

                      ======================

                       THE VIDEOCRYPT HACKS
                       
                      ======================



  The following paragraphs detail the various hacks on the
VideoCrypt system. To date all of them, have been countered by Sky
and News Datacom.


  The first hack occurred in 1990. The Morley Research hack was         
named after the company who initially marketed the hack. Unfor-         
tunately, such actions within the boundaries of the UK are illegal. 


  The second hack was more or less known about among hackers            
though it was never believed feasible. It was when the bizoids got      
hold of it that it became a problem for Sky.                             


  The third hack detailed is the KENtucky Fried Chip. This one was a    
departure from the hacks that preceded it. It marked the first time that 
the actual software in the VideoCrypt decoder had been used against     
the system.



                     ==========================

                      The Morley Research Hack                                        

                     ==========================

  The Morley Research Hack of 1990 had Sky very nervous.               
Someone had found a way to stop Sky from turning off the cards. The   
basic method used was the interception and redirection of the write    
routine. This was carried out with a circuit that was connected     
between the card and the card reader.


  The code and the diagram are from the original hack. This has  
been confirmed by reliable sources. This is, apparently another
version. Either way since the operation is being run from a UK   
address, the odds are that Sky will soon pay a visit. Since it is   
technically illegal in the UK to hack Sky. 

 
  The software produces another card identification number for the    
decoder. A few years ago this particular hack was successful but      
apparently Sky bought a few and were able to stop the hack.

 
  The basis for the hack is that it tries to confuse the decoder into  
thinking that the card that it has inserted has a different identity  
number.


      8748 Microcontroller Program
      ----------------------------

      0000 04 09 00 04 09 00 00 04
      0008 09 23 13 39 27 3A 04 10
      0010 14 58 D3 AC 96 10 8A 02
      0018 F8 D3 6F 96 10 14 58 D3
      0020 81 C6 48 FF D3 83 C6 4A
      0028 FF D3 85 C6 4C FF D3 87
      0030 C6 4E FF D3 89 C6 50 FF
      0038 D3 8B C6 52 FF D3 8D C6
      0040 54 FF D3 8F C6 56 04 70
      0048 04 E8 04 F1 24 7B 24 38
      0050 24 3C 24 45 24 49 24 6B
      0058 09 47 67 F6 58 BE 06 EE
      0060 5F BE 08 74 78 09 47 67
      0068 FF F7 AF EE 63 14 78 14
      0070 78 F9 A8 FA A9 FF AA 83
      0078 BD 0D ED 7A 8A 07 9A 00
      0080 83 AF 09 53 10 96 82 49
      0088 10 34 89 BE 08 BC 00 FF
      0090 F7 AF E6 95 1C 27 F7 F7
      0098 43 10 39 34 92 EE 8F FC
      00A0 53 01 D3 0l F7 43 10 39
      00A8 34 92 23 13 39 34 92 34
      00B0 92 83 AF 09 53 10 96 B3
      00B8 23 15 39 34 89 BE 08 BC
      00C0 00 FF F7 AF E6 C7 1C 27
      00C8 F7 F7 F7 F7 43 15 39 34
      00D0 92 EE C1 FC 53 01 D3 0l
      00D8 F7 F7 F7 43 15 39 34 92
      00E0 23 13 39 34 92 34 92 83
      00E8 8A 02 23 12 39 89 0l 04
      00F0 10 8A 04 BB 0A 14 58 D3
      00F8 83 96 F5 23 FE 14 81 23
      0100 FB 14 81 23 04 14 81 23
      0108 07 14 81 23 0B 14 81 23
      0110 FB 14 81 23 FF 14 81 EB
      0118 13 04 10 8A 08 BB 18 14
      0120 58 D3 E6 96 1F 23 85 14
      0l28 81 23 7F 14 81 00 00 00
      0130 23 FF 14 81 EB 30 04 10
      0138 8A 10 04 10 8A 20 23 12
      0l40 39 8A 0l 04 10 8A 40 04
      0148 10 8A 80 BB 0A 14 58 D3
      0l50 FC 96 4D 23 D5 14 B2 23
      0158 4F 14 B2 23 E0 14 B2 23
      0160 FB 14 B2 23 FF 14 B2 EB
      0168 63 04 10 8A 80 14 58 D3
      0170 8F 96 6D 23 B0 14 81 23
      0l78 15 14 81 23 06 14 81 23
      0l80 16 14 87 23 59 14 81 04
      0l88 70 9A 00 BD 07 ED 8D 8A
      0l90 80 83 9A 00 BD 09 ED 96
      0198 8A 80 00 83 9A 01 ** **

Instructions

  Change bytes &174, &178, &17C, &180, &184 to random values         
from &00 to &FF to create a new card ID number. This will reduce the 
chance of the decoder receiving a deactivation code which matches
that of the card the decoder thinks it has installed. 


See Fig 2 (FIG2.PCX on the disk) for Circuit Diagram.


The Morley Research hack was intended to be constructed without        
a card reader assembly as found in the decoders. Instead an               
arrangement Of connectors and a clamp were intended to hold the
card in the correct position.


  The unit was meant to be inserted between the card and the
decoder. The connection to the decoder could be hardwired or a PCB
with the card connector pad array could be used. The PCB card was  
the more difficult of the two. The actual fibreglass G10 PCB material
thickness is about twice that of a normal smart card. The typical smart
card thickness is 0.7 mm. The PCB had to be filed down with a
commercial sander.


  The actual circuitry of the Morley Research device can be
constructed on a PCB or, with careful layout, Veroboard. The one
thing that was decidedly unusual was the LED connected on the
multiplexer. It would dump current into the multiplexer when turned
on.


 While the unit will not work on the present Sky cards, it did work     
well enough to provoke Sky. The modification Sky used apparently         
used a different address so the unit was left waiting for an instruction
to write to a particular address that never arrived. 


  While this hack was defeated, it was the first attempt at interfering
with the data flow between the card and the decoder. It proved to Sky
that News Datacom and Thomson had not designed the most                        
pirate proof system yet devised. Perhaps it was pirate proof to them             
because they could not figure out how to hack it. It was not the first          
time that somebody thought they had invented an unhackable system.              


  The hack might have been called the Yamamoto hack, for the                    
situation was similar. During World War Two, the Japanese forces               
believed that they had invented an unbreakable cipher. They did not            
change it and transmitted all of their high security traffic in this cipher
Admiral Yamamoto was to travel by aircraft to one of the bases and              
his flightplan had been transmitted. A flight of American P-38
Lightning's was waiting for his aircraft.



                      =======================

                      The Infinite Lives Hack

                      =======================

  The VideoCrypt decoder was supposed to be a dumb terminal
devoid of any great secrets. Perhaps it was but there was a very
serious flaw in the card. it required a voltage greater than 17 Volts to
overwrite the card.


  Rumours started floating around among the hackers that it was
possible to modify the decoders so that the cards could not be
invalidated. It was therefore possible for a Sky smart card to last
indefinitely or at least until the next ROM change.


  This hack was referred to as the "Infinite Lives Hack". Messages
appeared on computer bulletin boards detailing the operation. An
operation which involved snipping a few wires, soldering a few others
and installing a zener diode.


  Basically, the hack involved limiting the voltage on the card's
programming connector. The voltage on this connector had to be in
the region of 21 Volts for the card to be reprogrammed or written to.
Cutting the voltage to this connector would have meant that the card
and therefore the decoder would not work. Instead, the voltage was
limited to a value, typically 15 Volts which would allow the card to
operate but would not allow the card write  operation to be successful.


  A plethora of devices appeared on the market. The cost of these
units ranged from about thirty pounds to over one hundred pounds.
One pirate was offering a sample quantity of one hundred units for
about four thousand dollars. Plainly these devices were little more
that voltage limiters but they exploited a serious flaw in the
VideoCrypt system. The publicity information on some of these
products also claimed that they worked on D2-MAC Eurocrypt.


  The Infinite Lives hack prevented the card's EPROM memory from
being written to and therefore Sky could not turn off the cards. On the
surface this would not seem too a serious problem. Of course when
examined in detail, it was a problem of devastating proportions.


  The actual problem lay with the Quickstart cards. A wonderful
marketing invention by someone with a monumental ignorance of pay
television security. These cards would be turned on by Sky over the
air. They would allow a customer to walk into a shop, sign up and be
authorised within a few hours.


  There were so many dead people signed up for Sky that every day
was a mini Last Judgement. False names and addresses were used
with a professionalism that would impress the best Spies. Even some
of the dealers got in on the act.


  Of course most, if not all, of the Quickstart smart cards were
destined for use in mainland Europe. The procedure up to the Infinite
Lives hack was that the card would be authorised and then taken and
kept out of a decoder for a month or two. Sky would send out the
card identity in the blacklist at various times and since the card was
not in a decoder it could not be switched off. The blacklist is
transmitted on all Sky channels for maximum effectiveness. 


  The Infinite Lives hack caused a mushroom effect in the trade of
the Quickstart cards in Europe. It was now possible to get a card that
could not be switched off and was valid almost indefinitely. Normally if
a Quickstart card in Europe gets nuked, the supplier has to provide
another. The Infinite Lives hack meant that the risk of the cards being
switched Off was minimised. The cards held back in reserve by the
suppliers were immediately brought on to the market.


  The situation was getting out of hand and Sky were forced to act.                   
They brought out a new card issue. The Version O6 cards                              
incorporated a voltage tripler on the card wafer so that the Vpp
voltage was not necessary. This solved the problem. It was not a                     
cheap solution. It was estimated that it cost Sky over £7 million to                 
replace the cards.


  Sky's recovery from the Infinite Lives hack was a perfect
demonstration of the main strength of smart cards. It allows the                     
recovery of a compromised system. Smart cards are not impossible to
reverse engineer, it is just expensive and hard to do so. The periodic               
change of cards is more of a deterrent to hacking than a card change                 
when the system is compromised.


  While the smart cards on the Sky services are issue O7 versions                     
many of the other VideoCrypt services are using old issue cards that
may well be susceptible to this hack. In many cases, it is not                      
economically feasible for the channel to upgrade.                                    


  The amazing thing is that Sky and News Datacom had a very good                      
opportunity to assess the scale of the Infinite Lives Hack and they                   
never took it.
 

  If they had included a routine in the O6 issue smart cards to test the
EPROM write voltage, then it would have been possible to switch off       
the cards in a modified decoder. Of course the message "Please           
Contact Sky" could have been flashed up on the on screen graphics.
The user of the hacked decoder would then have to telephone Sky to
have the card turned on again. That way Sky could make a database       
of the hacked decoders.  


  There were some rumours at the 1992 Cable And Satellite Show           
that there was another modification to stop the cards getting turned
off. It involved using a capacitor to skew the turn off data. 


  At the Subscription Television 1992 conference a delegate from          
News Datacom said that the fault for this hack lay with the card
manufacturers rather than News Datacom. This was a rather strange         
statement considering that it would only require a few bytes of code to   
check whether the card had been written to. The same type of check        
could have been used to check if a KENtucky Fried Chip was in
operation.

 
  The crypto processor would have been instructed over the air to            
read a certain address in the card's memory and store the result as 
(A). Then it would have been instructed to write the new data, (B), to 
the address. The next step would be to read the new data from that
address and store the result as (C). 


  The check is simply a series of comparisons.                              

     1.   (A) should not equal (C)

     2.   (B) should equal (C)


  If either of these comparisons fail then the card cannot be written to    
and either the decoder has been modified for the Infinite Lives Hack       
or the KENtucky Fried Chip Hack



                        =======================

                        The KENtucky Fried chip

                        ======================= 

The KENtucky Fried Chip may well be the greatest threat that Sky
has faced so far. It is certainly the one hack that questioned the
credibility of VideoCrypt as a viable scrambling system.
  

In one fell swoop it removed what is supposed to have been one of
the strongest points of the VideoCrypt system - its over the air
addressing.
 

  The KENtucky Fried Chip worked by stopping the turn off codes
being sent to the card. The card cannot be turned off. The card write
routines have either been altered or completely removed. This by
extension would mean that the card could not be authorised for other
channels while the KENtucky Chip is in operation.          

 
  The name of the chip is a hacker's joke. It is named after the Sky's
head of security Mr. Ken Crouch. Apparently he was being too
successful in stamping out some Grey Market card operations.
 

  VideoCipher ll and EuroCypher used the philosophy of the
Embedded Secure Processor. VideoCrypt relied on the Detachable
Secure Processor philosophy and reduced the decoder to the status
of a dumb terminal. There are some good arguments on each side.


  To date it has been the Embedded Secure Processor systems that         
have suffered from piracy. VideoCipher ll and FilmNet's Digital Audio   
have been hacked proving that the Embedded Secure Processor is          
anything but. EuroCypher was BSB's system. The amount of hackers        
trying to hack a system is a very good gauge of the success of a       
channel. BSB was considered by the Blackbox Industry to be a waste
of time.


   The fatal flaw in the VideoCrypt decoder was the unprotected
8052. This microcontroller handles the decoder housekeeping. It also
handles the secure microcontroller - card interface. 

 
   It is standard procedure to blow the read fuses in decoder
microcontrollers. This prevents unauthorised viewing of the stored      
program. Strangely, the read fuses on the official 8052 were not       
blown. In the Blackbox industry this was looked upon as a screw-up of   
the highest magnitude. There may have been a valid explanation        
though.

  Apart from the power supply section, the commonest failed
component in the faulty VideoCrypt decoders is the 8052. In light of
recent hacks, this problem would have increased. It would therefore
make sense if. it was possible to replace the chip without having to
purchase an official model.


  Many service centres will, in the case of a failed 8052 either
replace it with an 8052 from a junked decoder or with an 8752
programmed with the program from an official 8052. Perhaps
Thomson and News Datacomm had this in mind when choosing not
to blow the read fuses.


  Sky and News Datacom successfully countered version 1.O of the
KFC. Version 1.1 was actually ready far launch when Sky issued the
O7 smart cards. The software in the new batch was different from the
previous batch. As a result, the version 1.0 and 1.1 KFCs did not
work. Then there is always version 1.2.


  News Datacom do not seem to have learned very much from the
VideoCipher ll fiasco. One of the first hacks used a piggy back
arrangement for the EPROM. The hacker EPROM and the official
EPROM were mounted on a PCB with a multiplexer and a DIL socket.
Whenever necessary the official EPROM could be switched back into
circuit.


 The logical progression of this would be a KFC and the official
8052 on PCB with multiplexing. The multiplexing would be controlled
by a fast third processor. The KFC and the official 8052 would be
running in parallel. When the validity of the official 8052 is checked,
the third processor can return the output of the official 8052. The third
processor would have to interpret the commands to run the validity
check.



             ===========================================

             Season7 -- Software Sky smart card emulator

             ===========================================

  This software allows you to connect your PC to a Videocrypt pay-TV
decoder and watch the British Sky Broadcasting Network channels on the
European ASTRA satellites without a subscription and a smart card. You
will need a Videocrypt decoder with a card slot, an IBM AT compatible
PC with at least a 12 MHz i286 processor, a serial port and DOS 3.3 or
higher and you will have to build a small interface circuit as
described in the file ADAPTER.TXT.


IMPORTANT: It is illegal to watch pay-TV programs without a subscription
           in the countries in which a regular subscription is available
           (for the Sky channels, these are currently Great Britain and
           Northern Ireland). The legal situation in other countries
           is unclear, but as it is currently tolerated that e.g. in
           Germany and Sweden so-called pirate or clone cards are sold,
           using this software in other countries should be no problem 
           at the moment. There is perhaps also no problem if you have
           already a regular Sky subscription for all channels and want
           to use this software only for educational purposes in
           Great Britain and Northern Ireland. THE AUTHOR OF THIS SOFTWARE
           TAKES NO RESPONSIBILITY FOR THE LEGALITY OF USING AND
           DISTRIBUTING THIS SOFTWARE. As far as the author is concerned,
           this software may be used and distributed outside Great Britain 
           and Northern Ireland 



  Season7 implements currently the secret algorithm in the 07 series
card. It is very likely, that this software will malfunction after Sky
switches to the codes in the new 09 series cards which are already
being distributed to customers. Updating this software would be very
easy, if the author got the new secret algorithm for the 09 cards, but
this is unlikely at the moment just as it is unclear if clone cards
will be available after new new 09 card codes have been activated.


How do I use Season7
--------------------

  You have to build an electrical interface between the decoder's card
slot and a serial port of your PC. The file ADAPTER.TXT that comes with
this package gives you more technical information about how to do this.
Then start SEASON7.EXE and give as a command line argument the port
number to which you connected your interface (default is COM2 if you
don't give a number).

E.g. enter

	SEASON7 1

if your interface is connected to COM1. If the text 'RESET' or
'Decoding ...' doesn't appear after a few seconds, then please switch
the channel in order to cause a card reset in the decoder. This
software has currently only been tested with a PACE VC100 decoder, but
it is expected to work with all other decoders, too.


  You can leave the program by pressing either q, x or ESC and you can
activate and deactivate a debugging mode by pressing d. In the
debugging mode, all data packets exchanged between the card and the
decoder are listed. By pressing l you can write the last (up to 1000)
crypto messages to file VCLOG. As the log file time stamps are UTC, you
should define your local time zone in environment variable TZ (e.g. set
TZ=MET-1DST in Middle Europe). On slow computers (e.g. an i286
processor with 12 MHz is slow enough), the time needed for the
debugging output might already be too long and the decoder will get a
timeout and send a RESET signal. 


  As the protocol is quite time critical, try to use only simple DOS (no
DOS compatibility box in another operating system) and if you still
have problems, remove unnecessary TSR programms that might steal time
and interrupts from Season7. 

  
  On fast machines (e.g. with an i386 or i486 processor), it is possible
that the PC sends the bytes too quickly for the decoder. Then you'll
get a RESET message from time to time and the image won't be decoded
always. In this case you'll have to tell Season7 to wait 1 or 2
milliseconds after each byte. This is possible using the command line
options wb1 or wb2 or by pressing '+' or '-' while the software is
running. E.g. start the program with 'season7 2 wb1' in order to use
COM2 and wait 1 ms after each byte. On an old 12MHz i286 system
however, this additional wait time is not necessary and with wb1, such
a PC would even be too slow.

  
  While decrypting, Season7 shows you two hexadecimal numbers from the
decoder's data packets. The first one is used to select the secret key
in the card, so if this one changes one day, Sky has activated new
codes. The second number identifies the channel. If the numbers bore
you, better switch off the PC monitor in order to save power while
watching TV.


Who wrote Season7
-----------------

  Due to the not 100% clear legal situation that surrounds clone cards,
etc., I prefer not to state my name here. It should be sufficient to
know for you that Season7 was written by a German computer science
student just for fun and I have no commercial pay-TV piracy intentions.
The author and many other Videocrypt hobby experts who know how to
contact me periodically read the USENET group alt.satellite.tv.europe,
so please post there a message if you have problems, questions,
suggestions, bug reports, etc. regarding this software.


  Season7 uses a public domain serial port assembler routine which has
been published by David Kessner some time ago.


  This software was primarily written for European Star Trek fans outside
Great Britain who don't have a chance to get a regular Sky subscription
and have no other way of watching the undubbed version of their
favourite SF series. I don't want to cause any harm to Sky and I even
asked them for a regular subscription some time ago, but they refused
to sell one to Germany. So they have to live with the consequences of
attracting the interest of high tech freaks to the technical details of
their access control system. :-)


Does the existence of Season7 mean that Videocrypt is fully hacked?
-------------------------------------------------------------------

  No, not at all. Videocrypt continues to be a very secure access control
system. Season7 was only possible, because one hacker in Europe got in
an unknown way access to the secret key and algorithm in Sky's 07
series smart card. This knowledge will be completely useless once Sky
has exchanged all customer cards with the 09 series cards that surely
contain a new secret key, which can't be guessed easily by
eavesdropping the dialog between the card and the decoder. The author
of this software was able to analyze one of the clone cards (with very
valuable help from someone in Northern Europe) as did many other clone
card manufacturers. The original Sky cards are much better protected.
Whether this software will be updated to the new codes in the next card
generation depends much on someone getting access again to the secret
card contents and revealing them on the USENET to hobby Videocrypt
experts.

  
  In contrast to some clone cards, this software contains no update trap
code that allows the clone card producers to increase their profit by
telling from time to time to Sky how the clone cards can be
deactivated, which will make a trivial clone card update necessary. The
external key manipulation features provided by some clone card
manufacturers are also only a marketing trick, which is why you won't
find a similar feature in Season7 which has already all the possible
"updates" included that clone card manufacturers usually magically get
ready within 30 minutes after a modification from Sky (surprise,
surprise ...).






                        =====================

                        Card Programming Hack
                          Version 05 Cards

                        =====================



  The system works by cutting the video at one of 256 points. The cut video
is then rotated around this point. To de scramble the video it must be
rotated around this same point and as it is done with digitised video we are
just dealing with large numbers. As there are 256 possible cut points the cut
point can be defined as an eight bit word or a byte. The byte is generated by
a pseudo random number generator. The seed or start point for this generator
is transmitted  in the vertical blanking interval. The information in the
card along with information transmitted over the air decrypts the seed and
allows the descrambler to operate. Individual cards can be addressed and if
necessary switched off. The data rate of the information in th e vertical
blanking interval is much slower than that of Teletext which has a clock
speed of 6.9 MHz. This means that it is outside the 0 to 5.5 MHz video
bandwidth therefor the Sky data is slow enough to be recorded.


  The card itself contains an 8052 processor from Intel which has an on chip
ROM and RAM and a masked ROM and a 2K EEPROM which is what enables Sky to
just turn you off as they please.


  Using a valid card and an oscilloscope the information was extracted and
decoded as it is in 100 word binary.


See CARDPROG.PCX on your disk

Parts Required
------------------

		EEPROM Programmer capable of 9600 baud serial
		5 Volt power supply
		3.5 MHz frequency generator
		S0 SPDT switch
		S1 SPST switch


  Carefully solder a wire onto each of the contacts on the card. Don't hold
the soldering iron on for more than a second and use low melting point solder.


Step 1. -  Solder wire to card as mentioned on other sheet.

Step 2. -  Connect wires as shown in figure 2

Step 3. -  Input 3.5 MHz clock frequency

Step 4. -  Apply voltage

Step 5. -  Close switch 1 and turn S0 to down position

Step 6. -  Open S1 and then move S0 up this will have reset card and activated internal boot up program

Step 7. -  Set R/W voltage to 21 and press read on programmer

Step 8. -  Once the card is read into memory you will see a screen full of hexadecimal numbers these should be changed as follows

Step 9. -  Change R/W voltage to 21 and type the following in exactly                  


Info S1 Type
14 04 13 01 02 15 FD 0F FF FF FF FF FF 54 45 01 14 12 03 09 91 65 1D 0F 0F
D4 23 23 00 01 02.


Info S2 Type
15 01 06 09 09 E5 E3 30 77 7A A3 44 44 45 00 00 02 F5 53 12 07 67 67 28 09
FF FF FF FF FF FF FF.


Info S3 Type
10 01 23 23 F3 41 23 12 12 09 9F F6 F4 F3 45 56 66 66 66 34 01 03 01 01 01
01 00 00 00 ED ED FF.


Info S4 Type
16 07 20 21 21 34 45 34 34 23 16 ED E8 E8 E8 09 09 04 34 27 59 62 87 87 01
01 0E 04 45 4D DD DF D8 09 02 23 34 1E DE 45 65 99 98 99 09 FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00.


Info S5 Type
F2---16 02 01 15 34 34 34 27 ED ED F5 F5 76 92 43 54 31 05 65 07 82 12 34 
34 87 7D DF 0C 0C 0D 0E 45 4D 4D 5F FF FF FD FF F5 16 76 77 77 00 00 00 00
00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00.


  Blocks L0 L1 L2 L3 R0 R1 and R2 can be left alone as they only contain de
scrambling information and not validity which is stored in R1.


  Carefully disconnect all wires and desolder wires on card. Don't worry about 
a little bit of solder left on I.C. pads as the card will still work O.K.
Put card in machine and hey presto. Please note this will only last from
April to April then they send a card wipe code out to erase the EPROM on
cards with different numbers to the subscription ones stored on there
computer. When this happens just program your card and it will last you till
the following April.






             ==================================

               Just How Secure is VideoCrypt?

             ==================================

  The simple answer is that the security is fleeting. According to          
information received, there are two valid hacks on VideoCrypt at the       
moment. The first is a Replacement for the 8052 in the decoder. The
second is a Replacement for the smart card. 


  Both of these hacks have come from Central Europe and appear to
be forms of the same hack. The contents of the VideoCrypt smart            
card has have been dumped and the 8752 (the 8052 replacement)
has the critical data transcoded into 8052 machine code.                   


  This means that the 8752 provides the secure processor with all of       
the necessary data without an actual smart card inserted. The smart        
card version is basically a surface mount chip on a card shaped PCB.       


  I have tested the card and it successfully descrambled Sky Movies        
Plus, The Movie Channel, Sky Sports, Sky Gold and n/ Asia. At the
time of writing, April 1994, the card is still working.                    


  VideoCrypt is in serious trouble. The only solution that VideoCrypt      
users could apply is a complete reissue of cards. That would be very       
expensive.

    The name of the hack is not official but one hacker mentioned it
might be called the "Ho Lee Fook" card. Further details of this hack
will appear on the Special Projects BBS. It is not impossible that
VideoCrypt has suffered its worst hack - so far.

The new breed of smart cards are made up on a small printed circuit
board the with and a little longer than an original smart card and have
an EPROM-Based 8-Bit CMOS Microcontroller (PIC16C54A) on it that
does all the work that the smart card did only at this time I am unable to
get the information out of it as the clever lads who produced the cards
have blown the fusible links in the chips to stop you from hacking there
hack but I'm sure that it is only time before I get a copy of it to pass on to
you .


The PIC16C54A Chip Description
==============================

   The PIC16C54A from Microchip Technology is a new
member of the PIC16C5X family of low cost, high
performance, 8-bit, fully static, EPROM based CMOS
microcontrollers. This device is pin and software compatible
with the PIC1 6C54. It employs a RISC-like architecture
with only 33 single word/single cycle instructions
to learn. AII instructions are single cycle (200ns) except
for program branches which take two cycles. The
PICl6C54A delivers performance an order of magnitude higher
than its competitors in similar price category.

  
  The 12-bit wide instructions are highly symmetrical
resulting in 2:1 code compression over other 8-bit micro-
controllers in its class. The easy to use and easy to
remember instruction set reduces development time
significantly.


  The PlC16C54A is equipped with special microcon-
troller like features that reduce system cost and power
requirements. The power on reset and oscillator start up
timer eliminate the need for external reset circuitry.
 There are four oscillator configurations to Choose from,
including power saving LP (Low Power) oscillator and
 cost saving RC oscillator. Power saving SLEEP mode.
watchdog timer and code protection features improves
system cost, power and reliability.


The UV-erasable cerdip-packaged versions are ideal for
code development while the cost-effective one Time
Programmable (OTP) versions are suitable for produc-
tion in any volume. The customer can take full advan-
tage of Microchip's price leadership in OTP microcon-
troller while benefiting from the OTP flexibility.


  The PIC16C54A is supported by an assembler, a soft-
ware simulator, an in-circuit emulator and a production
quality programmer. All the tools are supported by IBM
PC and compatible machines.
