decoders contain a few built-in algorithms to prevent pirate
|
||
cards from being used. However due to a programming error on many of the
|
||
original decoders and IRDs (integrated receiver/descramblers), the most
|
||
powerful algorithm, the Fiat-Shamir zero-knowledge test, did not work
|
||
properly. On the newer videocrypt systems this error is fixed.
|
||
Voyager is patched and now acts exactly the same as the original cards
|
||
preventing the decoder to see it's not an original card.
|
||
|
||
VOYAGER.EXE: usage
|
||
-------------------
|
||
Syntax:
|
||
VOYAGER [com] [wax] [wbx] [wcx] [wdx] [wex] [a] [d] [e] [i] [j] [m] [n] [q] [v] [t] [z]
|
||
|
||
com: Serial port to use.
|
||
|
||
wa thru we are delays, all entered in ms (milliseconds)
|
||
wa wait between reset and answer to reset
|
||
wb wait after each outgoing byte
|
||
wc wait between header and first procedure byte
|
||
wd wait between procedure byte and data
|
||
we wait between final data byte and procedure bytes
|
||
|
||
a: Videocrypt Automatic delay setting.
|
||
d: debug mode on when program is started.
|
||
e: save time by doing less screen updates.
|
||
i: Displays channelnames by sub-id for debugging.
|
||
j: Switches between Adult keys before and after 24th may ECM.
|
||
m: OSD suppress.
|
||
n: Display nanoinfo on startup.
|
||
q: Quick decoding mode.
|
||
v: Show hexnumbers in o.s.d. on startup.
|
||
z: set baud rate at 10000 baud.
|
||
|
||
defaults are:
|
||
com: 2
|
||
wa: 50
|
||
wb: 0
|
||
wc: 0
|
||
wd: 0
|
||
we: 0
|
||
dn: debug mode n on.
|
||
e: no time saving
|
||
m: no OSD suppression
|
||
n: don't show nanoinfo
|
||
vn: viewmode n on.
|
||
jn: Adult ECM switching mode n on.
|
||
|
||
Example: VOYAGER 1 wa0 wb0 m
|
||
starts voyager using comport 1 with reset delay and byte delay set at
|
||
0 milliseconds, and with onscreen display suppressed.
|
||
|
||
Voyager is patched to work on Pace MSS systems
|
||
if your decoder locks-up use the wc parameter. wc150000 seems to work on
|
||
some systems but you might try other values.
|
||
After implementing the ZKT, the wc parameter may not be needed.
|
||
It works fine on my MSS system.
|
||
|
||
-----
|
||
READ the SETTINGS.TXT file for additional information on how to run voyager.
|
||
-----
|
||
|
||
Keyboard commands once the program is running:
|
||
|
||
F1: help -> page up, down scroll help
|
||
q: quit program
|
||
d: toggle debug mode on/off
|
||
i: shows sub-id hex bytes for debugging
|
||
j: Toggles between adult tables/algorithms
|
||
n: toggle nanoinfo on/off
|
||
v: toggle viewmode on/off (hexnumbers in o.s.d.)
|
||
l: write last crypto messages to logfile VCLOG
|
||
a: increase reset delay
|
||
b: decrease reset delay
|
||
+: increase byte delay
|
||
-: decrease byte delay
|
||
1: increase procedure delay
|
||
2: decrease procedure delay
|
||
c: clear the screen
|
||
t: nano tracing mode on/off
|
||
x: access command mode on/off
|
||
e: time saving on/off
|
||
m: OSD on/off
|
||
|
||
|
||
VOYAGER VERSION HISTORY
|
||
-----------------------
|
||
1.3j, Keys release 1.2 : (Voyager/Season71 version)
|
||
. 14-01-1996 (updated release)
|
||
. Added a new D2Mac channel.
|
||
. Added the 'C' switch to set the CI value.
|
||
. Fixed some bugs.
|
||
. Rewrote and optimized some of the routines.
|
||
. Extended the Nokia compatibility.
|
||
. Fixed a bug in the delay command line switch.
|
||
Now all is working fine.
|
||
. The pentium detect routine sometimes gives a wrong answer depending
|
||
on the CPU used. No time to fix it.. wait on one of the next releases.
|
||
. The Eurocrypt-S part is not yet finished...be patient.
|
||
|
||
1.3i, Keys release 1.1 : (Voyager/Season71 version)
|
||
. 23-12-1995 (updated release)
|
||
. Documented the source code (No it's NOT available).
|
||
. Rewrote and optimized some of the routines.
|
||
. Added the missing Eurocrypt commands.
|
||
. Added Nokia compatibility.
|
||
. Added Quick decoding mode (activate with 'Q' on commandline).
|
||
. The automatic delay detection was left out in the last release and is
|
||
now back again.
|
||
The automatic delay works only for VideoCrypt and can be activated
|
||
with the 'A' parameter on the commandline.
|
||
. Added the new 0b key for the TV3's.
|
||
. Bugfix on the answer strings.
|
||
. Option 'T' transformed to 'Z', now you can always switch from 10000 to
|
||
9600 and from 9600 to 10000 with the 'Z' key when the program is running.
|
||
Use the 'Z' switch also on the commandline to start with 10000 baud.
|
||
. Added a pentium detection routine
|
||
. The auto delay detect is back. With the 'A' switch on the commandline
|
||
The program uses automatic delays, only for VideoCrypt.
|
||
. The Sky 10 card is not yet implemented, be patient
|
||
|
||
1.3h, Keys release 1.0 : (Voyager/Season71 version)
|
||
. 02-12-1995 (updated release)
|
||
. D2Mac Eurocrypt M implemented. (Not S)
|
||
Channels supported :
|
||
Filmnet+, Filmnet TCMC, TV1000, TV1000 Cinema, TV3 Norway, TV3 Sweden,
|
||
TV3 Denmark, Filmmax, MTV Nordic, CNN Nordic, Eurosport Nordic,
|
||
Discovery Nordic, Children Channel Nordic, BBC Prime, Canal+ 16/9,
|
||
Cin‚Cin‚ma 16/9.
|
||
. The Sky 10 card is not yet implemented, be patient
|
||
|
||
1.35:. 03-10-1995 (updated release)
|
||
. reprogrammed for use on XT (8088/8086) systems.
|
||
. Code change, sky is using id-F for all the 'open-videocrypt' channels
|
||
except QVC wich still has its own id.
|
||
. Private version, so not spreaded and not available.
|
||
|
||
1.3: . 27-09-1995 (updated release)
|
||
. Last version before Sky's card change ??
|
||
. New layout.
|
||
. Added auto delay detect, so delays are now automaticaly set.
|
||
The detected CPU type is show on-screen, the Pentium is not yet detected.
|
||
. Added a new -second- delay routine, now both delay types are available
|
||
Miliseconds delays and Microseconds delays (Switching with 'Y').
|
||
. Id-F for The Disney Channel added.
|
||
. Sub-id for Nickelodeon added.
|
||
. Added the videocrypt mode identifier.
|
||
. Updated debug routines.
|
||
. Updated commandline options.
|
||
. Added the '?/h/H' key's to see the commandline options.
|
||
. Updated the messages displayed when using the wrong serial port.
|
||
. Adult channel decoding now with 3 modes: Auto ECM switching (default),
|
||
PS-ECM on and PS-ECM off. ('J' key for switching)
|
||
. Bug fix: black/white displaymode now working properly.
|
||
. Cleaned up the sources.
|
||
. Unlike some others Voyager had no problems with the ECM's and/or code
|
||
changes from 01-09-95, 12-09-95 till 15-09-95 and 18-09-95 till now.
|
||
. Although no longer in use, i added the RedHot TV decoding again just
|
||
to have it all in one version.
|
||
NOTE: The voyager 2.x versions are *NOT* mine, just ignore them they do
|
||
*NOT* contain the better parts of this Voyager version !!!
|
||
This is the official update !!
|
||
|
||
1.25:. 25-08-1995 (updated release)
|
||
. Added FSZKT test 1, including original serial numbers.
|
||
Voyager now acts as an original smartcard.
|
||
No more problems after a minute of decoding.
|
||
. Added the 'C' key to clear and redraw the screen with the Voyager word.
|
||
. Added the 'T' key for Nano tracing.
|
||
. Redefined the 'X' key to display the access commands on screen.
|
||
Now you can follow the activation and deactivation of cards on screen.
|
||
. Added all nanocommands.
|
||
. Changed byte delay at startup to 0.
|
||
. Cleaned up the complete sources.
|
||
|
||
1.2: . 16-08-1995 (updated release)
|
||
. Implemented the Sky ECM of 16-08-95.
|
||
. Cleaned up the nanocodes.
|
||
|
||
1.1: . 07-08-1995 (updated release)
|
||
. Implemented the Sky ECM of 01-08-95.
|
||
. Implemented cardcommand 72 (Answer from previous card).
|
||
. Debugging now in 4 steps: None, level 1, level 2 and level 3.
|
||
. The 'I' key now shows the 3 needed sub-id bytes on the PC screen.
|
||
. Switches 'M' and 'E' now also when running the program.
|
||
. Switches '1' and '2' implemented for procedure delay.
|
||
. Updates to the channel naming tables.
|
||
Also MTV-Europe name added to the table (was decoded fine allready
|
||
in version 1.0)
|
||
. Added full Sky 07 card decryption, just to have it all in one version.
|
||
. Adult/Eurotica/??? keytable autosearch added to try to survive
|
||
future ECM's.
|
||
. Unlike others Voyager had no problems with the ECM of 28-06-95.
|
||
Allthough it was not a real ECM but just a clean-up in the
|
||
Nanocommands, various seasons and batterycards got defeated.
|
||
|
||
1.0: . 28-06-1995 (initial release)
|
||
. Added the I switch to toggle between normal operation and
|
||
showing the channels by sub-id on the PC screen for debugging.
|
||
'I' shows also the corresponding 'sub-id' hex byte.
|
||
. Fixed various Pace MSS problems.
|
||
. Fixed TV Eurotica.
|
||
. Program should now autoswitch between 'old' codes and PS ECM.
|
||
. Adult/Eurotica keytable extended.
|
||
|
||
===
|
||
. Now toggle with 'J' key between adult key tables and
|
||
ECM 0d (Perry Smith ECM).
|
||
. Fixed Sky ECM of 15-06-95.
|
||
. ECM of 17-05-1995 implemented
|
||
. Turned 'Nanoinfo' to off at start-up for slower systems.
|
||
. Some cosmetic changes to async.asm
|
||
. Speedup of subchannel i.d. in o.s.d..
|
||
. Subchannel i.d.'s of Discovery and The Family channel added.
|
||
. Viewmode included (shows the first 8 bytes from indata in the o.s.d.)
|
||
. No key fits! included.
|
||
. Improved Channel i.d., subchannel I.D. of multichannels included
|
||
. Nano info included, displays full nano string and last pointers and
|
||
rompagenumbers used by a 30-nano command
|
||
. Channel name in the o.s.d. if you press the PPV-button
|
||
. Removed cursor in the left upper corner
|
||
. Improved onscreen display and channel i.d.
|
||
. Revised com port to COM2 on startup
|
||
. Fixed 'Reset' from PACE type decoders hanging program on startup
|
||
. Revised some code for xx286 cpu's
|
||
. Added TV-X new channel from 03-06-95.
|
||
. first implementation, derived from SEASON7.c being
|
||
the source for season in the 07-series period and SKY09PUB.ZIP
|
||
being the implementation of the 09-series for 8051(Thanks T.:-)) chips).
|
||
. new user interface
|
||
|
||
Updates at the moment also on: WWW.XS4ALL.NL/~CEYLON
|
||
|