Keeping with tradition, and seeing that this is the first article inPhrack on cable TV descrambling, any illegal box for use in descramblingcable television signals is now known as a PORNO BOX.

There are many methods that cable companies use to insure that you getwhat you pay for - and _only_ what you pay for. Of course, there arealways methods to get 'more than you pay for'. This file will discussthe most important aspects of these methods, with pointers to moredetailed information, including schematics and resellers of equipment.

Part I. How the cable company keeps you from getting signals

A brief history

---Older Systems---

Most scrambling methods are, in theory, simple. The original methodused to block out signals was the trap method. All traps remove signalsthat are sent from the CATV head end (the CATV company's station). Thefirst method, which is rarely used anymore was the negative trap.Basically, every point where the line was dropped had these traps, whichremoved the pay stations from your signal. If you decided to add a paystation, the company would come out and remove the trap. This method waspretty secure - you would provide physical evidence of tampering if youclimbed the pole to remove them or alter them (sticking a pin throughthem seemed to work randomly, but could affect other channels, as itshifts the frequency the trap removes.) This was a very secure system,but did not allow for PPV or other services, and required a lot ofphysical labor (pole-climbers aren't cheap). The only places this isused anymore is in an old apartment building, as one trip can serviceseveral programming changes. Look for a big gray box in the basementwith a lot of coax going out. If you are going to give yourself freeservice, give some random others free service to hide the trail.

The next method used was termed a positive trap. With this method, thecable company sends a _very_ strong signal above the real signal. Atuner sees the strong signal, and locks onto the 'garbage' signal. Aloud beeping and static lines would show up on the set. For the CATVcompany to enable a station, they put a 'positive' trap on the line,which (despite the name) removes the garbage signal. Many text fileshave been around on how to descramble this method (overlooking theobvious, buying a (cheap) notch filter), ranging from making a crudevariable trap, to adding wires to the cable signal randomly to remove thesignal. This system is hardly used anymore, as you could just put a trapinside your house, which wouldn't be noticed outside the house.

---Current Systems---

The next advent in technology was the box. The discussion of differentboxes follows, but there is one rather new technology which should bediscussed with the traps. The addressable trap is the CATV's dream. Itcombines the best features of the negative trap (very difficult to tamperwith without leaving evidence) with features of addressable boxes (nolineman needs to go out to add a service, computers can process Pay PerView or other services). Basically, a 'smart trap' sits on the pole andremoves signals at will. Many systems require a small amp inside thehouse, which the cable company uses to make sure that you don't hook upmore than one TV. I believe that the new CATV act makes this illegal,and that a customer does not have to pay for any extra sets (which do notneed equipment) in the house. Of course, we all know that the cable TVcompany will do whatever it wants until it is threatened with lawsuits.

Cable boxes use many different methods of descrambling. Most are not inuse anymore, with a few still around, and a few around the corner in thefuture. The big thing to remember is sync suppression. This method ishow the cable companies make the picture look like a really fucked up,waving Dali painting. Presently the most popular method is the Tri-modeIn-band Sync suppression. The sync signal is suppressed by 0, 6, or 10dB. The sync can be changed randomly once per field, and the informationnecessary for the box to rebuild a sync signal. This very common systemis discussed in Radio-Electronics magazine in the 2/87 issue. There areschematics and much more detailed theory than is provided here.

The other common method currently used is SSAVI, which is most common onZenith boxes. It stands for Sync Suppression And Video Inversion. Inaddition to sync suppression, it uses video inversion to also 'scramble'the video. There is no sync signal transmitted separately (or referencesignal to tell the box how to de-scramble) as the first 26 lines (blank,above the picture) are not de-synched, and can be re-synched with aphased lock loop - giving sync to the whole field. The data on inversionis sent somewhere in the 20 or 21st line, which is outside of thescreen. Audio can be scrambled too, but it is actually just moved to adifferent frequency. Radio Electronics August 92 on has circuits andother info in the Drawing Board column.

---Future Systems-

For Pioneer, the future is now. The system the new Pioneers use ispatented and Pioneer doesn't want you to know how it works. From thepatent, it appears to use combinations of in-band, out-band, and keys(also sending false keys) to scramble and relay info necessary todescramble. These boxes are damn slick. The relevant patents are US#5,113,411 and US #4,149,158 if you care to look. There is not muchinformation to be gained from them. Look for future updates to thisarticle with info on the system if I can find any :)

Other systems are the VideoCipher + (used on satellites now - this isscary shit.) It uses DES-encrypted audio. DigiCable and DigiCipher aresimilar, with Digi encrypting the video with DES also (yikes)... Andthey all use changing keys and other methods. Oak Sigma converters usesimilar methods which are available now on cable. (digital encryption ofaudio, etc...)

Part II. How the cable company catches you getting those signals

There are many methods the CATV company can use to catch you, or atleast keep you from using certain methods.

Market Code:    Almost _all_ addressable decoders now use a market code.
                This is part of the serial number (which is used for pay
                per view addressing) which decodes to a general geographic
                region.  Most boxes contain code which tell it to shut
                down if it receives a code (which can be going to any box
                on the cable system) which is from a different market area.
                So if you buy a converter that is say, market-coded for
                Los Angeles, you won't be able to use it in New York.

Bullets:        The bullet is a shut down code like above - it will make
                your box say 'bAh' and die.  The method used most is for
                the head end to send messages to every box they know of
                saying 'ignore the next shutdown message' ... and once
                every (legit) box has this info, it sends the bullet.
                The only boxes that actually process the bullet are ones
                which the CATV system doesn't know about.  P.S.  Don't
                call the cable company and complain about cable if you
                are using an illegal converter - and be sure to warn
                anyone you live with about calling the CATV co. also.

Leak Detection: The FCC forces all cable companies to drive around and
                look for leaks - any poor splice jobs (wiring your house
                from a neighbors without sealing it up nice) and some
                descramblers will emit RF.  So while the CATV is looking
                for the leaks, they may catch you.

Free T-Shirts:  The cable company can, with most boxes, tell the box to
                display a different signal.  So they can tell every box
                they know of (the legit box pool) to display a commercial
                on another channel, while the pirate boxes get this real
                cool ad with an 1800 number for free t-shirts... you call,
                you get busted.  This is mostly done during PPV boxing or
                other events which are paid for - as the company knows
                exactly who should get that signal, and can catch even
                legit boxes which are modified to receive the fight.

Your Pals:      Programs like "Turn in a cable pirate and get $100" let
                you know who your friends _really_ are.

I get a lot of questions about opening a box that you own. This is nota good idea. Most, if not ALL boxes today have a tamper sensor. If youopen the box, you break a tab, flip a switch, etc... This disables thebox and leaves a nice piece of evidence for the CATV co. to show that youplayed with it.

I also have had questions about the old "unplug the box when it isenabled, then plug it back in later"... The CATV company periodicallysends a signal to update all the boxes to where they should be. If youwant to do this, you'll need to find out where the CATV sends the addressinformation, and then you need to trap it out of the signal. So as soonas the fraudulent customer (let's call him Chris) sees his box get thesignal to receive the PPV porn channel, he installs the trap and now hisbox will never get any pay per view signals again... but he'll alwayshave whatever he was viewing at the time he put the trap in. Big problemhere is that most _newer_ systems also tell the box how long it candescramble that channel - i.e. "Watch SPICE until I tell you not to, or 3hours have passed"...

Where to make/buy/get porno boxes:

You can order a box which has been modified not to accept bullets. Thismethod is pretty expensive. You can also get a 'pan' descrambler - it isa separate piece that takes whatever goes in on channel 3 (or 2 or 4) anddescrambles it. These boxes can't be killed by the bullets, and workpretty well. There are some pans which are made by the same company asyour cable box and are sensitive to bullets, so beware.

There are two basic ideas for modifying a box (provided you get detailedinstructions on how to get it open, or how to fix it once you open it).You can change the S/N to something which is known as 'universal' ordisassemble the code and remove the jump to the shutdown code.The universal codes are rare, and may be extinct. Besides, if the cablecompany finds out your code, they can nuke it. This happens when someonewho makes (err made) 'universal' chips gets busted. The modification ofthe actual code is the best way to do it, just forcing a positiveresponse to permission checks is the easiest way.

A 'cube' is not a NeXT, it's a device which removes the data signal fromthe cable line, and inserts a 'nice' data signal which tells your box toturn everything on. A 'destructive' cube actually re-programs all theboxes below it to a new serial number and gives that number fullprivileges, while a 'non-destructive' cube needs to know your boxesserial number, so it can tell your box (without modifications) that itcan view everything. You have to get a new IC if you change boxes, butthe plus is that you can remove the cube and the box functions asnormal. Then again, you have to trust the place you are ordering thecube from to not be working for the cable company, as you have to givethem your box serial number - which the CATV cable has in their records.Cubes have been seen for sale in the back of Electronics Now (formerlyRadio Electronics).

Of course, you could check in the above mentioned articles and buildcircuitry, it would be a lot cheaper. The only problem is that you haveto be good enough not to fuck it up - TV signals are very easy to fuck up.

Then there is the HOLY GRAIL. Most scrambling systems mess with the syncpulse. This pulse is followed by the colorburst signal on NTSC video.Basically, the grail finds the colorburst and uses it as a referencesignal. In theory, it works wonderfully (but does not fix the videoinversion problems found on SSAVI systems). However, with the sync pulsewhacked, the colorburst method may give weak color or color shifts. Theschematics are in the May 1990 Radio-Electronics. I have also receivedemail from aa570@cleveland.Freenet.Edu about his colorburst kit, which isa modified (supposedly higher quality) version of the R-E schematics.The schematic and parts list is 5 bucks, 16 bucks for a pre-drilled andetched board. A little steep, but not too bad. E-mail the above formore information.