GENERIC Keys-R-Us You have just purchased the most unique PROM-based software tool developed for the videocipher to date. This chip will allow you the satellite dealer to now offer your customers 'total service' of the videocipher ranging from replacing the VC2's battery to repairing a 'brain dead' cipher. The process of 'Cloning' is actually making one Videocipher an exact working model of another or others in a global network of descramblers. The videocipher system distinguishes one descrambler from another by means of an I. D. # or Unit #, and several other groups of numbers known as 'keys' which are unique from one descrambler to another. One group of 'keys' located in IC chip U-7's RAM (memory), will be referred to as 'Seed Keys' and there are four 'keys' labeled zero through three. The other group of 'keys' known as 'Monthly Keys' and there are two of them, reside in IC chip U-20's RAM and are at memory addresses 6100 hex and 6160 hex respectively. The videocipher system uses two of the 'seed keys' along with the I.D. # plus the 'monthly key' which is sent by General Instruments, and are used in the D.E.S. algorithm to generate a 'working key' which when processed with the encrypted data stream from the satellite feed will produce unscrambled data, ready to be converted to audio. Instructions for use of GENERIC chip ***Extraction of information from an ACTIVE videocipher*** To replace the battery in an ACTIVE videocipher or CLONE from and ACTIVE videocipher, the first step is to sample or read all the necessary data from the descramber. 1 - Insert the GK chip into the U-30 position of the VC2 board to be sampled. Make sure a 28 pin socket is installed first and be sure to observe the proper position of pin #1. 2 - Use the front panel of the VC2 and press 'SETUP' to obtain the 'MAIN MENU' It is recomemded that you record all activity with a VCR for a permanent record. 3 - Press #1 'INSTALLATION'. Copy down on paper and save the UNIT #. (example: UNIT: 0100 ABCD FF00) 4 - Again press 'SETUP' for the 'MAIN MENU'. You will now want to read the four 'seed keys' in U-7. Press #4 'VIEW U-7 KEYS'. Follow the instructions on the screen and enter your Password 9 3 0 8 0 8 0 8 and then press 'ENTER'. The screen will flash. Again press 'SETUP' and #2. The screen will now display the 'U-7 SEED KEYS'. Copy down on paper and save the four 'seed keys'. Make sure you identify each of the four 'seed keys' as 00, 01, 02, and 03. They will need to be in that format when re-loading. (see figure #2a- for sample guide) When all information is copied, press 'SETUP' twice to obtain 'MAIN MENU'. 5 - You will now want to read and copy down on paper the 'monthly keys'. Press #9 to obtain 'REPAIR MENU'. (see figure #1b) Select #1 'VIEW U-20'. A box with four asterisks will appear in the upper left corner of the screen. This box will now be referred to as the 'location indicator'. Enter the memory address of U-20 you wish to view. Press 6 1 0 0. Then the right arrow (---> ) to [enter]. The screen will now display U-20's memory addresses 6100 hex to 6120 hex. The first four lines of the screen (excluding the hex addresses in the top half line) contains one of the two 'monthly keys'. Copy down on paper and save these four lines. (see figure #2b- for sample guide) Press 'SETUP' #9 for 'REPAIR MENU'. Again press #1 'VIEW U-20'. This time enter memory address 6160. Then the right arrow ( --> ) to [enter]. The screen will now display U-20's memory addresses 6160 hex to 619F hex. The first four lines of the screen (excluding the hex addresses in the top half line) contains the second 'monthly key'. Copy down on paper and save these four lines. (see figure #2c- for sample guide) If an error has been made during an entry point, use the left arrow ( <--- ) to clear the 'location indicator' (box in upper left corner of screen). Then re-enter the correct address. You now have extracted all the information necessary to 'CLONE' other descramblers to the VC2 you just sampled. Remember, the information you copied on paper is important. KEEP IT SAFE! _______________ ***VC HACKER*** 1. INSTALLATION 4. VIEW U-7 KEYS 9. REPAIR MENU --------------- --------------------- (ENTER) - 0, 1, 4, 9 --------------------- ( 'MAIN MENU') ---------------------------------------------------------- -------------------- *** REPAIR MENU *** TO VIEW U7 USE SET 4 1 - VIEW U-20 2 - MODIFY U-20 3 - CHANGE BOX ID 4 - CHANGE BOX KEYS 0 - -------------------- ( 'REPAIR MENU' ) -------------------- U-7 SEED KEYS KEY 00 AB CD EF 00 01 02 03 KEY 01 98 76 54 32 10 AB CD KEY 02 FE DC BA 01 23 45 67 KEY 03 11 22 33 44 55 66 77 -------------------- (screen from 'SETUP'#4 'VIEW U7 KEYS') ---------------------------------------------------------- (SAMPLE GUIDE) UNIT : 0100 ABCD FF00 ID KEY 00 KEY 01 KEY 02 KEY 03 --- ------ ------ ------ ------ 01 00 01 02 03 00 AB 98 FE 11 AB CD 76 CD 22 CD EF 54 BA 33 00 32 01 44 01 10 23 55 02 AB 45 66 03 CD 67 77 Sample guide 'U-7 SEED KEYS' ---------- 6100 613F ---------- C420 3853 1308 0001 0203 0405 0607 0809 0A0B 0C0D 0E0F 0080 00C4 2000 04C4 2000 xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx -------------------- ( Screen from 'SETUP' #9 - #1 'VIEW U-20) ---------------------------------------------------------- U-20 MEMORY (monthly memory) ADDRESS : 6100 = C4 6110 = OA 6101 = 20 6111 = 0B 6102 = 38 6112 = 0C 6103 = 53 6113 = 0D 6104 = 13 6114 = 0E 6105 = 08 6115 = 0F 6106 = 00 6116 = 00 6107 = 01 6117 = 80 6108 = 02 6118 = 00 6109 = 03 6119 = C4 610A = 04 611A = 20 610B = 05 611B = 00 610C = 06 611C = 04 610D = 07 611D = C4 610E = 08 611E = 20 610F = 09 611F = 00 Sample guide 'MONTHLY KEYS' address 6100 ****************************************************************************** --------- 6160 619F --------- FF00 81C4 2138 5313 0001 0203 0405 0607 0809 0A0B 0C0D 0E0F 1000 8000 C421 0005 xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx ------------------- (screen from 'SETUP'#9 - #1 'VIEW U-20') ---------------------------------------------------------- (SAMPLE GUIDE) U-20 MEMORY (monthly key for address 6160 ADDRESS : 6160 = FF 6170 = 08 6161 = 00 6171 = 09 6162 = 81 6172 = 0A 6163 = C4 6173 = 0B 6164 = 21 6174 = 0C 6165 = 38 6175 = 0D 6166 = 53 6176 = 0E 6167 = 13 6177 = 0F 6168 = 00 6178 = 10 6169 = 01 6179 = 00 616A = 02 617A = 80 616B = 03 617B = 00 616C = 04 617C = C4 616D = 05 617D = 21 616E = 06 617E = 00 616F = 07 617F = 05 ***Programming (loading) of information into a NON ACTIVE videocipher*** ---------------------------------------------------------- After battery replacement or to 'CLONE' a 'brain dead' NON ACTIVE videocipher, you will have to 'load' the information (data) you extracted earlier. You have probably realized by now that the data you extracted earlier contains a long list of alpha-numeric characters. This is because the VC2 works in a hex format (0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F). But the VC2's front panel is strictly numeric (01,2,3,4,5,6,7,8,9). To access the alpha characters used in this hex format, use the VC2's front panel 'right arrow' (--> ) during any entry point when the 'location indicator' (box with asterisk in upper left corner of screen ) appears. Remember, the 'location indicator' only appears in the 'SETUP' #9 'REPAIR MENU' section, commands #1, #2, #3, and #4. Also remember that the 'right arrow' (--> ) is still used as the [enter] key. The KEYS-R-US software knows the difference between an [enter] and [alpha] just by where and when the 'right arrow' (--> ) is pressed. Observe the 'location indicator' (box with asterisk in upper left corner of screen). If you now press 'right arrow' (--> ), the asterisk (*) will now change and appear as an 'up arrow ( ), this indicates you now wish to use an alpha character. The front panel numbers 1,2,3,4,5,6 will now become alpha characters A,B,C,D,E,F. (EXAMPLE- 1=A, 2=B, 3=C, 4=D, 5=E, 6=F) If an error has been made during an entry point, use the left arrow (<-- ) to clear the 'location indicator' (box in upper left corner of screen), then re-enter. 1 - Insert GK CHIP into the U-30 position of the VC2 board to be loaded. 2 - Use the front panel of the VC2 and press 'SETUP' and #9 to obtain 'REPAIR MENU'. 3 - Press #3 'CHANGE BOX ID'. The screen will now display an 'entry code' (9 3 0 8 0 8 0 8 ). Enter this code, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will appear in upper left corner of screen. Now enter the first eight characters for the ID # you extracted earlier in step #3. (example: ID# extracted: 0100 ABCDFF00 - load : 0100ABCD ), then 'right arrow to [enter]. The screen will flash. Again press 'SETUP' and #9 to obtain 'REPAIR MENU'. 4 - Now press #4 'CHANGE BOX KEYS'. The screen will again display an 'entry code' (9 3 0 8 0 8 0 8). Enter this code, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will appear in upper left corner of screen. Above the 'location indicator'will appear the ID# you just entered in step #3. Now enter the 'seed keys' you extracted earlier. Start with 'seed key' 00. Be sure to start with the identifier 00 and then the remaining numbers of that 'seed key'. (example - 00xxxxxxxxxxxxxx ) When entry is completed, press 'right arrow' (--> ) to [enter]. The 'REPAIR MENU' will now appear. Again press #4 'CHANGE BOX KEYS' Enter 'entry code'. 'Location indicator' will appear. Now load 'seed key' 01. Be sure to start with the identifier 01 and then the remaining numbers of that 'seed key'. (example - 01xxxxxxxxxxxxxx ) When entry is completed, press 'right arrow' (--> ) to [enter]. The 'REPAIR MENU' will again appear. Press #4 'CHANGE BOX KEYS' Enter 'entry code'. 'location indicator' will appear. Now load 'seed key' 02. Be sure to start with the identifier 02 and then the remaining numbers of that 'seed key'. (example - 02xxxxxxxxxxxxxx ) When entry is completed, press 'right arrow' (--> ) to [enter]. The 'REPAIR MENU' will again appear. Press #4 'CHANGE BOX KEYS' Enter 'entry code'. 'location indicator' will appear. Now load 'seed key' 03. Be sure to start with the identifier 03 and then the remaining numbers of that 'seed key'. (example - 03xxxxxxxxxxxxxx ) When entry is completed, press 'right arrow' (--> ) to [enter]. Once the ID# and the four 'seed keys' are loaded, unplug (power down) the descrambler, and then plug back in (power up) so as to cause a 'reset'. Now press 'SETUP' and #1 to confirm that the ID# is correct. If the ID# displayed does not have 'FF' before the last two digits in the ID# (example - UNIT: xxxx xxxx FFxx) an error was encountered during the loading of one or all four of the 'seed keys'. To verify this, repeat step #4 (extraction section) 'VIEW U-7 KEYS". If corrections need to be made, repeat steps #3 and #4 (program section). 5 - Press 'SETUP' and #9 to obtain 'REPAIR MENU'. Now press #2 'MODIFY U-20'. This will allow you to enter the two 'monthly keys'. The screen will then display an 'entry code' (9 3 0 8 0 8 0 8). Enter this code, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will appear in upper left corner of screen. Now enter the U-20 memory address 6 1 0 0 then 'right arrow' (--> ) to [enter]. The 'location indicator' will now show the 'memory address' along with the hex value that is in that memory address plus two asterisks (example: 6100 xx**). To start entry of the data you wrote down earlier in step #5 (extraction section), enter the hex characters for memory address 6100, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will now increment to 'memory address' 6101. Next enter the data for address 6101, 6102, 6103, ect. and use the 'right arrow' (--> ) to [enter] after each location. Continue this procedure until all four lines are entered. If an error has been made during an entry point, use the left arrow (<-- ) to clear the 'location indicator' (box in upper left corner of screen), then re-enter the correct data. Now repeat the above procedure to enter data at 'memory address' 6160. Press 'SETUP' and #9 to obtain 'REPAIR MENU'. Again press #2 'MODIFY U-20'. The screen will then display an 'entry code' ( 9 3 0 8 0 8 0 8). Enter this code, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will appear in upper left corner of screen. Now enter the U-20 memory address 6 1 6 0 then 'right arrow' (--> ) to [enter]. To start entry of the data you wrote down earlier in step #5 (extraction section), enter the hex characters for memory address 6160, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will now increment to 'memory address' 6161. Next enter the data for address 6161, 6162, 6163, ect. and use the 'right arrow' (--> ) to [enter] after each location. Continue this procedure until all four lines are entered. If an error has been made during an entry point, use the left arrow (<-- ) to clear the 'location indicator' (box in upper left corner of screen ), then re-enter the correct data. 6 - One final entry must be made before the descrambler can work. The 'service ID' must be entered at 'memory address' 6247. Again press 'SETUP' and #9 to obtain 'REPAIR MENU'. Press #2 'MODIFY U-20'. The screen will then display an 'entry code' (9 3 0 8 0 8 0 8). Enter this code, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will appear in upper left corner of screen. Now enter the U-20 memory address 6 2 4 7 then 'right arrow' (--> ) to [enter]. Now enter a hex ' C4 ' and the 'right arrow' (--> ) to [enter]. This is the current 'service ID' General Instruments is using. One other 'memory address' needs to be changed. This will cause the 'SETUP' #1 screen to display the ' C4 " in the 'service ID' section. Again press 'SETUP' and #9 to obtain 'REPAIR MENU'. Press #2 'MODIFY U-20'. The screen will then display an 'entry code' (9 3 0 8 0 8 0 8 ). Enter this code, then press 'right arrow' (--> ) to [enter]. The 'location indicator' will appear in upper left corner of screen. Now enter the U-20 memory address 6 2 2 3 then 'right arrow' (--> ) to [enter]. Now enter a hex 'D0' and the 'right arrow' (--> ) to [enter]. When completed, press 'SETUP'. You are now finished. Special Note: Many times you will not have to replace the RAM in U20. But you should really do this each time a box is cloned, because the address of the monthly authorization codes are are changing frequently. The most reliable way to do this is to read the RAM in U20 of the "Master" box each time you do the cloning process and use a RAMSET file or the WRITE20 file to install this "fresh" RAM into the new clone box. If your having problems with the process this is probably the reason. Everything is working great but the authorization codeas are'nt where they are supposed to be. A reader cable is still the easiest and most reliable method of reading the RAM. Be sure and remove any password from the "Master" before you read the RAM in U20. If a password goes into a new box someone might not know what it is and have problems. If you don't know the password yourself use the the "REPAIR MENU" "Modify U20" abd change 6268 to "80" and the lockout-password function will be disabled. SPECIAL NOTE: Setting the "Location Set" line on Setup 1 screen. Write down the 6 bytes beginning at 61F9 on the Master Unit. Put this same information in the clone unit at the same address and the clone unit will read "Location Set" at the bottom af the Setup 1 screen.  Downloaded From P-80 International Information Systems 304-744-2253