Multiple subbed box dumps

JTAG on dct2500/dct700
Post Reply
bowser22
Junior Member
Posts: 9
Joined: Wed Jul 26, 2006 7:56 am

Multiple subbed box dumps

Post by bowser22 »

Hey guys, everytime I change my sub with the CACO I make a dump if it. I have multiple units in the house, some running unmodded and some with spoofed uid's. At one time or another all the boxes have had the programming the others currently have. I have dumped the one from my basement with premies open and wrote the full backup to the one in my kitchen and still do not received the programming even though the kitchen box has had these premies channel before. Why not? I just get "SUBSCRIPTION SERVICE" call to sub
moddog
Junior Member
Posts: 638
Joined: Fri Aug 20, 2010 1:47 pm
Location: Some ware just like you.
Contact:

Post by moddog »

Clone one box with the other will not happen.....an since you or a member from 2006 i will not Explain why.
Good better best
Killswitch
Junior Member
Posts: 439
Joined: Tue Mar 23, 2010 6:12 am

Post by Killswitch »

Wow-w ! The guy is still using the legacy BDM and JTAG, no doubt. Been here for over seven (7) yrs. and thought that the Hardware was gonna get him full boat. Re-markable ! Didn't realize that these Tools were only gonna get him what had been previously subscribed to and NO MORE . I'll bet that this is pretty much the norm. Suggestion : go into the Archives and begin reading until your eyeballs pop from sockets. Then, pop back into place and continue.
bowser22
Junior Member
Posts: 9
Joined: Wed Jul 26, 2006 7:56 am

Post by bowser22 »

Yeah if it still works for me why wouldn't I use it? I was just mistaken in thinking I could get literally the last thing subbed as in before what is currently on the box but just a misunderstanding. I've been testing my boxes for a few months now and am by far no n00b to this shit so pull back on the attitude a bit boys. Legacy bdm and jtagg? What are you using that's so good? Besides a legitimate sub?

Ps, 7 years means fuck look at my minimal activity, most of the time spent reading
bowser22
Junior Member
Posts: 9
Joined: Wed Jul 26, 2006 7:56 am

Post by bowser22 »

I'm not here to argue but I have an idea, I was able to tune to the OOB frequency using a scanner with a discriminator output. I have dumped the raw stream audio, I'm considering doing some package changes and then playing the stream clip back using a tv transmitter tuned to the OOB, think it would work?
Wolfgang
Junior Member
Posts: 158
Joined: Fri May 03, 2013 6:00 pm
Location: Wild Wild West
Contact:

You are over simplifying the digital technology

Post by Wolfgang »

bowser22 wrote:... package changes and then playing the stream clip back using a tv transmitter tuned to the OOB, think it would work?
You are going to need some more hardware than an analog TV transmitter. OOB signal is a digitally modulated data into a QPSK modulator while an analog TV transmitter has a main video carrier modulated in AM and a sound 4.5 MHz sub-carrier modulated in FM. I guess you don't have one of these GI or Motorola modulators to create the real OOB signal.
This type of modulators are used for OnLine and OffLine Loaders that provide Firmware Code downloads including application modules like TV Guide, VOD, DVR etc.
Anyway that is not really expensive investment since one can find really cheap obsolete but still working good modulators. Here is what is currently selling on Fleabay: http://www.ebay.com/itm/GENERAL-INSTRUMENTS-MOTOROLA-OM-1000-MPEG-2-DIGITAL-OUT-OF-BAND-MODULATOR-QPSK-/360657058616?pt=LH_DefaultDomain_0&hash=item53f8d5fb38
However the real problem is to get the software that will drive that modulator. I am not trying to be negative here but this task won't reveal any secrets even if you succeed with this project. I don't actually see any benefit in all of this even if you have all this stuff figured out. If you are that good in modifying the data package you could do the same thing with the USBJTAG without all this RF stuff. Just go ahead and modify the firmware and the channel maps. Eventually you'll realize that this is not the way to read the keys from the XC chip and write such keys back to get the premium channels which I believe is your goal. That could be achieved much easier by just using serial connection and a special software of course. No need of all that hardware troubles. Unfortunately that software is highly confidential and not available.
afterhoursalex
Junior Member
Posts: 71
Joined: Sat Jan 12, 2008 7:03 pm

Post by afterhoursalex »

I disagree wolfgang,anybody can get access to that software
justsomeguy
Junior Member
Posts: 1417
Joined: Wed Jan 28, 2009 4:01 pm

Post by justsomeguy »

afterhoursalex wrote:I disagree wolfgang,anybody can get access to that software
the software and hardware yes....the proper codes to send to the box..well there's another story...lol....
live your life like a beer commericial
Wolfgang
Junior Member
Posts: 158
Joined: Fri May 03, 2013 6:00 pm
Location: Wild Wild West
Contact:

Just saying how things are normally done ...

Post by Wolfgang »

afterhoursalex wrote:I disagree wolfgang,anybody can get access to that software
I am curious to hear what software you have in your mind? I know exactly what software drives OM1000 or OM2000 but I don't think that is available on torrent sites, LOL. When I mentioned the confidential software I meant the software that writes the Unit Address directly to the XC chip. This is not the same as the OLL software i wrote about.
If you meant the software for serial connection than you are right. Everyone can get a free download of Putty or TeraTerm LOL. Still, that won't give you anything you can't achieve with USBJTAG on DCT700. Downloading firmware by OLL is something you want to do on boxes that don't have access to USBJTAG. OLLs are primarily used by Service Centers for STBs.
Comcast uses Linux based Headends with Digital Account Controllers to write keys to cable boxes again using that baby from the above picture, so it's a little bit more complicated than Off-Line-Loader driving software used to download firmware and apps. When it comes to the keys, which is the goal of this post, you need a lot more equipment and knowledge. There probably are other ways that are not discussed in public, I am just saying how things are normally done by cacos.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

@Wolfgang
Some members remind us of the origin of the phrase "ignorance is bliss"

http://200.30.155.18/
Wolfgang
Junior Member
Posts: 158
Joined: Fri May 03, 2013 6:00 pm
Location: Wild Wild West
Contact:

Post by Wolfgang »

@merkin

Good job, this communication server is running the same Java Carousel software that drives the OM modulators over TCP/IP port I mentioned in my post.
I remember you having similar project as the original poster, did you have any luck with loging the OOB downstream you wrote about in this post:

viewtopic.php?p=55829#post55829
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Wolfgang wrote:@merkin
I remember you having similar project as the original poster, did you have any luck with loging the OOB downstream you wrote about in this post:

viewtopic.php?p=55829#post55829
Is that what he was trying to do?

I got an r5000hd from ebay, but its the parallel ts version, and the demods in these cable boxes spit out serial ts. So I need to build an 8-bit serial in parallel out shift register with some d-flip-flops,ect., or just do it in vhdl. Its on the to-do list, just not a priority since no one seemed interested in the project.
Wolfgang
Junior Member
Posts: 158
Joined: Fri May 03, 2013 6:00 pm
Location: Wild Wild West
Contact:

Post by Wolfgang »

merkin wrote:... Is that what he was trying to do?...
It seems to me that's exactly what he was trying to do except the equipment used. Here it goes:

# Data downstream signal from cable received on an FM receiver tuned on the OOB channel (e.g. 75.25 MHz)
# Recorded the demodulated signal that sounds like a Dial-Up modem on a tape (or any other type) recorder
# Modulate the same recorded audio signal into a TV transmitter (not sure if he meant to modulate the audio FM sub-carrier or the Video Main carrier).
# Connect the TV TX output to the RF IN of the box and emulate the Data downstream as if it was coming from the CaCo.

@ bowser22 Please correct me if I am wrong maybe I misunderstood your concept.

Anyway, even if this equipment was capable of doing this which I seriously doubt because an analog TV transmiter doesn't have an FSK or PSK modulator, how can you identify what kind of data you have recorded as an audio track?
You originated this thread but we haven't heard from you ever since. I don't want to be negative here but this is a serious projects that needs more than basics knowledge of the digital cable. I suggest you to look at the link I mentioned in my previous post where similar idea was initiated but it takes a team to work on it to get it done. Especially some help from the USBJTAG maker is expected, LOL.
Finally this is not about thieving cable services since the time and money spent on such projects often exceeds the monthly cable bill. It's the curiosity itch that needs to be scratched.
bowser22
Junior Member
Posts: 9
Joined: Wed Jul 26, 2006 7:56 am

Post by bowser22 »

Wolfgang, that's exactly what I was attempting to do. I was going to try and capture a 3 minute stream following changes made to my subbed account. When the box receives the data I will know and stop recording. I am in it for the curiosity, it seems very feasible, though I am certain it will require lots of work. Maybe the spi replay is a better route, although last time I checked USBJTAG had not completed it for the dct700. Is there any way that data stream can be captured as audio and replayed? I mean, doesn't the dct demodulate the noise as it is?
bowser22
Junior Member
Posts: 9
Joined: Wed Jul 26, 2006 7:56 am

Post by bowser22 »

As far as replaying the audio I was going to attempt to do it through the audio and the video and watch the emm status in the dct700 service menu.
Post Reply

Who is online

Users browsing this forum: No registered users and 6 guests