Zines/phrack/52/13.txt

---[  Phrack Magazine   Volume 8, Issue 52 January 26, 1998, article 13 of 20


-------------------------[  Pay Per View (you don't have to)


--------[  Cavalier[TNO]



=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


 I......................................................... Introduction
 II........................................................ Automatic Windows
 III....................................................... The Login Window
 IV........................................................ The Main Menu
 V......................................................... Other Menus
 VI........................................................ Converter Types
 VII....................................................... Scrambler Types
 VIII...................................................... Scrambling Modes
 IX........................................................ Security Notes
 X......................................................... Conclusion



=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


.--------------.
| Introduction |
`--------------'

General Instruments sells more cable television equipment than any other
manufacturer. Included in their product range is the ACC-4000. The
ACC-4000 is a system that controls Pay-Per-View television.

The ACC-4000 is a PC running SCO Open Desktop v3.0. Earlier ACC-4000s
ran Interactive Unix. The interface for the ACC-4000 is X-Windows based,
so you can hack your way to free pron through an attractive GUI.

The ACC-4000 is often referred to as an addressable system. This means
that each set-top-box can be addressed independently. This allows every
subscriber to select their own programming -- and it allows the cable
television company to bill the subscriber for every television show the
subscriber selects.

The cable television signal is normally sent by satellite to a cable
headend. To translate this into terms that may be more comfortable to
Phrack readers, the cable head end is similar to a telephone company
central office. At the headend, the signal is scrambled to make it more
difficult to view without paying.

The ACC-4000 then routes the signal from the headend to the appropriate
set-top-boxes. It does this by merging control information into the data
stream before the data stream reaches the set-top-boxes. The ACC-4000
can talk to one-way, FONE-way, and two-way set-top-boxes. The ACC-4000
works over standard RF cable, fiber optics, microwave, and even
telephone wiring.

The ACC-4000 is capable of sending billing information to a cable
television billing system, such as CableData, CSG, or Wizard.

The ACC-4000 is a small system. The unit I examined was using a 486DX-50
processor. Nevertheless, one ACC-4000 can manage a half a million set
top boxes.

Often you will find other General Instruments systems connected to the
ACC-4000. A Data Provider Translator system can take input from outside
sources and merge them into the data stream going to the set-top-boxes.
This provides features like program guides, VCR IR codes, weather data,
Near-Video-On-Demand (NVOD) schedules, or even custom logos and menus. A
Message Editor system can be used to create custom "barker" messages for
cable subscribers.


.------------------.
| Automatic Windows|
`------------------'

In addition to the login window, the ACC-4000 opens two other types of
windows automatically to display information on the console. Using
Xwatchwin to view these windows remotely can help you figure out what is
going on with the system. The Windows are:

                        . Logger Window
                        . Wire Link X

The window titled "Logger Window" contains status and error messages.

The windows titled "Wire Link X" show data going from the ACC-4000 out
to other systems, usually the billing system. There is one "Wire Link X"
window for each system the ACC-4000 is feeding data.


.------------------.
| The Login Window |
`------------------'

The login window is extremely informative and looks something like this:

 .---------------------------------------------------------------------------.
 |          ACC4000                                                  Help    |
 |          ~                                                        ~       |
 |---------------------------------------------------------------------------|
 |LOGIN  |       Login to ACC4000         |               |                  |
 |---------------------------------------------------------------------------|
 |         General Instruments Addressable Control System                    |
 |User Name: #############################    Password: ########             |
 |         COPYRIGHT (C) 1996. General Instrument Corporation                |
 |---------------------------------------------------------------------------|
 |Site Number: 866  Geocode: 303  Terminal: tno:0.0  Software Version: V8.66 |
 |                                                                           |
 | Number ANICS Installed: 1              Number of Subscriptions: 16        |
 |  Parallel Data Streams: 1        1st Subscription Service Code: 1         |
 |       List Maintenance: HOST     Number of Simultaneous Events: 48        |
 |       Number List Maps: 8               1st Event Service Code: 89        |
 |       Return Frequency: 08.9 Mhz         Data Stream Baud Rate: 13.97 Khz |
 |                                                                           |
 | Data Base Size: 288K Subscribers      Converter ID Usage: 32K Groups      |
 |                                                                           |
 | 1st group 1-way    2nd group phone    3rd group phone    4th group 2-way  |
 | 5th group 2-way    6th group 2-way    7th group 2-way    8th group 2-way  |
 | 9th group 2-way                                                           |
 |                                                                           |
 |---------------------------------------------------------------------------|
 |Enter operator name                                                        |
 |                                                                           |
 |             F6:Clear Field     F7:Field Help        F8:Form Help          |
 `---------------------------------------------------------------------------'


        Site Number is assigned by General Instruments. This number is
        also stored in the set-top-box.

        Geocode is a optional number that may be assigned by the cable
        television company to segment it's set-top-boxes into groups.

        Terminal is the name of the X-windows terminal you are
        connecting from.

        Software Version is the release number of the ACC-4000 software.

        Number ANICS Installed is the number of transmission devices
        installed.

        Parallel Data Streams is the number of simultaneous
        transmissions into the data stream.

        List Maintenance is always set to HOST. In the future, General
        Instruments plans to allow the an ANIC to maintain the list of
        authorizations.

        Number List Maps is the size of the queue between the ACC-4000
        and the ANIC.

        Number of Subscriptions is the number of service codes allotted
        for subscriptions.

        1st Subscription Service Code is the first available scrambler
        tag for descrambling subscriptions.

        Number of Simultaneous Events is the maximum number of
        simultaneous Pay-Per-View (PPV) events that can be available at
        one time.

        1st Event Service Code is the first available scrambling tag for
        Pay-Per-View PPV events.

        Return Frequency is the transmit frequency used by two-way set
        top boxes. The range is normally 8.3 - 10.4Mhz.

        Data Stream Baud Rate is the rate of transmission of the data
        stream.

        Data Base Size is the maximum number of set-top-boxes the system
        is configured for.

        Converter ID Usage is always set to 32k. This means that 32k
        set-top-boxes can be grouped into a partition.

        Groups shows the division of the total number of set-top-boxes
        (data base size) into partitions.


.---------------.
| The Main Menu |
`---------------'

The Main Menu is the gateway to all other menus and looks something like
this:

 .---------------------------------------------------------------------------.
 |MAINMENU  |    Main Menu of Screen Options     |       |records found      |
 |                                                                           |
 |.-------------------------------------------------------------------------.|
 ||                                                                         ||
 ||                 Main Menu of Screen Options                             ||
 ||                                                                         ||
 || 1. Converters              Convs     7. User Information         Users  ||
 || 2. Services/Schedules      Svcs      8. Control System Functions System ||
 || 3. Headend Equipment       Headend   9. Reports                  Reports||
 || 4. Converter Types         ConvTyp  10. Data Path Configuration  DataCfg||
 || 5. Data Files              Files    11. Message Management       MsgMgt ||
 || 6. Business System Gateway Gateway  12. Return to Login          Exit   ||
 ||                                                                         ||
 ||                                                                         ||
 || Enter Selection:                                                        ||
 ||                                                                         ||
 |`-------------------------------------------------------------------------'|
 |                                                                           |
 |---------------------------------------------------------------------------|
 |Enter selection number or press function button                            |
 |                                                                           |
 |             F6:Clear Field     F7:Field Help        F8:Form Help          |
 `---------------------------------------------------------------------------'


.-------------.
| Other Menus |
`-------------'

The ACC-4000 has many other menus that are accessed through the Main Menu.
I will not waste time and space here describing these menus. If you gain
access to an ACC-4000, the online help should be sufficient to aid you
in using the system.

These menus allow you to perform functions such as:

                . Managing set-top-boxes
                . Managing headend scramblers
                . Sending messages to subscribers
                . Performing opinion polls on subscribers
                . Configuring available Pay-Per-View (PPV) events
                . Managing purchase data
                . Maintaining the ACC-4000 database
                . Creating reports


.-----------------.
| Converter Types |
`-----------------'

The ACC-4000 system supports a large number of set-top-boxes:


Type  Model                        Name                         Partition Type
------------------------------------------------------------------------------
 1    DRZ                          STARCOM II, 400, 500         One-Way
      (PROM based)
 2    DRZA-*A, DRZP-*A             STARCOM 450                  One-Way
      (PROM based, 128 tags)       STARCOM 450/P3
 3    DRZI*-*A                     STARCOM 450/P3               One-Way
      (PROM based, 256 tags)
 4    DRZI*-AT                     STARCOM 450                  Two-Way
 5    XT5-*1*                      STARCOM V                    One-Way
 6    XT5-*2*                      STARCOM V                    Two-Way
 7    DRZI*-*AV                    STARCOM 450                  One-Way
 8    DP*5-*3*                     STARCOM VI+                  Fone-Way
 9    DL4/DL4A                     STARCOM V                    One-Way
10    DP*5-*1*                     STARCOM VI+                  One-Way
11    DP*5-*2*                     STARCOM VI+                  Two-Way
12    DPBB-*1*                     STARCOM VI+                  One-Way
13    DPBB-*3*                     STARCOM VI+                  FONE-Way
14    DPBB-*2*                     STARCOM VI+                  Two-Way
15    DP711*, DPV721*, DPV721*/C1  STARCOM 7100/7200            One-Way
16    DP713*, DPV723*, DPV723*/C1  STARCOM 7100/7200            FONE-Way
17    DP712*, DPV722*, DPV722*/C1  STARCOM 7100/7200            Two-Way
18    DPBB7-*1*                    STARCOM 7300                 One-Way
19    DPBB7-*3*                    STARCOM 7300                 FONE-Way
20    DPBB7-*2*                    STARCOM 7300                 Two-Way
21    DPBB-*1*-M1                  STARCOM VI+ M/S              One-Way
22    DPBB-*3*-M1                  STARCOM VI+ M/S              FONE-Way
23    DPBB-*2*-M1                  STARCOM VI+ M/S              Two-Way
24    IDP7, LMDS-A, MMDS-A/CT1900  IDP7, LMDS-A, MMDS-A/CT1900  One-Way
25    IDP7, LMDS-A, MMDS-A/CT1900  IDP7, LMDS-A, MMDS-A/CT1900  FONE-Way
26    IDP7, LMDS-A, MMDS-A/CT1900  IDP7, LMDS-A, MMDS-A/CT1900  Two-Way
27    DCR                          DCR                          One-Way
28    DCR 3000S/4000S              DCR                          One-Way
30    CFT2000/2100                 CFT2000/2100                 One-Way
31    CFT2000/2100                 CFT2000/2100                 FONE-Way
32    CFT2000/2100                 CFT2000/2100                 Two-Way
33    STARPORT                     STARPORT                     One-Way
34    STARPORT (not implemented)   STARPORT                     FONE-Way
35    STARPORT (not implemented)   STARPORT                     Two-Way
36    CFT2200                      CFT2200                      One-Way
37    CFT2200                      CFT2200 STARFONE             FONE-Way
38    CFT2200                      CFT2200 STARVUE              Two-Way
39    CFT2900                      CFT2900                      One-Way
40    CFT2900                      CFT2900                      FONE-Way
41    CFT2900                      CFT2900                      Two-Way
42    Sega                         Sega                         One-Way


.-----------------.
| Scrambler Types |
`-----------------'

The ACC-4000 system supports several different types of scramblers at the
headend, including:

STARPACK Service Encoder (SSE)

        An older scrambler that scrambles with standby and 6db constant
        sync-suppression scrambling modes.

Digital Scrambler/Encoder (DS/E)

        An older RF scrambler.

Digital Video/Encoder (DV/E)

        An older baseband scrambler, used to further scramble DS/E
        signals.

Video Processor/Encoder (VP/E)

        A DS/E and a DV/E together.

Modulating Video Processor (MVP) and MVPII

        A newer scrambler.

Modulating Video Processor (MVP) II-DIU

        A MVPII with a Data Inserter Module (DIM) to enable data insertion.


.------------------.
| Scrambling Modes |
`------------------'

The ACC-4000 controls scramblers using several modes of scrambling, including:

        . Sync Suppression
        . Video Inversion
        . Audio Inversion

Supported sync suppression submodes are:

        . Standby
        . Clear, 0db constant
        . 6db constant
        . 10db constant
        . Scene change, 3 seconds
        . 6/10 pseudo-random, 30 seconds
        . 6/10 pseudo-random, 1 minute
        . 6/10 pseudo-random, 16 tics
        . 6/10 pseudo-random, 3 seconds

When using scene change or 6/10 pseudo-random sync suppression, the
ACC-4000 supports a number of dynamic mode types:

        . Pseudo-random 6/10/clear
        . Pseudo-random 6/clear
        . Pseudo-random 10/clear
        . Pseudo-random 6/10
        . Linear 6/10/clear
        . Linear 6/clear
        . Linear 10/clear
        . Linear 6/10

In addition, you can set the interval between dynamic mode time changes
in hours, minutes, seconds, or tics.

Supported video inversion submodes are:

        . Clear
        . Scene change field inversion
        . Constant video inversion
        . Timed field inversion

Note: Video and audio inversion only work with baseband set-top-boxes.


.---------------.
| Security Notes|
`---------------'

These systems normally have modems for use by both General Instruments
personnel and cable company personnel.  General Instruments personnel
dial in to diagnose problems with the system.  Cable company personnel
dial in to change Pay-Per-View (PPV) programming or to configure
customer set-top-boxes.

Any uncollected purchases are lost when a set-top-box is initialized.
To preserve uncollected purchases, the operator will do a Refresh
instead of an Initialize. If you can talk the operator into doing an
Initialization instead of a Refresh, any uncollected purchases not
already forwarded to the billing system will be lost.

Purchases are stored as integers. Older set-top-boxes were limited to
storing 16 purchases. Newer set-top-boxes are limited to storing 63
purchases.


.------------.
| Conclusion |
`------------'

If you can access a system such as the ACC-4000, you can have great fun.
Be careful when giving everyone in your city free access to WWF.


----[  EOF