![..[ Phrack Magazine ]..](../../images/phrack-logo.jpg){kind=logo}
.:: Pay Per View (you don't have to) ::.
Issues:
[ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ 16 ] [ 17 ] [ 18 ] [ 19 ] [ 20 ] [ 21 ] [ 22 ] [ 23 ] [ 24 ] [ 25 ] [ 26 ] [ 27 ] [ 28 ] [ 29 ] [ 30 ] [ 31 ] [ 32 ] [ 33 ] [ 34 ] [ 35 ] [ 36 ] [ 37 ] [ 38 ] [ 39 ] [ 40 ] [ 41 ] [ 42 ] [ 43 ] [ 44 ] [ 45 ] [ 46 ] [ 47 ] [ 48 ] [ 49 ] [ 50 ] [ 51 ] [ 52 ] [ 53 ] [ 54 ] [ 55 ] [ 56 ] [ 57 ] [ 58 ] [ 59 ] [ 60 ] [ 61 ] [ 62 ] [ 63 ] [ 64 ] [ 65 ] [ 66 ] [ 67 ] [ 68 ] [ 69 ] [ 70 ] [ 71 ]
Current issue : #52 | Release date : 1998-01-26 | Editor : route
| Introduction | Phrack Staff |
| Phrack Loopback | Phrack Staff |
| Line Noise | various |
| Phrack Prophile on o0 | Phrack Staff |
| Everything a hacker needs to know about getting busted | Agent Steal |
| Hardening the Linux Kernel | daemon9 |
| The Linux pingd | daemon9 |
| Steganography Thumbprinting | unknown |
| On the Morality of Phreaking | Phrack Staff |
| A Quick NT Interrogation Probe | twitch |
| Subscriber Loop Carrier | voyager |
| Voice Response Systems | voyager |
| Pay Per View (you don't have to) | cavalier |
| The International Crime Syndicate Association | D. Demming |
| Digital Certificates | Yggdrasil |
| Piercing Firewalls | bishnu |
| Protected mode programming and O/S development | mythrandir |
| Weakening the Linux Kernel | plaguez |
| Phrack World News | disorder |
| extract.c | Phrack Staff |
Title : Pay Per View (you don't have to)
Author : cavalier
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 13 of 20
-------------------------[ Pay Per View (you don't have to)
--------[ Cavalier[TNO]
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
I......................................................... Introduction
II........................................................ Automatic Windows
III....................................................... The Login Window
IV........................................................ The Main Menu
V......................................................... Other Menus
VI........................................................ Converter Types
VII....................................................... Scrambler Types
VIII...................................................... Scrambling Modes
IX........................................................ Security Notes
X......................................................... Conclusion
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
.--------------.
| Introduction |
`--------------'
General Instruments sells more cable television equipment than any other
manufacturer. Included in their product range is the ACC-4000. The
ACC-4000 is a system that controls Pay-Per-View television.
The ACC-4000 is a PC running SCO Open Desktop v3.0. Earlier ACC-4000s
ran Interactive Unix. The interface for the ACC-4000 is X-Windows based,
so you can hack your way to free pron through an attractive GUI.
The ACC-4000 is often referred to as an addressable system. This means
that each set-top-box can be addressed independently. This allows every
subscriber to select their own programming -- and it allows the cable
television company to bill the subscriber for every television show the
subscriber selects.
The cable television signal is normally sent by satellite to a cable
headend. To translate this into terms that may be more comfortable to
Phrack readers, the cable head end is similar to a telephone company
central office. At the headend, the signal is scrambled to make it more
difficult to view without paying.
The ACC-4000 then routes the signal from the headend to the appropriate
set-top-boxes. It does this by merging control information into the data
stream before the data stream reaches the set-top-boxes. The ACC-4000
can talk to one-way, FONE-way, and two-way set-top-boxes. The ACC-4000
works over standard RF cable, fiber optics, microwave, and even
telephone wiring.
The ACC-4000 is capable of sending billing information to a cable
television billing system, such as CableData, CSG, or Wizard.
The ACC-4000 is a small system. The unit I examined was using a 486DX-50
processor. Nevertheless, one ACC-4000 can manage a half a million set
top boxes.
Often you will find other General Instruments systems connected to the
ACC-4000. A Data Provider Translator system can take input from outside
sources and merge them into the data stream going to the set-top-boxes.
This provides features like program guides, VCR IR codes, weather data,
Near-Video-On-Demand (NVOD) schedules, or even custom logos and menus. A
Message Editor system can be used to create custom "barker" messages for
cable subscribers.
.------------------.
| Automatic Windows|
`------------------'
In addition to the login window, the ACC-4000 opens two other types of
windows automatically to display information on the console. Using
Xwatchwin to view these windows remotely can help you figure out what is
going on with the system. The Windows are:
. Logger Window
. Wire Link X
The window titled "Logger Window" contains status and error messages.
The windows titled "Wire Link X" show data going from the ACC-4000 out
to other systems, usually the billing system. There is one "Wire Link X"
window for each system the ACC-4000 is feeding data.
.------------------.
| The Login Window |
`------------------'
The login window is extremely informative and looks something like this:
.---------------------------------------------------------------------------.
| ACC4000 Help |
| ~ ~ |
|---------------------------------------------------------------------------|
|LOGIN | Login to ACC4000 | | |
|---------------------------------------------------------------------------|
| General Instruments Addressable Control System |
|User Name: ############################# Password: ######## |
| COPYRIGHT (C) 1996. General Instrument Corporation |
|---------------------------------------------------------------------------|
|Site Number: 866 Geocode: 303 Terminal: tno:0.0 Software Version: V8.66 |
| |
| Number ANICS Installed: 1 Number of Subscriptions: 16 |
| Parallel Data Streams: 1 1st Subscription Service Code: 1 |
| List Maintenance: HOST Number of Simultaneous Events: 48 |
| Number List Maps: 8 1st Event Service Code: 89 |
| Return Frequency: 08.9 Mhz Data Stream Baud Rate: 13.97 Khz |
| |
| Data Base Size: 288K Subscribers Converter ID Usage: 32K Groups |
| |
| 1st group 1-way 2nd group phone 3rd group phone 4th group 2-way |
| 5th group 2-way 6th group 2-way 7th group 2-way 8th group 2-way |
| 9th group 2-way |
| |
|---------------------------------------------------------------------------|
|Enter operator name |
| |
| F6:Clear Field F7:Field Help F8:Form Help |
`---------------------------------------------------------------------------'
Site Number is assigned by General Instruments. This number is
also stored in the set-top-box.
Geocode is a optional number that may be assigned by the cable
television company to segment it's set-top-boxes into groups.
Terminal is the name of the X-windows terminal you are
connecting from.
Software Version is the release number of the ACC-4000 software.
Number ANICS Installed is the number of transmission devices
installed.
Parallel Data Streams is the number of simultaneous
transmissions into the data stream.
List Maintenance is always set to HOST. In the future, General
Instruments plans to allow the an ANIC to maintain the list of
authorizations.
Number List Maps is the size of the queue between the ACC-4000
and the ANIC.
Number of Subscriptions is the number of service codes allotted
for subscriptions.
1st Subscription Service Code is the first available scrambler
tag for descrambling subscriptions.
Number of Simultaneous Events is the maximum number of
simultaneous Pay-Per-View (PPV) events that can be available at
one time.
1st Event Service Code is the first available scrambling tag for
Pay-Per-View PPV events.
Return Frequency is the transmit frequency used by two-way set
top boxes. The range is normally 8.3 - 10.4Mhz.
Data Stream Baud Rate is the rate of transmission of the data
stream.
Data Base Size is the maximum number of set-top-boxes the system
is configured for.
Converter ID Usage is always set to 32k. This means that 32k
set-top-boxes can be grouped into a partition.
Groups shows the division of the total number of set-top-boxes
(data base size) into partitions.
.---------------.
| The Main Menu |
`---------------'
The Main Menu is the gateway to all other menus and looks something like
this:
.---------------------------------------------------------------------------.
|MAINMENU | Main Menu of Screen Options | |records found |
| |
|.-------------------------------------------------------------------------.|
|| ||
|| Main Menu of Screen Options ||
|| ||
|| 1. Converters Convs 7. User Information Users ||
|| 2. Services/Schedules Svcs 8. Control System Functions System ||
|| 3. Headend Equipment Headend 9. Reports Reports||
|| 4. Converter Types ConvTyp 10. Data Path Configuration DataCfg||
|| 5. Data Files Files 11. Message Management MsgMgt ||
|| 6. Business System Gateway Gateway 12. Return to Login Exit ||
|| ||
|| ||
|| Enter Selection: ||
|| ||
|`-------------------------------------------------------------------------'|
| |
|---------------------------------------------------------------------------|
|Enter selection number or press function button |
| |
| F6:Clear Field F7:Field Help F8:Form Help |
`---------------------------------------------------------------------------'
.-------------.
| Other Menus |
`-------------'
The ACC-4000 has many other menus that are accessed through the Main Menu.
I will not waste time and space here describing these menus. If you gain
access to an ACC-4000, the online help should be sufficient to aid you
in using the system.
These menus allow you to perform functions such as:
. Managing set-top-boxes
. Managing headend scramblers
. Sending messages to subscribers
. Performing opinion polls on subscribers
. Configuring available Pay-Per-View (PPV) events
. Managing purchase data
. Maintaining the ACC-4000 database
. Creating reports
.-----------------.
| Converter Types |
`-----------------'
The ACC-4000 system supports a large number of set-top-boxes:
Type Model Name Partition Type
------------------------------------------------------------------------------
1 DRZ STARCOM II, 400, 500 One-Way
(PROM based)
2 DRZA-*A, DRZP-*A STARCOM 450 One-Way
(PROM based, 128 tags) STARCOM 450/P3
3 DRZI*-*A STARCOM 450/P3 One-Way
(PROM based, 256 tags)
4 DRZI*-AT STARCOM 450 Two-Way
5 XT5-*1* STARCOM V One-Way
6 XT5-*2* STARCOM V Two-Way
7 DRZI*-*AV STARCOM 450 One-Way
8 DP*5-*3* STARCOM VI+ Fone-Way
9 DL4/DL4A STARCOM V One-Way
10 DP*5-*1* STARCOM VI+ One-Way
11 DP*5-*2* STARCOM VI+ Two-Way
12 DPBB-*1* STARCOM VI+ One-Way
13 DPBB-*3* STARCOM VI+ FONE-Way
14 DPBB-*2* STARCOM VI+ Two-Way
15 DP711*, DPV721*, DPV721*/C1 STARCOM 7100/7200 One-Way
16 DP713*, DPV723*, DPV723*/C1 STARCOM 7100/7200 FONE-Way
17 DP712*, DPV722*, DPV722*/C1 STARCOM 7100/7200 Two-Way
18 DPBB7-*1* STARCOM 7300 One-Way
19 DPBB7-*3* STARCOM 7300 FONE-Way
20 DPBB7-*2* STARCOM 7300 Two-Way
21 DPBB-*1*-M1 STARCOM VI+ M/S One-Way
22 DPBB-*3*-M1 STARCOM VI+ M/S FONE-Way
23 DPBB-*2*-M1 STARCOM VI+ M/S Two-Way
24 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 One-Way
25 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 FONE-Way
26 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 Two-Way
27 DCR DCR One-Way
28 DCR 3000S/4000S DCR One-Way
30 CFT2000/2100 CFT2000/2100 One-Way
31 CFT2000/2100 CFT2000/2100 FONE-Way
32 CFT2000/2100 CFT2000/2100 Two-Way
33 STARPORT STARPORT One-Way
34 STARPORT (not implemented) STARPORT FONE-Way
35 STARPORT (not implemented) STARPORT Two-Way
36 CFT2200 CFT2200 One-Way
37 CFT2200 CFT2200 STARFONE FONE-Way
38 CFT2200 CFT2200 STARVUE Two-Way
39 CFT2900 CFT2900 One-Way
40 CFT2900 CFT2900 FONE-Way
41 CFT2900 CFT2900 Two-Way
42 Sega Sega One-Way
.-----------------.
| Scrambler Types |
`-----------------'
The ACC-4000 system supports several different types of scramblers at the
headend, including:
STARPACK Service Encoder (SSE)
An older scrambler that scrambles with standby and 6db constant
sync-suppression scrambling modes.
Digital Scrambler/Encoder (DS/E)
An older RF scrambler.
Digital Video/Encoder (DV/E)
An older baseband scrambler, used to further scramble DS/E
signals.
Video Processor/Encoder (VP/E)
A DS/E and a DV/E together.
Modulating Video Processor (MVP) and MVPII
A newer scrambler.
Modulating Video Processor (MVP) II-DIU
A MVPII with a Data Inserter Module (DIM) to enable data insertion.
.------------------.
| Scrambling Modes |
`------------------'
The ACC-4000 controls scramblers using several modes of scrambling, including:
. Sync Suppression
. Video Inversion
. Audio Inversion
Supported sync suppression submodes are:
. Standby
. Clear, 0db constant
. 6db constant
. 10db constant
. Scene change, 3 seconds
. 6/10 pseudo-random, 30 seconds
. 6/10 pseudo-random, 1 minute
. 6/10 pseudo-random, 16 tics
. 6/10 pseudo-random, 3 seconds
When using scene change or 6/10 pseudo-random sync suppression, the
ACC-4000 supports a number of dynamic mode types:
. Pseudo-random 6/10/clear
. Pseudo-random 6/clear
. Pseudo-random 10/clear
. Pseudo-random 6/10
. Linear 6/10/clear
. Linear 6/clear
. Linear 10/clear
. Linear 6/10
In addition, you can set the interval between dynamic mode time changes
in hours, minutes, seconds, or tics.
Supported video inversion submodes are:
. Clear
. Scene change field inversion
. Constant video inversion
. Timed field inversion
Note: Video and audio inversion only work with baseband set-top-boxes.
.---------------.
| Security Notes|
`---------------'
These systems normally have modems for use by both General Instruments
personnel and cable company personnel. General Instruments personnel
dial in to diagnose problems with the system. Cable company personnel
dial in to change Pay-Per-View (PPV) programming or to configure
customer set-top-boxes.
Any uncollected purchases are lost when a set-top-box is initialized.
To preserve uncollected purchases, the operator will do a Refresh
instead of an Initialize. If you can talk the operator into doing an
Initialization instead of a Refresh, any uncollected purchases not
already forwarded to the billing system will be lost.
Purchases are stored as integers. Older set-top-boxes were limited to
storing 16 purchases. Newer set-top-boxes are limited to storing 63
purchases.
.------------.
| Conclusion |
`------------'
If you can access a system such as the ACC-4000, you can have great fun.
Be careful when giving everyone in your city free access to WWF.
----[ EOF
© Copyleft 1985-2024, Phrack Magazine.