Sky Card copy/hack

Status
Not open for further replies.
Messages
2
Likes
0
#1
I was wondering if anything has happened with regards to the Sky card being able to be copied into another digibox. I know it may be a long shot, but here's hoping. Can the serial number of the digibox be altered? I think that's the key isn't it?
 

rolfw

Believe it when I see it Admin.
Staff member
Messages
37,664
Likes
1,276
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
#2
No I think that it is more than that Showcase, certain parts of the Sky card can be read, but to my knowledge nobody has copied one successfully. There is also to my knowledge no easy way of changing the number of the box to match a card pairing.
 

easysat

Regular Member
Messages
323
Likes
0
My Satellite Setup
Dreambox 7000S + motorised 80cm dish, Amstrad DRX550 Digibox + fixed dish
My Location
pj::
#3
I saw something a while back from someone in Italy. He claimed that the firmware in a Pace digibox model (2500?) could be read via the JTAG port on the STM processor. The box serial number was allegedly in the flash and non-protected and so could be changed if wanted. I guess if this worked, only people with two boxes and one card would find it useful.
 

rolfw

Believe it when I see it Admin.
Staff member
Messages
37,664
Likes
1,276
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
#4
Interesting Easysat, as you say of course, only of use to someone with a second box or of course a cloned card.
 
Messages
2
Likes
0
#5
That's great information guys. Thanks for your replies. I have no idea what JTAGs are etc, but if anyone knows if any of this is reality and not rumour, I'm prepared to buy a Digibox and test this all out. Please investigate and reply. I'm pretty sure this would have great consequences within this marketplace.
 
Messages
11
Likes
0
My Location
pj::none
#6
heard that the box can be chiped card need to be copyed dont know how true but i think its possible
 

2old4this

Honorary Admin
Messages
1,658
Likes
0
My Location
Cloud Cuckoo Land
#7
Have heard nothing substantive on copying cards, but it is certainly true that the firmware of the digibox can be read out and written back (including a modified serial-number if desired) using a JTAG hardware interface (or BDM or OSLink). I posted on this begin/October last year. See http://www.satellites.co.uk/php-bin/forum/showthread.php?s=&threadid=2798

The serial number (some refer to it as the boxkey) can be changed freely if there is no checksum applied. The firmwares so far examined did not include checksums on the serial.

The sector where the serial-number is stored is protected, but by applying 12v to the Flash RESET signal one can unlock it and overwrite it.

There was a website with more details on doing this for a Pace 2500S last October at http://www.worex.ee/ but this appears to have now disappeared.

In any event, I know for a fact that it has been successfully done on a Grundig GDS310.

2old
PS: A JTAG (Joint Test Action Group) interface is simply an interface which directly talks to the hardware/memory without going through an on-board aplication.
 

easysat

Regular Member
Messages
323
Likes
0
My Satellite Setup
Dreambox 7000S + motorised 80cm dish, Amstrad DRX550 Digibox + fixed dish
My Location
pj::
#8
Now that 2old mentions it, I am pretty certain that his post was the source of my information.

I tried this with an Amstrad DRX100, but I couldn't get the JTAG interface to divulge anything except the chip ID. I think the available JTAG firmware reader programs rely on a using the DCU (diagnostics control unit) that is built into more recent STi5xxx processors. The ST20-TP2 in my Amstrad doesn't have this so maybe this is why it didn't work. The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor.

I was going to try an OS-link with the ST20-TP2 but I couldn't get my OS-link interface to work. Maybe another day when I have more time, I will have another go at trying to sort this out.

By the way, some other were people using PC cards to download the software updates that get sent out to Digiboxes. This seems a painless way of getting the firmware, as you don't even need to have the Digibox!
 
Messages
1
Likes
0
#9
"The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor."
I'm wondering, what fta receiver is it that has that processor?
 
Messages
11
Likes
0
My Location
stoke
#10
must look inside sky pace wonder if similar to cable pace,ie lift an read atmels,not that im familiar with this practace bot heard about it.
 
Messages
3
Likes
0
#11
Could someone please advise/clarify re: JTAG/OSLINK Interface ?

Reading the section about using JTAG/OSLINK Interface modules on Pace 2500? boxes, I have looked inside two different pace models and cannot find a cable connection for either Interface Modules.

I am puzzled ?
 

Donzo Bonzo

Regular Member
Messages
93
Likes
1
My Satellite Setup
Humax and Echostar receivers, Dragon, two dishes, one fixed 100cm dish pointing at Hotbird, and a 90cm motorised dish; plus a rubbish DVD recorder and cool DVD players, and lots of cables!! Oh, yeah, and a video recorder - best invention yet!!
#12
Even if you could copy a card, surely you would only have as many channels as that are on your original subscription. If you were on the basic package, surely the duplicate card would also be on the basic package...only wondered.
 

easysat

Regular Member
Messages
323
Likes
0
My Satellite Setup
Dreambox 7000S + motorised 80cm dish, Amstrad DRX550 Digibox + fixed dish
My Location
pj::
#13
m.knight said:
Could someone please advise/clarify re: JTAG/OSLINK Interface ?

Reading the section about using JTAG/OSLINK Interface modules on Pace 2500? boxes, I have looked inside two different pace models and cannot find a cable connection for either Interface Modules.
The general method if you haven't a service manual for the receiver in question...
You need to identify the relevant pins on the MPEG processor chip (using the chip manufacturer's datasheet). With this information, you can trace the tracks on the board to either a connector (if the manufacturer has provided one) or some other convenient point where you can solder your own wires on. Usually the JTAG signals are brought out to at least some pads on the board as the receiver manufacturer wants access for production test purposes. OSLINK is specific to ST chips (descended from the original British transputer) but you can use it to do all sorts of interesting things like dump the memory contents.
 
Messages
7
Likes
0
#15
you dont need to copy the card or add little gadgets on the box.
theres a new way of watching sky,and any other encryption apart from power vu.

dreamboxxxxxxxxxxxxxxxxxxxx
 

john_graydon

Specialist Contributor
Messages
2,219
Likes
3
My Satellite Setup
Azbox premium HD+,Dusty Dreambox 7000s,& Sky HD.
My Location
Dublin....Ireland
#16
georgebr said:
you dont need to copy the card or add little gadgets on the box.
theres a new way of watching sky,and any other encryption apart from power vu.

dreamboxxxxxxxxxxxxxxxxxxxx

You still need a valid sky card to view these chs.
 

007.4

Regular Member
Messages
113
Likes
25
My Satellite Setup
STBs = Ultimo4K, VUDUO2, VuSolo2, Alien2, AzBox HD Elite, ET8000:
Dishes = 180cm PF, 80cm offset, 60cm offset, Sky mini:
LNBs c120 for PF dish = Ku-Band White Smart Titanium (modified to c120)
and for C-Band Titanium C1W-PLL
My Location
UK
#17
"You still need a valid sky card to view these chs."

..........Well "someone" still needs a valid card ;-)
 

john_graydon

Specialist Contributor
Messages
2,219
Likes
3
My Satellite Setup
Azbox premium HD+,Dusty Dreambox 7000s,& Sky HD.
My Location
Dublin....Ireland
#18
007.4 said:
"You still need a valid sky card to view these chs."

..........Well "someone" still needs a valid card ;-)
Correct for sure.
 

Detlef

Regular Member
Messages
17
Likes
0
My Location
Bonn, Ostend
#19
"The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor." and chavonbravo wrote: "I'm wondering, what fta receiver is it that has that processor?"
The answer is most of them. Do a Google on ST5505 or ST5518 and half of China will appear. :)

They are a great family of chips that offer on one chip what used to take 4 or more chips; hence the cheapness of many current STBs.
 
Messages
2
Likes
0
My Satellite Setup
hmm
My Location
london
#20
easysat said:
Now that 2old mentions it, I am pretty certain that his post was the source of my information.

I tried this with an Amstrad DRX100, but I couldn't get the JTAG interface to divulge anything except the chip ID. I think the available JTAG firmware reader programs rely on a using the DCU (diagnostics control unit) that is built into more recent STi5xxx processors. The ST20-TP2 in my Amstrad doesn't have this so maybe this is why it didn't work. The JTAG trick works fine with a cheap FTA receiver that I have with the STi5505 processor.

I was going to try an OS-link with the ST20-TP2 but I couldn't get my OS-link interface to work. Maybe another day when I have more time, I will have another go at trying to sort this out.

By the way, some other were people using PC cards to download the software updates that get sent out to Digiboxes. This seems a painless way of getting the firmware, as you don't even need to have the Digibox!
Hi,
I've opened amstrad drx100 and I cannot find jtag connection, could you tell me where can I find it ?

thx
 
Status
Not open for further replies.
Top