Microsoft the leader of software since the early 1980s and a lot has changed.

There was 3.0 with a new GUI but yet it was still an epic fail! Windows 95

however had another new GUI that consisted of the start menu and was the first

os that came with an os and a browser (a game changer) it was a hit Microsoft

made billions off this one release. Windows 98 was another huge hit it came with

great performance upgrade and ran half decent on old hardware. Windows 98 SE

was an epic fail it had no improvements over windows 98 and Microsoft felt the

heat from this one. Windows ME was another epic fail it had no new features and

inferior performance everyone was outraged and demanded a downgrade to

windows 98 SE. And then Microsoft finally recovered with windows 2000 It had a

crisper looking GUI with better performance. Windows eXPeriance had

astounding changes it was released in 2002 and is expected to be used till 2014!

Windows Vista had a great ne GUI with aero however everyone seemed to be a

vista hater so it was not a huge achievement.

Now not yet released windows seven its huge its got a new taskbar ne

virtualization technology I could list all the new feature but it would be pages and

I’m not goanna bore you to death. But don’t listen to me  go get yourself a copy

on October 20^th.

I have started studying the StarChoice problem just recently. I present here the current status of my research. In this post, I try to present in a single digest all the knowledge I have collated to date (mostly through reading this forum) in the hopes that it might spark more interesting discussions. As I gather more information on the subject, this could eventually mutate into a bonafide FAQ!

RATIONALE

Why do I bother with SC, you ask? First, because as a hacker, this is a very interesting subject to study (read “hacker” as defined here: h.ttp://www.tuxedo.org/~esr/jargon/h…try/hacker.html). Second, the fact that the waves are there, just like the Everest, is reason enough! Finally, I have 3 nice SC receivers gathering dust and I prefer learning how they work more than simply using then to watching TV! So please spare me the “why do you want SC anyway” rant!

CATCH THE WAVE

This section lists imaginative means to potentially make good use of the EM waves that StarChoice beams at you from the Anik E2 and F1 satellites. Note that (asides from number 2 below) I have not experienced any of these methods first hand, therefore, AFAIK, this is all fiction… Also, none of the information below gives any profound insight in truly hacking StarChoice (i.e.: actually defeating DigiCipherII).

1. Form a community! A group of people fax SC to let them know that a buddy has purchased their receiver. Buddy, the front man, calls SC to activate his service for his multiple receivers. The community members pay buddy their share of the bill. As far as SC is concerned, all the receivers on that account are in the same house, but they could be anywhere in the satellites’ footprint, perhaps, God forbid, there could even be one in each of the community members’ house!

2. PPV Unplugged! Plug in your phone line, call up SC, activate the modem and order your first PPV. After this first activation, unplug your phone line and keep ordering PPVs. The receiver will now be able to unlock the PPVs without contacting SC. It will keep track of the fact that you ordered a movie in a non-volatile memory (probably a battery-backed RAM. More on this later). Usually, the receiver tries to contact SC in the middle of the night, but since your phone line is disconnected, SC will not know that you ordered a PPV. Rumor has it that you can keep ordering PPVs up to a maximum of 25 flicks, but that there is probably a limited timeframe for doing this (i.e.: if the receiver knows that it has undeclared PPVs in its memory and that it did not successfully contact SC in a while, the receiver will probably stop allowing you to keep accumulating PPVs). IIRC, I have personally unlocked about 5 movies over a two-month period without SC ever being informed (after which time I moved and cancelled my SC subscription). Once you reach the limit, open up your receiver and remove the battery. Note that it seems that this method has the unpleasant side-effect of erasing your subscription, which requires calling up SC to have them re-beam it…

3. Let your back bone slide! The SC receivers are designed around Motorola’s 68331 microcontroller, which has a neat feature called Background Debugging Mode (BDM, more on this later). Simply connect your PC to this interface’s 10-pin connector via a serial or parallel port BDM adapter and you’ve got yourself the means to read/write internal registers and read/write all memory. Furthermore, if the code ran from RAM (von Neumann architecture) it would also allow you to step through code and set breakpoints, but since the code runs from flash, no can do.

This BDM thingy opens up interesting research avenues:

a) True freedom of choice! h.ttp://www.coolstf.com/4play/ discusses means to reprogram the channel maps of a receiver that is almost identical to the DSR-401. This method allows one to tell the receiver to enable decoding of any non-encrypted channels that are not normally accessible (i.e.: all channels marked F on Anik E2 and F1 on h.ttp://www.lyngsat.com/dig/starchoicee2_chno.shtml and h.ttp://www.lyngsat.com/dig/starchoicef1_chno.shtml). Although it discusses 4DTV, what is teaches is directly applicable to StarChoice. Thank God for 4DTV, because information about StarChoice is hard to find, but information on 4DTV is abundant! For example: h.ttp://www.coolstf.com/mpeg/index.html and h.ttp://www.faqs.org/faqs/Satellite-TV/4dtv/.

b) Send in the clones! An interesting twist to option 1 above is the potential ability to clone receivers. Instead of sending a fax to SC, the members of the community change their receivers’ Unit Address to buddy’s address (Note that the UA is most probably stored in flash). All members would have access to buddy’s programming…

c) Zap the PPVs! An other interesting twist, this time to option 2 above is the potential ability to use the BDM to erase only the PPV information contents of the battery-backed RAM without affecting the channel map and other such subscription information.

d) Write your own firmware! To any sane person, this would sound absolutely impossible. However some tattooed longhaired German super geek has done this for a European Nokia receiver (check out h.ttp://www.dominance.net/overflow if it ever comes back online, or h.ttp://www.dvb2000.org while you wait). This receiver is also based on a BDM-equiped microcontoller. The BDM interface is used to download the firmware to flash. This totally blows my mind! I don’t think I’ll ever come this far in my research, but their work is inspiring!

UNDER THE COVER

Opening a DSR-401 receiver reveals a PCB that is almost identical to 4DTV’s DSR-905 h.ttp://www.coolstf.com/4play/905big.gif.. The 10-PIN BDM header (bottom left) was not installed in my DSR-401 unit. I easily soldered one in place.

I also have an older receiver at home (DSR-411? The one that has an 8-segment display). I did not study it closely, but it is interesting to note that I can’t seem to find a battery on its PCB…

Here is a list of the main ICs that populate the DSR-401 PCB:

U8 HYUNDAI HY62V8100B
http://www.hynix.com/datasheet/pdf/sram/HY62V8100B.PDF
128 KB SRAM
Battery-powered! This is the memory that most certainly holds the PPV information and channel map (and whatever else SC beams to your receiver to activate it!). Information on 4DTV seems to indicate that this memory is mapped at 800000h.

U11 AMD AM29LV800BB
http://www.amd.com/us-en/assets/con…_docs/21490.pdf
8 MB Boot Sector Flash Memory

U12 AMD AM29LV400BB
http://www.amd.pl/products/nvd/techdocs/21523.pdf
4 MB Boot Sector Flash Memory

U13 Motorola MC68LK331CPV27
http://e-http://www.motorola.com/webapp/sp…H#documentation
MC68331 Microcontroller (with BDM)

U15 General Instrument BCM7010 KPB BROADCOM
http://www.broadcom.com/pbs/BCM7010.pdf
MPEG-2 decoder

U16 ISSI IS41LV16100-60K
http://www.issiusa.com/pdf/41C16100.pdf
16 MB EDO DRAM

U17 CONEXANT RC224ATLV
http://www.conexant.com/products/prodparts.jsp?id=282
9600 bps POTS modem

U19 HYUNDAY HY57V161610D
http://www.dsp-memory.com/datasheet…7v161610dtc.pdf
16 MB SDRAM

BACKGROUND DEBUGGING MODE

Here are some interesting links on BDM:

http://cmp.felk.cvut.cz/~pisa/m683xx/bdm_driver.pdf
http://www.zeecube.com/bdm/
http://www.geocities.com/Television…connection.html
http://www.ee.uwa.edu.au/~braunl/eyebot/bd/bd32.html
http://e-http://www.motorola.com/brdata/PDFDB/docs/SDIUM.pdf
http://www.macraigor.com/zenofbdm.pdf
http://www.ocdemon.net/Merchant2/me…&Store_Code=MTS
http://www.uni-sat.net/nutils.html
http://www.pemicro.com
Although you can buy some HW and FW from Motorola or P&E for about 130$US, you can build the HW yourself and use free software off the net. I got my BDM on e-bay from a guy in Germany for about 25$CDN (including a CD and shipping and handling!). Let me know if you are interested in getting one and I’ll get him to contact you. Note that I did not yet manage to get my BDM to work. I’ll need to tackly this with a logic analyzer to see what’s going on.

WHAT NOW?

My first goal is to get my BDM to work! I’ll use it to read all memories. Then, I’ll take a closer look at the contents of the battery-backed RAM. I’ll do a write test: the 4DTV trick to add some free un-encrypted channel. Then, I’ll do another write test to see if I can clear any PPV information in that RAM without erasing any important subscription information. I will then try to find where the UA is stored and see if I can change it and clone my receivers. I think this is a better first avenue or research than locking the battery-backed RAM (as suggested in a few threads on this BBS), because I think that its contents is most probably updated periodically with DCII keys.

Oh! And somewhere between all these tasks I’ll go outside and install my dish!

I’ll keep you all posted on my developments. My girlfriend is off all next week, so I should be able to put in a few late nights!

If you are pretty much at the same stage in your own research, I would love to hear from you. Drop me a line!

Cheers!

I Found This Article On A Forum If This Is Yours Please Claim It