Sky Card copy/hack

Status
Not open for further replies.

showcase

Member
Joined
Apr 21, 2003
Messages
2
Reaction score
0
Points
0
Website
Visit site
I was wondering if anything has happened with regards to the Sky card being able to be copied into another digibox. I know it may be a long shot, but here's hoping. Can the serial number of the digibox be altered? I think that's the key isn't it?
 

rolfw

Believe it when I see it Admin.
Staff member
Joined
May 1, 1999
Messages
38,056
Reaction score
1,443
Points
113
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
No I think that it is more than that Showcase, certain parts of the Sky card can be read, but to my knowledge nobody has copied one successfully. There is also to my knowledge no easy way of changing the number of the box to match a card pairing.
 

easysat

Regular Member
Joined
Jan 1, 2000
Messages
323
Reaction score
0
Points
0
My Satellite Setup
Dreambox 7000S + motorised 80cm dish, Amstrad DRX550 Digibox + fixed dish
My Location
pj::
I saw something a while back from someone in Italy. He claimed that the firmware in a Pace digibox model (2500?) could be read via the JTAG port on the STM processor. The box serial number was allegedly in the flash and non-protected and so could be changed if wanted. I guess if this worked, only people with two boxes and one card would find it useful.
 

rolfw

Believe it when I see it Admin.
Staff member
Joined
May 1, 1999
Messages
38,056
Reaction score
1,443
Points
113
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
Interesting Easysat, as you say of course, only of use to someone with a second box or of course a cloned card.
 

showcase

Member
Joined
Apr 21, 2003
Messages
2
Reaction score
0
Points
0
Website
Visit site
That's great information guys. Thanks for your replies. I have no idea what JTAGs are etc, but if anyone knows if any of this is reality and not rumour, I'm prepared to buy a Digibox and test this all out. Please investigate and reply. I'm pretty sure this would have great consequences within this marketplace.
 

willy

Member
Joined
Jan 1, 2000
Messages
11
Reaction score
0
Points
0
Website
Visit site
My Location
pj::none
heard that the box can be chiped card need to be copyed dont know how true but i think its possible
 

2old4this

Honorary Admin
Joined
Jan 1, 1999
Messages
1,658
Reaction score
0
Points
0
My Location
Cloud Cuckoo Land
Have heard nothing substantive on copying cards, but it is certainly true that the firmware of the digibox can be read out and written back (including a modified serial-number if desired) using a JTAG hardware interface (or BDM or OSLink). I posted on this begin/October last year. See http://www.satellites.co.uk/php-bin/forum/showthread.php?s=&threadid=2798

The serial number (some refer to it as the boxkey) can be changed freely if there is no checksum applied. The firmwares so far examined did not include checksums on the serial.

The sector where the serial-number is stored is protected, but by applying 12v to the Flash RESET signal one can unlock it and overwrite it.

There was a website with more details on doing this for a Pace 2500S last October at http://www.worex.ee/ but this appears to have now disappeared.

In any event, I know for a fact that it has been successfully done on a Grundig GDS310.

2old
PS: A JTAG (Joint Test Action Group) interface is simply an interface which directly talks to the hardware/memory without going through an on-board aplication.
 

easysat

Regular Member
Joined
Jan 1, 2000
Messages
323
Reaction score
0
Points
0
My Satellite Setup
Dreambox 7000S + motorised 80cm dish, Amstrad DRX550 Digibox + fixed dish
My Location
pj::
Now that 2old mentions it, I am pretty certain that his post was the source of my information.

I tried this with an Amstrad DRX100, but I couldn't get the JTAG interface to divulge anything except the chip ID. I think the available JTAG firmware reader programs rely on a using the DCU (diagnostics control unit) that is built into more recent STi5xxx processors. The ST20-TP2 in my Amstrad doesn't have this so maybe this is why it didn't work. The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor.

I was going to try an OS-link with the ST20-TP2 but I couldn't get my OS-link interface to work. Maybe another day when I have more time, I will have another go at trying to sort this out.

By the way, some other were people using PC cards to download the software updates that get sent out to Digiboxes. This seems a painless way of getting the firmware, as you don't even need to have the Digibox!
 

chavonbravo

Member
Joined
Jul 3, 2004
Messages
1
Reaction score
0
Points
0
Age
39
"The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor."
I'm wondering, what fta receiver is it that has that processor?
 

bronson

Member
Joined
Aug 20, 2004
Messages
11
Reaction score
0
Points
0
Age
47
My Location
stoke
must look inside sky pace wonder if similar to cable pace,ie lift an read atmels,not that im familiar with this practace bot heard about it.
 

m.knight

Member
Joined
Jan 8, 2005
Messages
3
Reaction score
0
Points
0
Could someone please advise/clarify re: JTAG/OSLINK Interface ?

Reading the section about using JTAG/OSLINK Interface modules on Pace 2500? boxes, I have looked inside two different pace models and cannot find a cable connection for either Interface Modules.

I am puzzled ?
 

Donzo Bonzo

Regular Member
Joined
Mar 3, 2005
Messages
93
Reaction score
1
Points
0
Age
52
My Satellite Setup
Humax and Echostar receivers, Dragon, two dishes, one fixed 100cm dish pointing at Hotbird, and a 90cm motorised dish; plus a rubbish DVD recorder and cool DVD players, and lots of cables!! Oh, yeah, and a video recorder - best invention yet!!
Even if you could copy a card, surely you would only have as many channels as that are on your original subscription. If you were on the basic package, surely the duplicate card would also be on the basic package...only wondered.
 

easysat

Regular Member
Joined
Jan 1, 2000
Messages
323
Reaction score
0
Points
0
My Satellite Setup
Dreambox 7000S + motorised 80cm dish, Amstrad DRX550 Digibox + fixed dish
My Location
pj::
m.knight said:
Could someone please advise/clarify re: JTAG/OSLINK Interface ?

Reading the section about using JTAG/OSLINK Interface modules on Pace 2500? boxes, I have looked inside two different pace models and cannot find a cable connection for either Interface Modules.

The general method if you haven't a service manual for the receiver in question...
You need to identify the relevant pins on the MPEG processor chip (using the chip manufacturer's datasheet). With this information, you can trace the tracks on the board to either a connector (if the manufacturer has provided one) or some other convenient point where you can solder your own wires on. Usually the JTAG signals are brought out to at least some pads on the board as the receiver manufacturer wants access for production test purposes. OSLINK is specific to ST chips (descended from the original British transputer) but you can use it to do all sorts of interesting things like dump the memory contents.
 

javers

Member
Joined
Jun 8, 2004
Messages
1
Reaction score
0
Points
0
Age
39
If its any help, the dragon cam now supports sky uk cards and you can set the serial # to any number you like.
 

georgebr

Member
Joined
Jun 4, 2003
Messages
7
Reaction score
0
Points
0
Age
51
Website
Visit site
you dont need to copy the card or add little gadgets on the box.
theres a new way of watching sky,and any other encryption apart from power vu.

dreamboxxxxxxxxxxxxxxxxxxxx
 

john_graydon

Regular Member
Joined
Aug 24, 2003
Messages
2,219
Reaction score
3
Points
38
Age
61
My Satellite Setup
Azbox premium HD+,Dusty Dreambox 7000s,& Sky HD.
My Location
Dublin....Ireland
georgebr said:
you dont need to copy the card or add little gadgets on the box.
theres a new way of watching sky,and any other encryption apart from power vu.

dreamboxxxxxxxxxxxxxxxxxxxx


You still need a valid sky card to view these chs.
 

007.4

Regular Member
Joined
Dec 8, 2002
Messages
159
Reaction score
37
Points
28
My Satellite Setup
STBs = Ultimo4K, VUDUO2, VuSolo2, Alien2, AzBox HD Elite, ET8000:
Dishes = 180cm PF, 80cm offset, 60cm offset, Sky mini:
LNBs c120 for PF dish = Ku-Band White Smart Titanium (modified to c120)
and for C-Band Titanium C1W-PLL
My Location
UK
"You still need a valid sky card to view these chs."

..........Well "someone" still needs a valid card ;-)
 

john_graydon

Regular Member
Joined
Aug 24, 2003
Messages
2,219
Reaction score
3
Points
38
Age
61
My Satellite Setup
Azbox premium HD+,Dusty Dreambox 7000s,& Sky HD.
My Location
Dublin....Ireland
007.4 said:
"You still need a valid sky card to view these chs."

..........Well "someone" still needs a valid card ;-)

Correct for sure.
 

Detlef

Regular Member
Joined
Jun 28, 2004
Messages
17
Reaction score
0
Points
0
Age
38
My Location
Bonn, Ostend
"The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor." and chavonbravo wrote: "I'm wondering, what fta receiver is it that has that processor?"
The answer is most of them. Do a Google on ST5505 or ST5518 and half of China will appear. :)

They are a great family of chips that offer on one chip what used to take 4 or more chips; hence the cheapness of many current STBs.
 

remur

Member
Joined
Aug 23, 2005
Messages
2
Reaction score
0
Points
0
Age
45
My Satellite Setup
hmm
My Location
london
easysat said:
Now that 2old mentions it, I am pretty certain that his post was the source of my information.

I tried this with an Amstrad DRX100, but I couldn't get the JTAG interface to divulge anything except the chip ID. I think the available JTAG firmware reader programs rely on a using the DCU (diagnostics control unit) that is built into more recent STi5xxx processors. The ST20-TP2 in my Amstrad doesn't have this so maybe this is why it didn't work. The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor.

I was going to try an OS-link with the ST20-TP2 but I couldn't get my OS-link interface to work. Maybe another day when I have more time, I will have another go at trying to sort this out.

By the way, some other were people using PC cards to download the software updates that get sent out to Digiboxes. This seems a painless way of getting the firmware, as you don't even need to have the Digibox!

Hi,
I've opened amstrad drx100 and I cannot find jtag connection, could you tell me where can I find it ?

thx
 
Status
Not open for further replies.
Top