.                                                +             .

               _______ ____   ________    ___    _______ _____/|

       +      /  __  //    \ /  ______\  /  /   /  __  //  ____!

             /  /_ \//  /\  \\  \  ___  /  /   /  /_ \//  /___

            /  __/  /  /  \  \\  \ \  \/  /   /  __/   \____  \

            \  \__/\\  \  /  / \  \/  /\__\___\  \__/\.____/  /    '

   *         \_____/ \__\/  /   \____/    \__/ \_____/| _____/     |

                        /__/  .     /    _  /         |/       - --+- -

      USR HST Dual Standard 14400  /    / \/ 285 Megs :            |

          _____________________   /     \   ______________________ .

   .      \__ __ _ _           \_/       \_/            _ _ __ __/

   :        \___ __ _ _  Sysop: Zaphod Beeblebrox   _ _ __ ___/

   |           \___ __ _ _   Control Team EHQ    _ _ __ ___/

---+--- -         \___________    ICS SHQ    ___________/

   |                          \___   :   ___/

   :            +46-18-262804     \  |  /     24 Hours/Day.           ' 

   .      *                        \ | /    .

                   .______    _____/ | \___/|___________ 

                   |   _  \  /  _/ __|__ \__!  ______  /

       '           |  | \  \/  /_\| /  /|/_  \/ |  | \/

                   |  |  \  \  _/ ' \___'  \    |  |              +

                   |  |  /  /  \__/\____/  /    |  |

                   !__! /__/\______| _____/     !__!

                                   |/                             

                                   :

File: CT_CPIR1.TXT (Version 1.00).

----------------------------------



Control Team Scandinavia Brings you: Cable Scrambling Systems - All you wanted

to know about them, but were afraid to ask the Cable Co. How they work and how

to defeat their security and get pay-channels for free.



Part I: Salora Cable Descramblers SAHT 1006 Type 4256 and SAHT 2000 Type 4270

=============================================================================



The Salora Cable Descrambler is the most common one in Sweden and the other

Scandinavian countries. It's manufactured by Salora/Luxor, probably either in

Sweden or Finland. This is probably one of the more advanced descramblers

currently in use, and the scrambling method is one out of four possible ones

listed below. The audio signal is always left untouched (At least it appears to

be that way!!!). This textfile will concentrate on the Mark 1 Saloras, but some

of this will also be true for the Mark 2's:



     1. Supressed HSYNC pulses only

     2. Supressed HSYNC pulses and inverted video signal.

     3. Normal Picture, inverted video signal.

     4. A variation of all the above srambling techniques, for example they

        can send every second picture unscrambled and inverted, and then send a

        scrambled picture that is not inverted. Most pirate descramblers are

        not fast enough to detect whether they use this scrambling technique or

        not!!!! This is enough about how they scramble the channels for now,

        let us concentrate on how the descrambler works, and how to defeat it.



Hacking Salora Mark 1 Cable Descramblers:

=========================================



First, we start with the standard Mark 1 Salora Cable Descrambler box: It's a

grey box, about the size of a HST, but about double the height. On the front

there is five pushbuttons, one for On/Off, Channel Step forward, Channel Step

Backward and then two switches concerning shifting between your in-memory

pre-programmed channels and the decoders hyperband channels. On thr right of

the box you have a key-lock that can lock the hyperband feature of the box, so

you can only watch the first 20 channels (Those you programmed in the box via

your remote control). On the back of the box you have the usual RF in and RF

out for the antenna wires from the cablenet, and then Test Signal and Antenna

amplifier On/Off. And of course, on the front you also have a few leds

indicating if you're in hyperband or normal mode, and a two-digit led display

showing the current channel you're watching (Just the channel number, no fancy

text or anything...). About opening the box: You're on your own now, most boxes

that you rent nowadays have some platic seals in the two bottom screw-holes,

and the cable company tends to get highly pissed-off if they find their seals

are not in place when you return your rented box. Although, I have looked at

the contract you sign when you get the box, and it doesn't say anywhere that

you are not allowed to open it, but in the manual it says the box will stop

working if you open it, and that you are not allowed to do that. It will *NOT*

stop working if you open it. I did that to a box we rented a long time ago, and

it worked when I put it back together, but sad enough that was before I knew

what to do with cable boxes to get free channels... Yak-Yak!!! But on the seals

that are right over the first two bottom screws are some kind of tracks that

could be for a very large screwdrives, one who has almost the same diameter as

the hole it resides in, so maybe there is a way to remove the seal without

damaging it. Or, even better, get a descrambler they don't know you have, then

you can fuck around with it as much as you like.



When you have opened the box, start with removing the large daughterboard to

the left, and put it aside. Do not unplug the leads between the main

circuitboard and the daughterboard, they will just be alot of trouble getting

them back in the right places. Now, locate IC13 and IC15, they should be down

to the left corner of the main PCB. They are very often covered with molten

glue, which we will have to remove first. Don't worry, just use a knife, but be

carefull not to damage the CPU or the ID Prom, since they are the only circuits

in the descrambler you cannot buy at an electronics part store. The CPU is

custom made for Salora, and the ID prom has to be saved for when you are going

to return your cable-box. After you have removed all of the molten glue, remove

the screws that hold the main PCB and remove the main PCB from the box, then

desolder IC15 and put a 16 pin socket where it was. (Use a good socket, not the

low-budget ones they sell for .01 cents a piece!!!). Check which pin of IC15

the circuit trace from Pin 11 of IC13 goes to. This is the data bit of the prom

containing your ID number that they decided to use on your box. The ID prom is

normally a 54S287 or N82S129 (256*4 Bits Bipolar PROM, 50 ns). Inside the

bipolar prom, only one of the four bits available are used. In the first 32 bit

segment your ID number is stored, and in segment 3 Saloras Service address,

which is 1024 is always stored. The decoders address is in fact only 20 bits,

but what's the other 12 bits then?? Well, they there just to make life hard for

us. For example if you should have ID #042424 it will be $A5B8 and in binary it

will be %00001010010110111000. This is then shifted right 11 times (Or let us

for simplicity use a multiplication with 2^11. 42424*(2^11)=86884352, $52DC000,

and binary %00000101001011011100000000000000. This ID number is then OR:ed with

the check: %10000000000000000000010001001101 and finally we get the bitstream

which the decoder CPU will read from the ID Prom. So, now we do know what we

should encode into the ID prom, now the only problem is where to obtain valid

decoder id numbers and how to program them onto the bipolar prom... Wait a

second... Doesn't the sticker on the back of the box look very similar to the

numbers I read from my ID prom?? Fuckin'A dude... The decoders ID number is

almost always written on a sticker on the back/under the decoder. There are two

stickers, one with only 6-8 digits on it, and one with both letters and digits

on it. You are only interested in the one with digits-only!!! That is the

number to process with the above method and program into a prom for the

decoder. Bipolar proms are a bit of a pain to program, so I have included some

pictures explaining how to use a standard 2764 Eprom (Yeah, I know, it's 10000

times too big, but it's easier to program one of those, right???), and how to

build a 32 bit multiplexer circuit; In other words, build your own 32 bit

eprom, but this one is programmed with 32 DIP switches which you flip low or

high manually when you need to change ID number on your box. I have tested both

designs on my own box, and they work very good. However the multiplexer is much

more complex to build, so I only recommend that one for the serious hardware

wizards!!! Oh yes, it's usually bit 3 or 4 on the bipolar prom that are used to

send data to the CPU, that is, pins 10 and 9 on IC15. Switching between the

normal address and the service address is done by cutting or closing J64 which

is a jumper between VCC and A6 on IC15. A6 is otherwise grounded via a 220 Ohm

resistor. (See the diagram over the Salora address pinout. This one was made by

Lord Canis, and some of the information in this text as well as the original

Salora Address Creator v2.0 for Pc and comaptibles were also programmed by Lord

Canis and Electronic Power. I do not know any of them, but I feel that I have

to credit them for their work, if it hadn't been for them I would never have

started hacking cable descramblers at all, and this file would never have been

written!!!! But I felt that I had to write some more-precise descriptions on

how to hack the Saloras, and how they work, and most important of all: How to

use other circuits instead of the hard to program bipolar proms. I will also

include an Atari ST compatible conversion of the Salora Address creator, but

the ST version will support 8 bit address proms, since using a 2764 eprom will

give you 8 databits, and that is 8 ID numbers for each address. You'll

understand what I am talking about if you know anything about memory chips.



Have a look at the pictures supplied in this archive for schematics for build

-ing the 2764 Eprom adaptor and the address creator multiplexer mentioned a

bit earlier in this text. Anyway, as an example, here's the dump-files from

a Salora decoder.......





Binary Dump of Salora Decoder Prom #88768 (Old Salora Decoder).

===============================================================



10011111111111111111111111111111

11111111111111111111111111111111

10111111111111111111111111111111

11111000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



10000000000000000000000000000000

00000000000000000000000000000000

10000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



10000000000000000000000000000000

00000000000000000000000000000000

10000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



10001010110101100000010001001101 = 88768 = $15AC0

00000000000000000000000000000000

10000000001000000000000000000000 = 1024 = $400

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



When you look at this dump, you will recognize that the old Salora decoders

only have one address burned on the pro except for the service address. The

original decoder address is always programmed in bit 3 or 4 at the first 32

bit segment. The service address is always at bit 3 or 4 at the third 32 bit

The old Salora is the easiest one to hack...... Now we will have a look at

the rom from a new Salora NT:....Binary ump of Salora NT Decoder Prom #134076 - B228010 (Salora NT).

====================================================================



10011111111111111111111111111111

10011111111111111111111111111111

10011111111111111111111111111111

10011111111111111111111111111111

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



10000000000000000000000000000000

10000000000000000000000000000000

10000000000000000000000000000000

10000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



10011010111101110100110001001101 = 220905 = $35EE9

00000000000000000000000000000000

10000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



10000000001000000000010000000000 = 1024 = $400

00000000000000000000000000000000

10010000010111011110010001001101 = 134076 = $20BBC

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000



What can we say about the prom dump of the Salora NT decoder you see above???

Well, bits 1 and 2 are always the same on all of the Salora NT's I have dumped

the proms from. And in fact they are not even connected to anything at all if

you have a look inside the LF0101 VLSI module. Bit 4 contains the service addr

in the first 32 bit segment, and the actual cable ID in the second 32 bit

segment. The rest of bit 4 is unused. In bit 3 the first segment appears to

be connected to the CPU in the VLSI module, as far as I can see, and the first

32 bit segment is the only part that is in use in bit 3. This might or might

not be anything important, I am not 100% sure, since I have *NOT* successfully

hacked one of these new babies.... Either it's a checksum of bit 4 segment 2,

or it might be a value that is also programmed in the main CPU, to make it

impossible to replace the ID prom without reading off the checksum from it

first. That means you have to build yourself a read-device for bipolar proms

(This is not too hard, but the average lamer would probably end up destroying

both the decoder and the computer he tried to read the prom with!!!). To

desolder the prom is out of the question, since it's a surface mounted PLCC

device, which resides inside the LF0101 VLSI module. To reach the prom, you

have to open up the VLSI module, and melt a bit of the glue they used to hide

all of the goodies inside it.... I have successfully hacked one of these new

decoders now, and to hack it, you do like this: Remove the top black cover of

LF0101, and you'll see a small black chip beneath the molten glue. Remove all

of the molten glue around that chip, which is the 74S287 (256*4 Bit PROM), and

solder wire wrap wires from address pins VCC,GND,A0,A1,A2,A3,A4 to your pirate

prom. Cut the leg that is marked as D4 between the circuitboard and where it

enters the 20 pin PLCC module, and connect D4 from the pirate prom to the end

that is going to the circuitboard. (See picture schematics). First we have the

pinconfig of both the PLCC 74S287 and the DIL N82S129 chips:



     V   C C                            V                  

     C A E E D D D D              A 6 N C A                

     C 7 1 2 1 2 3 4              5 A C C 7                

     | | | | | | | |              | | | | |                

    -----------------            /----------               

    |               |         A4-|         |-CE1          

    \    N82S129    |         A3-|  74S287 |-CE2           

    /               |         A0-|         |-D1            

    |               |         A1-|         |-NC            

    -----------------         A2-|         |-D2            

     | | | | | | | |             -----------               

     A A A A A A A G              | | | | |                

     6 5 4 3 0 1 2 N              N G N D D                

                   D              C N C 4 3                

                                    D                      



Legend:

-------



      "+" = Wires joined here. The two wires are connected with each other.

      "=" = Wires cross each other here. *NOT* connected in any way at all!!!

      "!" or "-" = This is a wire connecting two points in the circuit.



Schematics for connecting pirate PROM in Salora NT "SAHT 2000 Type 4270".

=========================================================================



Note #1: This leg must be cut off in some fashion as close to the body of the

PLCC chip. The lead from the pirate prom or address creator must be connected

to the part of the chip leg that goes down to the circuitboard, and *NOT* to

the end which goes in to the chip's body....



       +-------------------------------------------+

       | +-+-+----------+                          |

       | | | |          |                          |

       | | | |       +--=--------------------------=-------+

       | | | |       |  |                          |       |

       | | | |       |  |                          |       |

       | | | |       |  |                          |       | 

       | | | | | | | |  |                    | | | | |     |

      ----------------- |                   /----------    |

      |               | |         +---------|         |-   |

      \    N82S129    | |         | +-------| 74S287  |-   |

      /    (256*4)    | |         | | +-----| 256*4   |-   |

      |               | |         | | | +---|         |-   |

      ----------------- |         | | | | +-|         |-   |

       | | | | | | | |  |         | | | | | -----------    |

       | | | | | | | +--+         | | | | |  | | | | |     |

       +-+-=-=-=-=-=-+            | | | | |    |   |       |

           | | | | | +------------=-=-=-=-=----+   |       |

           | | | | |              | | | | |        +-------+   <-- See Note #1

           | | | | +--------------=-=-=-=-+ 

           | | | |                | | | |

           | | | +----------------=-=-=-+ 

           | | |                  | | |  

           | | +------------------=-=-+

           | |                    | |

           | +--------------------+ |

           |                        |

           +------------------------+



This is how to connect a normal bipolar Signetics N82S129 256*4 Bit bipolar

prom to one of the new SAHT 2000 Type 4270 decoders. For the older types, just

plug in the bipolar prom in the spot marked for IC15 in the decoder. They use

bit 3 or 4 for the descrmabler address, and you can program one address at

segment 0 and another one at segment 3 of the bit used. To find out which bit

they use, get an ohm meter and check the connection between Pin 11 of IC13 and

pins 9 (Bit 4) and 10 (Bit 3) of IC15. The one that reads close to 0 ohms is

the one in use. If you do not have access to the equipment needed for prog-

-ramming bipolar memory devices, use the schematics below, which describes how

to use a standard 2764 eprom instead of a bipolar memory. The eprom thing has

been tested and works fine in the old SAHT 1006 - 4256 decoders, but I have

not at todays date tested it on the new SAHT 2000 - 4270 modells...





Pinconfig of the 2764 Eprom Chip:

=================================



       V P       A   A                       

       C G N A A 1 O 1 C D D D D D           

       C M C 8 9 1 E 0 E 7 6 5 4 3           

       | | | | | | | | | | | | | |    

      -----------------------------

      |                           |

      |                           |

      \      2764 EPROM CHIP      |

      /                           |

      |                           |

      |                           |

      -----------------------------

       | | | | | | | | | | | | | |

       V A A A A A A A A A D D D G           

       P 1 7 6 5 4 3 2 1 0 0 1 2 N           

       P 2                       D           



How to Connect the 2764 Eprom Chip instead of the bipolar prom chip:

====================================================================



       +------------------------------------+     

       |   +-----------------------------+  |     

       |   |                          +--=--=-+-------------------+   

       |   |                          |  |  | |                   |

   +---+-+ |                          |  |  | |                   |

   |   | | +-+-+-+-+-+-+              |  |  | +-+-+       +---+   |

   |   | | | | | | | | |              |  |  | | | |       |   |   |

   |   | | | | | | | | | | | | | |    |  |  | | | | | | | |   |   |

   |  -----------------------------   |  | -----------------  |   |

   |  |                           |   |  | |               |  |   |

   |  |                           |   |  | \   N82S129     |  |   | 

   |  \      2764 EPROM CHIP      |   |  | /   (256*4)     |  |   | 

   |  /                           |   |  | |               |  |   | 

   |  |                           |   |  | -----------------  |   |

   |  |                           |   |  |  | | | | | | | |   |   | 

   |  -----------------------------   |  |  | | | | | | | |   |   |

   |   | | | | | | | | | | | | | |    +--=--=-+ | | | | | +---=---+

   |   | +-+-+ | | | | | | |     |       |  |   | | | | | |   |   

   +---+ |     | | | | | | |     |       |  |   | | | | | |   |   

         |     | | | | | | |     +-------+--=-=-=-=-=-=-=-+   |  

         |     | | | | | | |     |          |   | | | | |     |   

         |     | | | | | | +-----=----------=---=-=-=-=-=-----+         

         |     | | | | | |       |          |   | | | | |               

         |     | | | +-=-=-------=----------=---=-=-=-=-+             

         |     | | |   | |       |          |   | | | |                 

         |     | | |   +-=-------=----------=---=-=-=-+                 

         |     | | |     |       |          |   | | |                    

         |     | | |     +-------=----------=---=-=-+                   

         |     | | |             |          |   | |                       

         |     | | +-------------=----------=---=-+                        

         |     | |               |          |   |                          

         |     | +---------------=----------=---+                          

         |     |                 |          |                              

         +-----=-----------------+          |                              

               |                            |                              

               +----------------------------+                              



Do remember that the decoder ID's are stored binary in the prom, but they are

stored serially; one bit at each address. Since a 2764 is 8 bits wide, you can

store 8 decoder ID's at segment 1 and another 8 at segment 3. (With the prom

hooked up like this, segment 3 really is segment 2 of the 2764...). You choose

which segment you wanna use with jumper J64 on the old Salora SAHT 1006 - 4256

and jumper Q201 on the new Salora SAHT 2000 - 4270's.... 





Salora Decoder 32 Bit Address Multiplexer - Construction Plans:

===============================================================



The idea behind the 32 Bit address multiplexer for the Salora decoders is

quite easy and straightforward. I use two 74150 1-of-16 multiplexers, whose

outputs are fed into one 74LS157 1-of-2 multiplexer. Then, the highest address

bit selects which of the two 16 bit multiplexors that the bit should be read

from. If this sounds complicated to you, do not worry, it is!!! Just follow

my plans and everything will be just fine. The idea is to set the address by

using four 8 bit hex switches connected to the two 16 bit multiplexers. So

multiplexer #1 will deliver the high 16 bits, and multiplexer #2 the low 16

bits. Just look at the schematic below..... For the construction of the

multiplexer you will require:



          * Two 74150 (1-of-16 multiplexer)

          * One 74LS157 (1-of-2 multiplexer)

          * Four 8 bit hex switches (You know, DIL packagem switches)

          * Four 10kOhm*8 Resistorpacks

          * Two 24 Pin Sockets

          * One 16 Pin Socket

          * One Piece of Experiment Circuitboard

          * One 16 Pin thingy to connect the Circuitboard to the socket on the

            circuitboard inside the Salora decoder.



Now for the construction plans. We'll start out with the pin configurations of

the 74150 and the 74LS157:



                            O     O                        

                    V _     U     U                        

                    C C 4 4 T 3 3 T                        

                    C E A B 4 A B 3                        

                    | | | | | | | |                        

                   -----------------                       

                   |               |                       

                    \   74LS157    |                       

                    /              |                       

                   |               |                       

                   -----------------                       

                    | | | | | | | |                        

                    S 1 1 O 2 2 O G                        

                    E A B U A B U N                        

                    L     T     T D                          

                          1     2                          





                  V                 " " "                  

                  C     1 1 1 1 1 1 1 2 4                  

                  C 8 9 0 1 2 3 4 5 " " "                  

                  | | | | | | | | | | | |                  

                 -------------------------                 

                 |                       |                 

                 |                       |                 

                  \        74150         |                 

                  /                      |                 

                 |                       |                 

                 |                       |                 

                 -------------------------                 

                  | | | | | | | | | | | |                  

                  7 6 5 4 3 2 1 0 _ O " G                  

                                  C U 8 N                  

                                  E T " D                  



This was the pinconfigurations of the two IC's involved in this project. Now

onto the actual construction of it... NOTE: If you are gound to make a version

that fits directly in the socket of the Saloras ID prom holder, make sure you

check for how much space you have in the decoder to put this little gizmo on

before you build it. I have tried it, and it works fine, but I carefully

designed mine to fit in the space I know is available......



 VCC                  GND                                                      

  *                    *                                                       

  |                    |                                                       

  +--------------------=----------------+                                      

  |                    |                |                                      

  |      Bits 8-15     |                |          Bits 16-31                  

  |                    |                |                                      

  |      +-+-+-+-+-+-+-+----------------=--+-------+-+-+-+-+-+-+-+             

  |      | | | | | | | |                |  |       | | | | | | | |             

  |     -----------------               |  |      -----------------            

  |     |# # # # # # # #|               |  |      |# # # # # # # #|            

  |     -----------------               |  |      -----------------            

  |      | | | | | | | |                |  |       | | | | | | | |             

  |   ------------------                |  |     -----------------             

  |   % 10kOhm*8 Pack  % +----------+   |  |     % 10kOhm*8 Pack % +----------+

  |   ------------------ | +------+ |   |  |     ----------------- | +------+ |

  |    | | | | | | | | | | | +--+ | |   |  |     | | | | | | | | | | | +--+ | |

  +----+ | | | | | | | | | | |  | | |   +--=-+---+ | | | | | | | | | | |  | | |

  |    | | | | | | | | | | | |  | | |      | |   | | | | | | | | | | | |  | | |

  |   ------------------------- | | |      | |  ------------------------- | | |

  |   |                       | | | |      | |  |                       | | | |

  |   |                       | | | |      | |  |                       | | | |

  |    \       74150          | | | |      | |   \        74150         | | | |

  |    /    Multiplexer #1    | | | |      | |   /    Multiplexer #2    | | | |

  |   |                       | | | |      | |  |                       | | | |

  |   |                       | | | |      | |  |                       | | | |

  |   ------------------------- | | |      | |  ------------------------- | | |

  |    | | | | | | | | | | | |  | | |      | |   | | | | | | | | | | | |  | | |

  +--+ | | | | | | | | | | | |  | | |      | +-+ | | | | | | | | | | | |  | | |

  |  | | | | | | | | | | | | +--=-=-=------+   | | | | | | | | | | | | |  | | |

  |  ----------------- | | | |  | | |      |   ----------------- | | | |  | | |

  |  % 10kOhm*8 Pack % +-=-=-+  | | |      |   % 10kOhm*8 Pack % +-=-=-+  | | |

  |  -----------------   | |    | | |      |   -----------------   | | |  | | |

  |    | | | | | | | |   | |    | | |      |     | | | | | | | |   | | |  | | |

  |   -----------------  | |    | | |      |    -----------------  | | |  | | |

  |   |# # # # # # # #|  | |    | | |      |    |# # # # # # # #|  | | |  | | |

  |   -----------------  | |    | | |      |    -----------------  | | |  | | |

  |    | | | | | | | |   | |    | | |      |     | | | | | | | |   | | |  | | |

  |    | | | | | | | |   | |    | | |      |     | | | | | | | |   | | |  | | |

  |    +-+-+-+-+-+-+-+-+-=-=----=-=-=------+-----+-+-+-+-+-+-+-+-+-=-=-+  | | |

  |                      | |    | | |                              | |    | | |

  |                      | |    +-=-=------------------------+-----=-=----+ | |

  |                      | |      | |                        |     | |      | |

  +-------------------+  | |      +-=---------------------+--=-----=-=------+ |

  |                   |  | |        |                     |  |     | |        |

  | +--------------+--=--=-+        +------------------+--=--=-----=-=--------+

  | |              |  |  | |                           |  |  |     | |         

  | |              |  |  | +---------------------------=--=--=-----=-+         

  | |              |  |  |                             |  |  |     |           

  | | | | | | | |  |  |  | +---------------------------=--=--=--+--+           

 ----------------- |  |  | |                           |  |  |  |              

 |               | +--=--=-=-------------+----------+  |  |  |  |            

  \   74LS157    | |  |  | |             |  BITS!   |  |  |  |  |              

  /              | |  |  | |             | / | | \  |  |  |  |  |              

 |               | |  +--=-=-------+   +-+ * * * *  |  |  |  |  |              

 ----------------- |     | |       | | | | | | | |  |  |  |  |  |              

  | | | | | | | |  |     | |      ----------------- |  |  |  |  |              

  | | | |       +--+     | |      |        1 2 3 4| |  |  |  |  |               

  | | +-=----------------+ |      \     EPROM     | |  |  |  |  |              

  | |   |                  |      /    SOCKET     | |  |  |  |  |              

  | +---=------------------+      |               | |  |  |  |  |              

  |     |                         ----------------- |  |  |  |  |              

  |     *                          | | | | | | | |  |  |  |  |  |              

  |    BIT                             | | | | | +--+  |  |  |  |              

  +------------------------------------+ | | | |       |  |  |  |              

                                         | | | +-------+  |  |  |              

                                         | | |            |  |  |              

                                         | | +------------+  |  |              

                                         | |                 |  |              

                                         | +-----------------+  |              

                                         |                      |              

                                         +----------------------+              

                                                                               



Connect a jumper-wire between the BIT output and *ONE* of the BIT inputs, dep-

ending on which of the four bits that is used in you descrambler, check by

looking at IC13 and see where the circuitboard trace from PIN 11 goes. Should

be pin 9 or 10 (Bit 4 or Bit 3) of the PROM. Solder a socket in the place of

the prom, build the address creator according to the ASCII picture above, and

set the switches to a working decoder ID number and there you have it working

fine!!! Good luck to all ye cable pirates!!!!!!

                                                                               

Zaphod Beeblebrox of ICS and Control Team Scandinavia.

This has been a Beeblebrox Industries Unlimited Production '93.



P.S: This is only for information purposes, and if *YOU* screw with a cable

descrambler which you have rented from the cable company, it's entirely your

own problem, I accept no reponsibility for your actions. Also, this is only

for the advanced hardware wizards, I will not answer any questions about this,

if you don't know what this is about, you don't need to know!!!!

I have not yet written the Salora address calculator for the ST, so you'll

have to make do with the Pc version written by Electronic Power & Lord Canis.

It can be run from Pc Ditto for those of you who has got that program.

I will not release any beta versions of the ST version until I have tested

it a bit more.... So go out and hack the shit out of them decoders d00dez!!

D.S