The information contained in this document is for educational purposes only, and is in no way intended to assist anyone to break any laws. It is your reponsibility to obtain proper authorization from DTV/USSB before using any type of test device on your DSS Receiver!
The author makes no guarantee as to the accuracy of any information provided in this document and is not responsible for any consequences of its use. Most of the items in this faq have been tested and are known to work. But in short, if you toast your receiver by following any instructions in this document you've got no one to blame but yourself!
Oh yeah! And DIRECTV, DSS, DIRECT TICKET, DIRECTV Sports Choice,
and "Satellite TV at its Best" are official trademarks of DIRECTV,
Inc., a unit of Hughes Electronics Corp. NDC and News DataCom is an
official trademark of News DataCom Ltd. and Rupert Murdock.
Motorola is a registered trademark of Motorola Corp. Intel, Pentium,
Overdrive are all registered trademarks of Intel Corp. Siemens is a
registered trademark of Siemans Corp.
There are currently 3 types of DSS test devices available.
In order, these are:
These are covered in detail below.
There are 3 different types of DSS Access Card Emulators. The Battery Card, the L Card, and the T Card. These cards are also refered to as 'Green Cards' sometimes due to their green circuit board color.
The Battery Card came out first and was the original DSS Hack. It was introduced in Late Summer of 1995 and was developed in Canada by the Battery Group.
The Battery Card was never supposed to be sold into the United States. It was to be sold only in Canada and other countries which could get the DSS signal but could not legally subscribe to the DSS services. There were a few Battery Cards sold in the US however.
Then the knock-offs came out in the United States. The L-Card
arrived in the Winter of 1995 and the T-Card showed up in Early
Spring of 1996. The L and T cards were developed from the Original
Battery Card design and software supposedly stolen by disgruntled
employees/partners of the original Battery Group.
The Battery Card got its name from the large round battery it utilizes. It uses the Dallas 5002 secure microprocessor, Atmel 89C51, and SRAM (usually Hyundai). It is usually just refered to by it's shortened name a 'batt card'.
This is the Original DSS Fix. The L and the T Cards have spawned off from it much to the chagrin of the Battery Card developers. Not widely sold in the US.
The original Battery Card group no longer exists as of 9/01/96 and
instead a new one has been formed and is headed up by RonSilver et
al. and a new programmer from Europe known only as Big Gun. Big
Gun is sometimes refered to as biggun or just bg.
For awhile DTV was shutting down the Battery Cards weekly but the Big Gun has recently came up with a new encryption scheme loaded into the bootstrap (B/S) portion of the cards which is called v3 or Version 3. This new v3 boot strap has been much more stable but still seems to have bugs that need to be worked out and has went down due to ecm's a few times now.
Upgrading to the v3 bootstrap is only done by a couple of select dealers and your card *MUST* be sent into one these dealers to have the v3 bootstrap added to your card. There is no software available to do this yourself.
The older Battery Cards that have not been upgraded to the new v3
Bootstrap are still going down on a weekly basis.
The L-Card got its name from its shape. It simply looks like a large L.
It was the second card to be released and uses a Dallas 5000 secure microprocessor, and an Atmel 89C51, like the Battery Card, the L-Card can be reprogrammed through an 18-pin edge connector. This device was widely sold in the US.
The L-Group as of 11/1/96 has pretty much dissapeared. Everybody suspects they took the money and ran off to the bahamas or some such thing to enjoy their ill gotten gains and bask in the sun.
The L-Card has been upgraded a couple a times by the L-Group to try and combat being shut down but nothing has really helped much.
These cards are currently being shut down weekly along with the non
upgraded (v3) Battery Cards.
The T-Card, the latest to be released, again so named because it looks like a T uses a Dallas Sip Stik due to an anticipated shortage of Dallas 5000 and 5002 micros. The Sip Stiks provide a high level of encryption. It also utilizes an Atmel 89C51. This Card can also be reprogrammed through the 18-pin edge connector if the need arises. Not widely sold anywhere due to reliability problems.
T-Cards were made by the L-Group and are currently facing the same fate as the L-Cards.
These cards (like ALL the others) can NOT be made at home. They are ALL made by pros at a site where the proper equipment can be used. These are not basement lab projects. Even if you could make a card at home, the MASTER software that is loaded onto the card at the "factory" is NOT attainable by the public, and without this software loaded onto a new card, it is unable to be used.
All of the above test devices have the ability to decode and test ALL of the DSS channels available.
The above test devices (Battery, L, T Cards) can all be reprogrammed using a simple parallel programmer which the end contacts of the card fit into.
Original DSS Access Cards are usually called Plastic Cards, Plastic or The Blues due to their plastic (credit card like) construction and the blue Access Card logo on the top of the card.
The Original DSS Access Cards use a conditional security system designed by News Data Com Ltd. (NDC). They were contracted by DirecTV to handle the security system on the DSS Receivers. NDC are the ones responsible to make sure the system stays secure and develop ECM's and newer technology to counter pirates.
There are two series of plastic cards available now. The DSS/01 also known as "E", "F", "G" series cards and the DSS/04 or "H" series cards.
The easiest way to tell the two apart is to turn the cards over and look at the serial numbers on the back.
DSS/01 series cards will have a serial number of 0000 3999 9999 and below. They also have a manufacture number below and to the right of the barcode which starts in Exxxxxxxxxx, Fxxxxxxxxxx, or Gxxxxxxxxxx hence the cards "E", "F", or "G" designation.
DSS/04 series cards will have a serial number of 0000 4000 0000 and above. DSS/04 cards also have DSS printed just below the serial number in the middle underneath the bar code. They also have a manufacture number below and to the right of the barcode which starts in Hxxxxxxxxxx hence the cards "H" designation.
The DSS/01 cards use a Motorola 6805SC21 microprocessor, 6144 bytes of ROM, and 3008 bytes of EEPROM memory and 128 bytes of RAM.
The DSS/01 series cards have been fully hacked and can be reprogrammed to test all of the DSS channels available by using a simple serial programmer which can be had for about $120 (USD). Plans to build a serial programmer for these cards as well as software to reprogram the cards is available from the addresses below in Section 2.3 of the FAQ
The DSS/04 cards use an modified Siemens 8051 microprocessor, an ASIC, ROM, EEPROM and RAM.
The DSS/04 cards have only been partially hacked at this time. Software is available to read the cards only. Nothing yet to actually program the new cards. Cards similar to the DSS/04 cards have been hacked in Europe and so it is likely only a matter of time until the newer cards are fully hacked.
The above test cards have the ability to decode and test ALL of the DSS channels available.
There are two 'types' of plastic card hacks available. Clones and 3M's.
Clones are just exact copies of someone else's card called a 'MASTER' that has been copied to another card making it a 'Clone of the Master' or just 'Clone' for short.
Cloned cards of a Master will recieve any programming being paid for on the Master cards including pay per views (ppv's) and any other special events or regular programming. If a Master card does not have ppv on it, the Clone of the Master will not either and so on with the rest of the programming.
So far no cloned card has never been ecm'd.
3M's start out as a clone but only need to have one channel being subscribed to on the Master Clone. After this special software called 3m is added to the card which allows ALL of the channels to be viewed normally.
The term 3M comes from an old VideoCipher II hack. The term itself means '3 Musketeer' as in the 'One for all and all for one' quote from the old 3 Musketeer movie.
3M software changes a Cloned card into thinking that just because it's actually only subscribing to one channel it's really subscribing to them all and so they all just come in normally.
Lately the 3M'd plastic cards have been getting ECM'd quite alot and when they have been ECM's they usually end up Code 99'd. Code 99 info is contained in Section 2.2 below.
Once 3M software is placed on your card it requires special software to remove it. Several such software programs are described in the section 2.1.3 below.
Most 3M software placed onto a plastic card will make it work like a Battery type card as it will receive all channels and will tune them in immediately without having to push anymore buttons. (Like ppv's require you to do on a normal plastic or clone.)
Several types of plastic software are known to exist. In short order here are their names and a short description of each.
This was supposedly the first version of widely used and widely available plastic clone software. Had a few bugs nothing big. Would let you read a card, modify the memory of the card, and save it to disk for later use, and copy data to a card. Simple to use. Fairly good looking. This software could not make exact duplicates of cards since it only copied needed info to make clones and nothing more.
This software has been known to destroy cards when running on fast pc's such as high end 486's and Pentiums. This software runs in DOS.
This was supposedly the second version of widely used and widely available plastic clone software. Fixed several bugs and problems with CL10. No new features though.
This software has been known to destroy cards when running on fast pc's such as high end 486's and Pentiums. This software runs in DOS.
This was supposedly the third version of widely used and widely available plastic clone software. Fixed several bugs and problems with CL12. Lots of new features including the ability to completely wipe a card clean for removal of 3M software or pay per view data or other strange bits that had been changed inadvertantly. And the ability to add tiering data to the card. The look and feel was changed for the better as well as a password protection system implemented for some special features. Step by step instructions for cloning a card with this software will be presented in next months issue.
This software has been known to destroy cards when running on fast pc's such as high end 486's and Pentiums. This software runs in DOS.
CL45_4 is the rumored version of CL45 with the ability to clone new DSS/04 "H" series cards.
No one has admitted to actually seeing this software yet so not much is known about it.
CL50 is supposedly the real version of the new CL software that will be able to work with DSS/04 series cards.
As above no one has actually admitted to seeing this software yet so at this point in time it is still just a rumor.
Ron.exe is some software released by Fast Eddies programmer which is a 2nd generation 3M program with a built in clone (eddie's).
This software is pretty much plug and play. You just run the Ron software on a card and walla it works!
Version 2 of 3m software and up 3m has anti-code 99 routines in it, but some cards have been known to go code 99 when running it.
Where did the name come from? Supposedly Eddie stole the software from Ron Silver to get back at him for some reason and hence the name Ron...
This software should work fine when running on fast pc's such as high end 486's and Pentiums. This software runs in DOS.
Cyclone is a new card programming software that is available. Features of Cyclone are the clearing of ppv's on card, cleaning of a card, card time zone changes, adding of tiering information to a card, adding 3M to a card, removal of sports blackouts on a card. Ability to change card password. Turn on pay per view buy option. Complete card copies to make exact duplicates of cards. Improved user interface.
This software should work fine when running on fast pc's such as Pentiums. This software runs in DOS.
Tornado is a neat new card enabling software from Tornado. It will allow you test a DSS ACCESS CARD by giving you access to time zone correction, activation of all channels, including all PPV, engineering channels, and blackout channels.
The author includes a reverse feature which make this software unique in that it will undo anything you ask it to change on a card.
This software includes an adjustable wait loop and so should work just fine on faster pc's such as Pentiums. This software runs in DOS.
Plastic4 software is a new Windows based DSS/01 card programming software that has a unique feature in that it allows you to read a card and save a .cor image file to disk that can then be used with the PC Based DSS Access Card Emulator described in next months issue. Plastic4 can also read/write the older CL12 (.pat) files. Another neat feature is the use of patches which gives you the ability to patch in features like tornado or 3m to a plastic4 card file.
This software is slower than most other non-windows card programming softwares.
This software should work fine on faster pc's such as Pentiums. This software runs in Windows.
Card Blaster is a DSS/01 card cloning software only. The software will read a card, save an image to disk, read an image from disk and copy an image to a card. This software due to it's changeable wait loop will safely program cards using a fast pc such as a pentium. Several people have said that this software allowed them to clone cards that they could not previously with other software. This software comes from Fast Eddie's programmer.
This software should work fine on faster PC's, such as Pentiums. This software runs in DOS.
DSS97 is a new software out that will allow you to read your DSS/04 "H" Series cards. It will read a new series card and store the info to disk for study.