407 lines
17 KiB
Plaintext
407 lines
17 KiB
Plaintext
---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 13 of 20
|
|
|
|
|
|
-------------------------[ Pay Per View (you don't have to)
|
|
|
|
|
|
--------[ Cavalier[TNO]
|
|
|
|
|
|
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
|
|
I......................................................... Introduction
|
|
II........................................................ Automatic Windows
|
|
III....................................................... The Login Window
|
|
IV........................................................ The Main Menu
|
|
V......................................................... Other Menus
|
|
VI........................................................ Converter Types
|
|
VII....................................................... Scrambler Types
|
|
VIII...................................................... Scrambling Modes
|
|
IX........................................................ Security Notes
|
|
X......................................................... Conclusion
|
|
|
|
|
|
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
|
|
|
|
|
.--------------.
|
|
| Introduction |
|
|
`--------------'
|
|
|
|
General Instruments sells more cable television equipment than any other
|
|
manufacturer. Included in their product range is the ACC-4000. The
|
|
ACC-4000 is a system that controls Pay-Per-View television.
|
|
|
|
The ACC-4000 is a PC running SCO Open Desktop v3.0. Earlier ACC-4000s
|
|
ran Interactive Unix. The interface for the ACC-4000 is X-Windows based,
|
|
so you can hack your way to free pron through an attractive GUI.
|
|
|
|
The ACC-4000 is often referred to as an addressable system. This means
|
|
that each set-top-box can be addressed independently. This allows every
|
|
subscriber to select their own programming -- and it allows the cable
|
|
television company to bill the subscriber for every television show the
|
|
subscriber selects.
|
|
|
|
The cable television signal is normally sent by satellite to a cable
|
|
headend. To translate this into terms that may be more comfortable to
|
|
Phrack readers, the cable head end is similar to a telephone company
|
|
central office. At the headend, the signal is scrambled to make it more
|
|
difficult to view without paying.
|
|
|
|
The ACC-4000 then routes the signal from the headend to the appropriate
|
|
set-top-boxes. It does this by merging control information into the data
|
|
stream before the data stream reaches the set-top-boxes. The ACC-4000
|
|
can talk to one-way, FONE-way, and two-way set-top-boxes. The ACC-4000
|
|
works over standard RF cable, fiber optics, microwave, and even
|
|
telephone wiring.
|
|
|
|
The ACC-4000 is capable of sending billing information to a cable
|
|
television billing system, such as CableData, CSG, or Wizard.
|
|
|
|
The ACC-4000 is a small system. The unit I examined was using a 486DX-50
|
|
processor. Nevertheless, one ACC-4000 can manage a half a million set
|
|
top boxes.
|
|
|
|
Often you will find other General Instruments systems connected to the
|
|
ACC-4000. A Data Provider Translator system can take input from outside
|
|
sources and merge them into the data stream going to the set-top-boxes.
|
|
This provides features like program guides, VCR IR codes, weather data,
|
|
Near-Video-On-Demand (NVOD) schedules, or even custom logos and menus. A
|
|
Message Editor system can be used to create custom "barker" messages for
|
|
cable subscribers.
|
|
|
|
|
|
.------------------.
|
|
| Automatic Windows|
|
|
`------------------'
|
|
|
|
In addition to the login window, the ACC-4000 opens two other types of
|
|
windows automatically to display information on the console. Using
|
|
Xwatchwin to view these windows remotely can help you figure out what is
|
|
going on with the system. The Windows are:
|
|
|
|
. Logger Window
|
|
. Wire Link X
|
|
|
|
The window titled "Logger Window" contains status and error messages.
|
|
|
|
The windows titled "Wire Link X" show data going from the ACC-4000 out
|
|
to other systems, usually the billing system. There is one "Wire Link X"
|
|
window for each system the ACC-4000 is feeding data.
|
|
|
|
|
|
.------------------.
|
|
| The Login Window |
|
|
`------------------'
|
|
|
|
The login window is extremely informative and looks something like this:
|
|
|
|
.---------------------------------------------------------------------------.
|
|
| ACC4000 Help |
|
|
| ~ ~ |
|
|
|---------------------------------------------------------------------------|
|
|
|LOGIN | Login to ACC4000 | | |
|
|
|---------------------------------------------------------------------------|
|
|
| General Instruments Addressable Control System |
|
|
|User Name: ############################# Password: ######## |
|
|
| COPYRIGHT (C) 1996. General Instrument Corporation |
|
|
|---------------------------------------------------------------------------|
|
|
|Site Number: 866 Geocode: 303 Terminal: tno:0.0 Software Version: V8.66 |
|
|
| |
|
|
| Number ANICS Installed: 1 Number of Subscriptions: 16 |
|
|
| Parallel Data Streams: 1 1st Subscription Service Code: 1 |
|
|
| List Maintenance: HOST Number of Simultaneous Events: 48 |
|
|
| Number List Maps: 8 1st Event Service Code: 89 |
|
|
| Return Frequency: 08.9 Mhz Data Stream Baud Rate: 13.97 Khz |
|
|
| |
|
|
| Data Base Size: 288K Subscribers Converter ID Usage: 32K Groups |
|
|
| |
|
|
| 1st group 1-way 2nd group phone 3rd group phone 4th group 2-way |
|
|
| 5th group 2-way 6th group 2-way 7th group 2-way 8th group 2-way |
|
|
| 9th group 2-way |
|
|
| |
|
|
|---------------------------------------------------------------------------|
|
|
|Enter operator name |
|
|
| |
|
|
| F6:Clear Field F7:Field Help F8:Form Help |
|
|
`---------------------------------------------------------------------------'
|
|
|
|
|
|
Site Number is assigned by General Instruments. This number is
|
|
also stored in the set-top-box.
|
|
|
|
Geocode is a optional number that may be assigned by the cable
|
|
television company to segment it's set-top-boxes into groups.
|
|
|
|
Terminal is the name of the X-windows terminal you are
|
|
connecting from.
|
|
|
|
Software Version is the release number of the ACC-4000 software.
|
|
|
|
Number ANICS Installed is the number of transmission devices
|
|
installed.
|
|
|
|
Parallel Data Streams is the number of simultaneous
|
|
transmissions into the data stream.
|
|
|
|
List Maintenance is always set to HOST. In the future, General
|
|
Instruments plans to allow the an ANIC to maintain the list of
|
|
authorizations.
|
|
|
|
Number List Maps is the size of the queue between the ACC-4000
|
|
and the ANIC.
|
|
|
|
Number of Subscriptions is the number of service codes allotted
|
|
for subscriptions.
|
|
|
|
1st Subscription Service Code is the first available scrambler
|
|
tag for descrambling subscriptions.
|
|
|
|
Number of Simultaneous Events is the maximum number of
|
|
simultaneous Pay-Per-View (PPV) events that can be available at
|
|
one time.
|
|
|
|
1st Event Service Code is the first available scrambling tag for
|
|
Pay-Per-View PPV events.
|
|
|
|
Return Frequency is the transmit frequency used by two-way set
|
|
top boxes. The range is normally 8.3 - 10.4Mhz.
|
|
|
|
Data Stream Baud Rate is the rate of transmission of the data
|
|
stream.
|
|
|
|
Data Base Size is the maximum number of set-top-boxes the system
|
|
is configured for.
|
|
|
|
Converter ID Usage is always set to 32k. This means that 32k
|
|
set-top-boxes can be grouped into a partition.
|
|
|
|
Groups shows the division of the total number of set-top-boxes
|
|
(data base size) into partitions.
|
|
|
|
|
|
.---------------.
|
|
| The Main Menu |
|
|
`---------------'
|
|
|
|
The Main Menu is the gateway to all other menus and looks something like
|
|
this:
|
|
|
|
.---------------------------------------------------------------------------.
|
|
|MAINMENU | Main Menu of Screen Options | |records found |
|
|
| |
|
|
|.-------------------------------------------------------------------------.|
|
|
|| ||
|
|
|| Main Menu of Screen Options ||
|
|
|| ||
|
|
|| 1. Converters Convs 7. User Information Users ||
|
|
|| 2. Services/Schedules Svcs 8. Control System Functions System ||
|
|
|| 3. Headend Equipment Headend 9. Reports Reports||
|
|
|| 4. Converter Types ConvTyp 10. Data Path Configuration DataCfg||
|
|
|| 5. Data Files Files 11. Message Management MsgMgt ||
|
|
|| 6. Business System Gateway Gateway 12. Return to Login Exit ||
|
|
|| ||
|
|
|| ||
|
|
|| Enter Selection: ||
|
|
|| ||
|
|
|`-------------------------------------------------------------------------'|
|
|
| |
|
|
|---------------------------------------------------------------------------|
|
|
|Enter selection number or press function button |
|
|
| |
|
|
| F6:Clear Field F7:Field Help F8:Form Help |
|
|
`---------------------------------------------------------------------------'
|
|
|
|
|
|
.-------------.
|
|
| Other Menus |
|
|
`-------------'
|
|
|
|
The ACC-4000 has many other menus that are accessed through the Main Menu.
|
|
I will not waste time and space here describing these menus. If you gain
|
|
access to an ACC-4000, the online help should be sufficient to aid you
|
|
in using the system.
|
|
|
|
These menus allow you to perform functions such as:
|
|
|
|
. Managing set-top-boxes
|
|
. Managing headend scramblers
|
|
. Sending messages to subscribers
|
|
. Performing opinion polls on subscribers
|
|
. Configuring available Pay-Per-View (PPV) events
|
|
. Managing purchase data
|
|
. Maintaining the ACC-4000 database
|
|
. Creating reports
|
|
|
|
|
|
.-----------------.
|
|
| Converter Types |
|
|
`-----------------'
|
|
|
|
The ACC-4000 system supports a large number of set-top-boxes:
|
|
|
|
|
|
Type Model Name Partition Type
|
|
------------------------------------------------------------------------------
|
|
1 DRZ STARCOM II, 400, 500 One-Way
|
|
(PROM based)
|
|
2 DRZA-*A, DRZP-*A STARCOM 450 One-Way
|
|
(PROM based, 128 tags) STARCOM 450/P3
|
|
3 DRZI*-*A STARCOM 450/P3 One-Way
|
|
(PROM based, 256 tags)
|
|
4 DRZI*-AT STARCOM 450 Two-Way
|
|
5 XT5-*1* STARCOM V One-Way
|
|
6 XT5-*2* STARCOM V Two-Way
|
|
7 DRZI*-*AV STARCOM 450 One-Way
|
|
8 DP*5-*3* STARCOM VI+ Fone-Way
|
|
9 DL4/DL4A STARCOM V One-Way
|
|
10 DP*5-*1* STARCOM VI+ One-Way
|
|
11 DP*5-*2* STARCOM VI+ Two-Way
|
|
12 DPBB-*1* STARCOM VI+ One-Way
|
|
13 DPBB-*3* STARCOM VI+ FONE-Way
|
|
14 DPBB-*2* STARCOM VI+ Two-Way
|
|
15 DP711*, DPV721*, DPV721*/C1 STARCOM 7100/7200 One-Way
|
|
16 DP713*, DPV723*, DPV723*/C1 STARCOM 7100/7200 FONE-Way
|
|
17 DP712*, DPV722*, DPV722*/C1 STARCOM 7100/7200 Two-Way
|
|
18 DPBB7-*1* STARCOM 7300 One-Way
|
|
19 DPBB7-*3* STARCOM 7300 FONE-Way
|
|
20 DPBB7-*2* STARCOM 7300 Two-Way
|
|
21 DPBB-*1*-M1 STARCOM VI+ M/S One-Way
|
|
22 DPBB-*3*-M1 STARCOM VI+ M/S FONE-Way
|
|
23 DPBB-*2*-M1 STARCOM VI+ M/S Two-Way
|
|
24 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 One-Way
|
|
25 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 FONE-Way
|
|
26 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 Two-Way
|
|
27 DCR DCR One-Way
|
|
28 DCR 3000S/4000S DCR One-Way
|
|
30 CFT2000/2100 CFT2000/2100 One-Way
|
|
31 CFT2000/2100 CFT2000/2100 FONE-Way
|
|
32 CFT2000/2100 CFT2000/2100 Two-Way
|
|
33 STARPORT STARPORT One-Way
|
|
34 STARPORT (not implemented) STARPORT FONE-Way
|
|
35 STARPORT (not implemented) STARPORT Two-Way
|
|
36 CFT2200 CFT2200 One-Way
|
|
37 CFT2200 CFT2200 STARFONE FONE-Way
|
|
38 CFT2200 CFT2200 STARVUE Two-Way
|
|
39 CFT2900 CFT2900 One-Way
|
|
40 CFT2900 CFT2900 FONE-Way
|
|
41 CFT2900 CFT2900 Two-Way
|
|
42 Sega Sega One-Way
|
|
|
|
|
|
.-----------------.
|
|
| Scrambler Types |
|
|
`-----------------'
|
|
|
|
The ACC-4000 system supports several different types of scramblers at the
|
|
headend, including:
|
|
|
|
STARPACK Service Encoder (SSE)
|
|
|
|
An older scrambler that scrambles with standby and 6db constant
|
|
sync-suppression scrambling modes.
|
|
|
|
Digital Scrambler/Encoder (DS/E)
|
|
|
|
An older RF scrambler.
|
|
|
|
Digital Video/Encoder (DV/E)
|
|
|
|
An older baseband scrambler, used to further scramble DS/E
|
|
signals.
|
|
|
|
Video Processor/Encoder (VP/E)
|
|
|
|
A DS/E and a DV/E together.
|
|
|
|
Modulating Video Processor (MVP) and MVPII
|
|
|
|
A newer scrambler.
|
|
|
|
Modulating Video Processor (MVP) II-DIU
|
|
|
|
A MVPII with a Data Inserter Module (DIM) to enable data insertion.
|
|
|
|
|
|
.------------------.
|
|
| Scrambling Modes |
|
|
`------------------'
|
|
|
|
The ACC-4000 controls scramblers using several modes of scrambling, including:
|
|
|
|
. Sync Suppression
|
|
. Video Inversion
|
|
. Audio Inversion
|
|
|
|
Supported sync suppression submodes are:
|
|
|
|
. Standby
|
|
. Clear, 0db constant
|
|
. 6db constant
|
|
. 10db constant
|
|
. Scene change, 3 seconds
|
|
. 6/10 pseudo-random, 30 seconds
|
|
. 6/10 pseudo-random, 1 minute
|
|
. 6/10 pseudo-random, 16 tics
|
|
. 6/10 pseudo-random, 3 seconds
|
|
|
|
When using scene change or 6/10 pseudo-random sync suppression, the
|
|
ACC-4000 supports a number of dynamic mode types:
|
|
|
|
. Pseudo-random 6/10/clear
|
|
. Pseudo-random 6/clear
|
|
. Pseudo-random 10/clear
|
|
. Pseudo-random 6/10
|
|
. Linear 6/10/clear
|
|
. Linear 6/clear
|
|
. Linear 10/clear
|
|
. Linear 6/10
|
|
|
|
In addition, you can set the interval between dynamic mode time changes
|
|
in hours, minutes, seconds, or tics.
|
|
|
|
Supported video inversion submodes are:
|
|
|
|
. Clear
|
|
. Scene change field inversion
|
|
. Constant video inversion
|
|
. Timed field inversion
|
|
|
|
Note: Video and audio inversion only work with baseband set-top-boxes.
|
|
|
|
|
|
.---------------.
|
|
| Security Notes|
|
|
`---------------'
|
|
|
|
These systems normally have modems for use by both General Instruments
|
|
personnel and cable company personnel. General Instruments personnel
|
|
dial in to diagnose problems with the system. Cable company personnel
|
|
dial in to change Pay-Per-View (PPV) programming or to configure
|
|
customer set-top-boxes.
|
|
|
|
Any uncollected purchases are lost when a set-top-box is initialized.
|
|
To preserve uncollected purchases, the operator will do a Refresh
|
|
instead of an Initialize. If you can talk the operator into doing an
|
|
Initialization instead of a Refresh, any uncollected purchases not
|
|
already forwarded to the billing system will be lost.
|
|
|
|
Purchases are stored as integers. Older set-top-boxes were limited to
|
|
storing 16 purchases. Newer set-top-boxes are limited to storing 63
|
|
purchases.
|
|
|
|
|
|
.------------.
|
|
| Conclusion |
|
|
`------------'
|
|
|
|
If you can access a system such as the ACC-4000, you can have great fun.
|
|
Be careful when giving everyone in your city free access to WWF.
|
|
|
|
|
|
----[ EOF
|
|
|