---[ Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 13 of 20 -------------------------[ Pay Per View (you don't have to) --------[ Cavalier[TNO] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= I......................................................... Introduction II........................................................ Automatic Windows III....................................................... The Login Window IV........................................................ The Main Menu V......................................................... Other Menus VI........................................................ Converter Types VII....................................................... Scrambler Types VIII...................................................... Scrambling Modes IX........................................................ Security Notes X......................................................... Conclusion =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= .--------------. | Introduction | `--------------' General Instruments sells more cable television equipment than any other manufacturer. Included in their product range is the ACC-4000. The ACC-4000 is a system that controls Pay-Per-View television. The ACC-4000 is a PC running SCO Open Desktop v3.0. Earlier ACC-4000s ran Interactive Unix. The interface for the ACC-4000 is X-Windows based, so you can hack your way to free pron through an attractive GUI. The ACC-4000 is often referred to as an addressable system. This means that each set-top-box can be addressed independently. This allows every subscriber to select their own programming -- and it allows the cable television company to bill the subscriber for every television show the subscriber selects. The cable television signal is normally sent by satellite to a cable headend. To translate this into terms that may be more comfortable to Phrack readers, the cable head end is similar to a telephone company central office. At the headend, the signal is scrambled to make it more difficult to view without paying. The ACC-4000 then routes the signal from the headend to the appropriate set-top-boxes. It does this by merging control information into the data stream before the data stream reaches the set-top-boxes. The ACC-4000 can talk to one-way, FONE-way, and two-way set-top-boxes. The ACC-4000 works over standard RF cable, fiber optics, microwave, and even telephone wiring. The ACC-4000 is capable of sending billing information to a cable television billing system, such as CableData, CSG, or Wizard. The ACC-4000 is a small system. The unit I examined was using a 486DX-50 processor. Nevertheless, one ACC-4000 can manage a half a million set top boxes. Often you will find other General Instruments systems connected to the ACC-4000. A Data Provider Translator system can take input from outside sources and merge them into the data stream going to the set-top-boxes. This provides features like program guides, VCR IR codes, weather data, Near-Video-On-Demand (NVOD) schedules, or even custom logos and menus. A Message Editor system can be used to create custom "barker" messages for cable subscribers. .------------------. | Automatic Windows| `------------------' In addition to the login window, the ACC-4000 opens two other types of windows automatically to display information on the console. Using Xwatchwin to view these windows remotely can help you figure out what is going on with the system. The Windows are: . Logger Window . Wire Link X The window titled "Logger Window" contains status and error messages. The windows titled "Wire Link X" show data going from the ACC-4000 out to other systems, usually the billing system. There is one "Wire Link X" window for each system the ACC-4000 is feeding data. .------------------. | The Login Window | `------------------' The login window is extremely informative and looks something like this: .---------------------------------------------------------------------------. | ACC4000 Help | | ~ ~ | |---------------------------------------------------------------------------| |LOGIN | Login to ACC4000 | | | |---------------------------------------------------------------------------| | General Instruments Addressable Control System | |User Name: ############################# Password: ######## | | COPYRIGHT (C) 1996. General Instrument Corporation | |---------------------------------------------------------------------------| |Site Number: 866 Geocode: 303 Terminal: tno:0.0 Software Version: V8.66 | | | | Number ANICS Installed: 1 Number of Subscriptions: 16 | | Parallel Data Streams: 1 1st Subscription Service Code: 1 | | List Maintenance: HOST Number of Simultaneous Events: 48 | | Number List Maps: 8 1st Event Service Code: 89 | | Return Frequency: 08.9 Mhz Data Stream Baud Rate: 13.97 Khz | | | | Data Base Size: 288K Subscribers Converter ID Usage: 32K Groups | | | | 1st group 1-way 2nd group phone 3rd group phone 4th group 2-way | | 5th group 2-way 6th group 2-way 7th group 2-way 8th group 2-way | | 9th group 2-way | | | |---------------------------------------------------------------------------| |Enter operator name | | | | F6:Clear Field F7:Field Help F8:Form Help | `---------------------------------------------------------------------------' Site Number is assigned by General Instruments. This number is also stored in the set-top-box. Geocode is a optional number that may be assigned by the cable television company to segment it's set-top-boxes into groups. Terminal is the name of the X-windows terminal you are connecting from. Software Version is the release number of the ACC-4000 software. Number ANICS Installed is the number of transmission devices installed. Parallel Data Streams is the number of simultaneous transmissions into the data stream. List Maintenance is always set to HOST. In the future, General Instruments plans to allow the an ANIC to maintain the list of authorizations. Number List Maps is the size of the queue between the ACC-4000 and the ANIC. Number of Subscriptions is the number of service codes allotted for subscriptions. 1st Subscription Service Code is the first available scrambler tag for descrambling subscriptions. Number of Simultaneous Events is the maximum number of simultaneous Pay-Per-View (PPV) events that can be available at one time. 1st Event Service Code is the first available scrambling tag for Pay-Per-View PPV events. Return Frequency is the transmit frequency used by two-way set top boxes. The range is normally 8.3 - 10.4Mhz. Data Stream Baud Rate is the rate of transmission of the data stream. Data Base Size is the maximum number of set-top-boxes the system is configured for. Converter ID Usage is always set to 32k. This means that 32k set-top-boxes can be grouped into a partition. Groups shows the division of the total number of set-top-boxes (data base size) into partitions. .---------------. | The Main Menu | `---------------' The Main Menu is the gateway to all other menus and looks something like this: .---------------------------------------------------------------------------. |MAINMENU | Main Menu of Screen Options | |records found | | | |.-------------------------------------------------------------------------.| || || || Main Menu of Screen Options || || || || 1. Converters Convs 7. User Information Users || || 2. Services/Schedules Svcs 8. Control System Functions System || || 3. Headend Equipment Headend 9. Reports Reports|| || 4. Converter Types ConvTyp 10. Data Path Configuration DataCfg|| || 5. Data Files Files 11. Message Management MsgMgt || || 6. Business System Gateway Gateway 12. Return to Login Exit || || || || || || Enter Selection: || || || |`-------------------------------------------------------------------------'| | | |---------------------------------------------------------------------------| |Enter selection number or press function button | | | | F6:Clear Field F7:Field Help F8:Form Help | `---------------------------------------------------------------------------' .-------------. | Other Menus | `-------------' The ACC-4000 has many other menus that are accessed through the Main Menu. I will not waste time and space here describing these menus. If you gain access to an ACC-4000, the online help should be sufficient to aid you in using the system. These menus allow you to perform functions such as: . Managing set-top-boxes . Managing headend scramblers . Sending messages to subscribers . Performing opinion polls on subscribers . Configuring available Pay-Per-View (PPV) events . Managing purchase data . Maintaining the ACC-4000 database . Creating reports .-----------------. | Converter Types | `-----------------' The ACC-4000 system supports a large number of set-top-boxes: Type Model Name Partition Type ------------------------------------------------------------------------------ 1 DRZ STARCOM II, 400, 500 One-Way (PROM based) 2 DRZA-*A, DRZP-*A STARCOM 450 One-Way (PROM based, 128 tags) STARCOM 450/P3 3 DRZI*-*A STARCOM 450/P3 One-Way (PROM based, 256 tags) 4 DRZI*-AT STARCOM 450 Two-Way 5 XT5-*1* STARCOM V One-Way 6 XT5-*2* STARCOM V Two-Way 7 DRZI*-*AV STARCOM 450 One-Way 8 DP*5-*3* STARCOM VI+ Fone-Way 9 DL4/DL4A STARCOM V One-Way 10 DP*5-*1* STARCOM VI+ One-Way 11 DP*5-*2* STARCOM VI+ Two-Way 12 DPBB-*1* STARCOM VI+ One-Way 13 DPBB-*3* STARCOM VI+ FONE-Way 14 DPBB-*2* STARCOM VI+ Two-Way 15 DP711*, DPV721*, DPV721*/C1 STARCOM 7100/7200 One-Way 16 DP713*, DPV723*, DPV723*/C1 STARCOM 7100/7200 FONE-Way 17 DP712*, DPV722*, DPV722*/C1 STARCOM 7100/7200 Two-Way 18 DPBB7-*1* STARCOM 7300 One-Way 19 DPBB7-*3* STARCOM 7300 FONE-Way 20 DPBB7-*2* STARCOM 7300 Two-Way 21 DPBB-*1*-M1 STARCOM VI+ M/S One-Way 22 DPBB-*3*-M1 STARCOM VI+ M/S FONE-Way 23 DPBB-*2*-M1 STARCOM VI+ M/S Two-Way 24 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 One-Way 25 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 FONE-Way 26 IDP7, LMDS-A, MMDS-A/CT1900 IDP7, LMDS-A, MMDS-A/CT1900 Two-Way 27 DCR DCR One-Way 28 DCR 3000S/4000S DCR One-Way 30 CFT2000/2100 CFT2000/2100 One-Way 31 CFT2000/2100 CFT2000/2100 FONE-Way 32 CFT2000/2100 CFT2000/2100 Two-Way 33 STARPORT STARPORT One-Way 34 STARPORT (not implemented) STARPORT FONE-Way 35 STARPORT (not implemented) STARPORT Two-Way 36 CFT2200 CFT2200 One-Way 37 CFT2200 CFT2200 STARFONE FONE-Way 38 CFT2200 CFT2200 STARVUE Two-Way 39 CFT2900 CFT2900 One-Way 40 CFT2900 CFT2900 FONE-Way 41 CFT2900 CFT2900 Two-Way 42 Sega Sega One-Way .-----------------. | Scrambler Types | `-----------------' The ACC-4000 system supports several different types of scramblers at the headend, including: STARPACK Service Encoder (SSE) An older scrambler that scrambles with standby and 6db constant sync-suppression scrambling modes. Digital Scrambler/Encoder (DS/E) An older RF scrambler. Digital Video/Encoder (DV/E) An older baseband scrambler, used to further scramble DS/E signals. Video Processor/Encoder (VP/E) A DS/E and a DV/E together. Modulating Video Processor (MVP) and MVPII A newer scrambler. Modulating Video Processor (MVP) II-DIU A MVPII with a Data Inserter Module (DIM) to enable data insertion. .------------------. | Scrambling Modes | `------------------' The ACC-4000 controls scramblers using several modes of scrambling, including: . Sync Suppression . Video Inversion . Audio Inversion Supported sync suppression submodes are: . Standby . Clear, 0db constant . 6db constant . 10db constant . Scene change, 3 seconds . 6/10 pseudo-random, 30 seconds . 6/10 pseudo-random, 1 minute . 6/10 pseudo-random, 16 tics . 6/10 pseudo-random, 3 seconds When using scene change or 6/10 pseudo-random sync suppression, the ACC-4000 supports a number of dynamic mode types: . Pseudo-random 6/10/clear . Pseudo-random 6/clear . Pseudo-random 10/clear . Pseudo-random 6/10 . Linear 6/10/clear . Linear 6/clear . Linear 10/clear . Linear 6/10 In addition, you can set the interval between dynamic mode time changes in hours, minutes, seconds, or tics. Supported video inversion submodes are: . Clear . Scene change field inversion . Constant video inversion . Timed field inversion Note: Video and audio inversion only work with baseband set-top-boxes. .---------------. | Security Notes| `---------------' These systems normally have modems for use by both General Instruments personnel and cable company personnel. General Instruments personnel dial in to diagnose problems with the system. Cable company personnel dial in to change Pay-Per-View (PPV) programming or to configure customer set-top-boxes. Any uncollected purchases are lost when a set-top-box is initialized. To preserve uncollected purchases, the operator will do a Refresh instead of an Initialize. If you can talk the operator into doing an Initialization instead of a Refresh, any uncollected purchases not already forwarded to the billing system will be lost. Purchases are stored as integers. Older set-top-boxes were limited to storing 16 purchases. Newer set-top-boxes are limited to storing 63 purchases. .------------. | Conclusion | `------------' If you can access a system such as the ACC-4000, you can have great fun. Be careful when giving everyone in your city free access to WWF. ----[ EOF