Note: Hacker Central has no connection with the author of this file. We present it here merely for informational purposes because it helps describe how the cable system works.


*****************************************
* HOW TO GET FREE CABLE! *
* BY: THE INFILTRATOR *
* 4/24/98 *
*****************************************






How to get PHREE CABLE!

Ok, so you just moved in and you want free cable tv. After all, who wants to pay for it when theres already commercials? I feel like I'm already paying for it by watching. Getting the bill every month is just insulting. Anyway, you want it.So here goes.

First off, dont go run and call the cable company right away. Your cable line might be active already! Find that thick black co-axial (solid copper wire with a wire mesh shield wrapped around it) wire coming in near a window or corner. Attach it to your TV and tune around to see if you can receive any channels.Make sure to set your TV to "CABLE". If you have a cable ready TV and you get a whole bunch of channels, you're in luck! You don't even have to subscribe (Keep in mind that they may cut you off after a few months- they leave places wired ON PURPOSE to entice tennants into subscribing, but then they yank it out after a few months to get you to pay).

If this works for you, you will probably get the "basic package". This is usually the local network affilliates (ABC,NBC,CBS,FOX channels from the nearest city) plus any local channels (The WB, superstations, etc..) Plus whatever your cable company decides should be "basic". Some of them think that MTV should be basic, (some of them have the nerve to charge extra!) The same for VH-1, Comedy Central, etc. But you'll probably get CNN, C-SPAN, History Channel, Animal Planet, Cooking Chanel, and all that boring stuff.

If this doesn't work, just order basic cable.

You are using a TV or a VCR, so some of the channels may appear wavy, the audio portion may be missing, and/or the picture will be "inverted". (Picture inversion is when all of the colors are reversed. If you've ever seen the negative for a color picture, you will know what that looks like.) These are the scrambled channels. This is where a descrambler will come into play. More on this later.

If you ALREADY have some sort of cable service AND have a cable box (converter) from the cable company, most likely you wont actually see the scrambled channels. Instead you will get an advertisement channel, a local Cable guide channel, the weather channel, or a message saying "You do not subscribe to this channel" or "this channel not authorized" or something similar. that is because you have a box that is programmed to only get the channels that you have paid for. If HBO is on channel 63, and you tune in 63 and get a 24-hour a day movie preview channel ("coming up this week on pay per view, Naked Gun 2 1/2..."), thats why. Your box has been told (programmed) to go to this channel instead of showing you the scrambled signal. Remember, your legitimate cable box can be remotely controlled by the cable company to show you one channel on the channel display and actually be receiving and displaying on the TV a completely different channel. This will be discussed again later.

The good thing about having a converter from the cable company is that you already HAVE a descrambler built in to that box.. You just need to get it to work for you. This is where test chips and external activators come in handy. More on this later.
Also, if you want to get your own descrambling equipment, you already know what kind of box is in use (just flip it over and check the manufacturer and model number) and therefore what kind of descrambler you need if you want to buy a seperate descrambler.

Anyway, if you want to get a descrambler, you will want to drop down to this package :"basic service" because it is the lowest priced package that still allows cable channels to enter your house.

Please note that some cable companies have something called "Broadcast basic". (It is different from "basic cable" or "basic service".) Stay away from this!!! All it is is the local channels from your area. You could probably get these channels with an external antenna. But when you drop down to "broadcast basic" they switch your cable line and you can't even get the scrambled channels! So if you get a descrambler, there will be no signal there for it to descramble! DONT GET 'BASIC BROADCAST'!

I ordered broadcast basic because it was like $7.00 a month, but then I had to wait 2 weeks to go back to my basic cable. All I got on broadcast basic was chanel 2-13!

Alright, at this point you have the lowest cost package that stil allows scrambled channels in on your cable line.

Now you need a descrambler.

Step one is to find out what kind of scrambling is used in your area. Surprisingly enough, this is a tough task for many people. A lot of cable companies do not issue cable boxes to those people who get ONLY basic cable, so there is no way to know what "brand" of scrambling is used. This is essential to knowing what kind of device you need to descramble the pictures. The cable company figures that if you have a cable ready TV or VCR, you don't need a box- the channels you are getting are not scrambled. Seems to me that they are losing money on this though, because you can't order pay per view without a box. Oh well, THEIR loss. (You will be getting pay per view soon enough anyway :-)

I don't see a problem with this method of finding out what equipment is in use in your area: Asking for a box when you first sign up for cable, so you can see what model it is. Then, just send it back after a month or two and tell them you got a cable ready TV or VCR and don't need the converter any longer (you are using the premise of saving money; the cable company charges you a small fee every month to rent the converter).

As for other ways of figuring out what box is used in your area, you could try checking with a neighboor, asking people at work, etc... Don't bother calling the cable company and asking because there's no reason that anyone would want to know unless they were buying a descrambler. Well, in fact, it IS legal call the cable company and ask them what kind of scrambling is used because there ARE third party boxes that you could buy to avoid paying rental fees for the converter that the cable company rents to you, but I wouldn't mess with this option-it will just arouse suspicion.
The point is: you NEED to know what box is used. Find out somehow. And make sure the person you find out from is on the same system as you are. Also make sure that they got the box sometime within the past few years. For example, a system I was on orignally started on Scientific Atlanta equipment. Then they went to a multimode baseband Jerrold/GI system with random video inversion and audio privacy. If I had asked someone who lived in the area for a long time and got their box 7 years ago, they would tell me to get a Scientific Atlanta 8580 box. But the new subscribers are getting General Instruments CFT2200 boxes!
There is a big difference between the two boxes! The CFT 2200 are backwards compatible with old systems like the Scientific Atlanta 8580. What they do is run the system with the old Scientific Atlanta scrambling while handing out the new GI 2200 boxes. When they feel that enough people have swapped out their old boxes (due to box breakdowns, people who want to get the "new" channels, people who move out and give back their box,etc...) they permanently swap over to the new system. All the people who got illegal descrambler systems that are strictly compatible with the SA 8580 are now screwed.

The reason I went through that whole story is to illustrate the need to get the best and most universally compatible box that you can afford.

Something that should be mentioned here is that if you are interested in a seperate descrambler ("standalone descrambler"), you NEED A CABLE CONVERTER TO USE WITH THE DESCRAMBLER!
You can't get something that just "goes on the line" beween the cable line and your cable-ready TV or VCR. You need SOMETHING to tune in the channel, and a VCR just doesnt cut it. You have to have a converter to pick the channel you want. Then, you can either have an external descrambler (this type of set up is called a "two-piece"), or an internal descrambler ("one-piece").
THIS IS A VERY COMMON QUESTION! "CAN I JUST GET SOMETHING THAT GOES ON THE LINE BEFORE MY TV?" THE ANSWER IS NO!

There is only one exception to the above rule-- universal descrambler plans. These take an RCA input for video, and they are designed to accept the video output from a VCR. There is another situation where you could put something on your line to 'get' channels without a converter-- FILTERS. They are not really an exception to the above rule, as filters do not technically descramble. Filters are a general pain in the ass. I'll talk about them here for a bit:

There are two types of filter systems for cable television. They are called "positive" and "negative" filters. (I forget which is which). One of the systems works this way: It is a regular cable system, but along with every premium channel, on the same frequency, is sent some noise, or garbage signal. This way, when you try to receive a channel, your TV, VCR, or cable converter gets a bunch of "noisy" signal along with the TV signal, and you can't see the channel. I have heard that this looks like a faint video signal with possibly a 'beeping' noise in the background. Its not the easiest type of signal security to recognize, but if you KNOW that, say, in your area, HBO is on channel 63, and when you go to 63, theres not much of a picture (as opposed to a scrambled picture that is STRONG, just not viewable due to being wavy, inverted, etc...) as if you were trying to get a TV signal from far away, its a good chance that there is a noise signal on top of the channel. In this case, you can add a FILTER in the line to remove JUST the noise from that channel. Then, you could view the channel in the clear on your TV (note that the whole topic of filters is not really SCRAMBLING or DESCRAMBLING, but its more a question of wether the signal is there, or clean, or not...So you COULD have a channel that needs a filter, and then when the noise is removed, it is ALSO SCRAMBLED in some other way, although I'm not sure if this is generally done...)

So, in a legitmate case of this kind of filter use, the customer would call up and order a channel. The cable guy would come by and install a filter somewhere on your cable line. (Possibly up on the pole). The obvious drawbacks are that when a customer wants to get a channel, the company has to pay a guy to go all the way out to the residence. Then, when the customer cancels, the service call has to be made all over again. Also, this type of security obviously does not work for Pay Per View. (It would be rediculous for them to come out and install a filter for a one night event or a 2-hour movie). For this reason, if you have a filter system, either they use an additional type of scrambling for the pay per views, or do not support any pay per view channels.
(With a NON-filtered addressable system, the customer's boxes can be remotely programmed by the cable company. No service people have to come to your house. This both saves the company a lot of money (no service call) and MAKES the company a lot of money (pay per view is possible), and this is probably why filter systems are not very common.)

By the way, when you see the "$10 radio shack plans" or any similar crappy text files for sale on the net, it is usually a home-made tuenable version of this filter that they are selling. The disadvantage to this is that, almost NO systems use this type of signal security anymore, and, if more than one channel is filtered, you have to get up and re-tune the filter, or build one for each channel and chain them together. If you live in a filter area, just go buy professional filters and chain them together, its a lot easier to do.

The OTHER type of filter system is a little more insidious. In this case, if you are not paying for a channel, there is a filter installed on your cable line (in a locked box or up on the pole) that REMOVES the signal from your channel lineup. There is NO signal left on the line, so there is NOTHING for you to attempt to descramble. Even adding an amplifer would not bring the channel back, it is almost completely removed by the filter. I guess that a channel protected with this type of filter would just have nothing on it, or a very very faint signal.

(See the difference? One system adds noise to a channel and you put a filter on to REMOVE the NOISE and get the channel clearly. The other system sends out channels normally and they put a filter on for every channel you DON'T pay for, and it REMOVES the CHANNEL from the line.)

This system has similar problems to the other type of filter system (the company has to come to your house to add a channel) but it is VERY effective (from the cable company's point of view). Most people who want to steal cable don't mind having an illegal descrambler in the house, BUT will not feel too comfortable climbing a telephone pole or breaking into a locked cable distribution box to rip out their filters. Therefore, cable theft is low on this type of filter system. Another advantage is that, if you pay for a channel and the filter is removed, the channel may come in IN THE CLEAR (but not always, they could have added video scrambling to it) and so your VCR can tape the channel directly, as if it were a regular channel (have you ever tried to tape a scrambled show and watch another scrambled show at the same time? You would need two descramblers and some complicated wiring. Imagine if the channels come in in the clear- taping would be a breeze!)
    Also, removing the filter leaves pretty obvious evidence that you tampered with your service. You could yank the filter, drill out the inside, and replace the "guts" with a straight piece of coaxial cable I guess...

So now you see why I hate filters. It is not uncommon to have a traditional addresable SCRAMBLED system with one or two of the most popular channels FILTERED (with one of the two methods described above). I guess the thinking of the cable company is that they can still remotely program your box to get things such as Pay Per View and some of the premium channels, but with the most popular premium channel (usually HBO and maybe one other channel) filtered out, people won't buy descramblers when they hear "Yeah, this box gets all the channels except for HBO (the most popular channel that people want when they get a box)".

OK, now to the technical stuff. You've gotten the model number of a box that is in use in your area, and you've made sure that it is a recent box. If Pay Per View is available in your area, you have made sure that the person that you checked the model number of can get pay per view (including the adult (Playboy, Spice, ATV) channels if they are available on your system). Now you want to know what to do to get "everything". The porno channels are often the most heavily protected. I don't think its because porno is the most sought after programming on cable, but rather its often the newest additions to the lineup and therefore enjoys the benfits of the most recent scrambling technology.

First, I'll go over some things you need to know about scrambling.

Cable tv signals come from a cental location and are amplified and distributed from that location. Sometimes, a microwave link might be used to get the signal from one populated area to another. Anyway, the video and audio signals are put into the coaxial cable, but they also add a data signal. It usually appears in or near the FM broadcast band. In fact, you can sometimes hear the signal on an FM radio if you touch the center conductor of the cable to the antenna of a radio. You will hear a strong buzzing sound on a certian frequency. This is the data. Think of it like a modem signal, but it comes from one computer and goes out to a lot of little computers. This data contiains LOTS of info. For example, the Infamous BULLET signal is in this data.
The data in this signal can turn legitimate subscriber's boxes on and off, tell them to descramble a certian channel and not another, kill the box, and many other functions. Each box has a serial number. The box listens to the data until it sees its serial number coing down the line. Then it does whatever the 'headend' says (this is the name for the equipment that the cable TV signals and data comes out of at the Central Office).

For example, let's say that you are a subscriber and your cable box has an internal serial number of 42 (ok, this has been simplified a bit :) You call up to order Cinemax (ch 34 on your system), and the cable company operator looks up your account. Then the headend is told to authorize your box. It sends a command that in effect says "Attention Box 42!! Use your internal descrambler and start descrambling Channel 34!". Now you get Cinemax! Pretty simple, isn't it?

Now, I will explain how the infamous "bullet" works- there's nothing magical, and it ABSOLUTELY does not involve sending a voltage pulse or any other wierd electrical activity down the line. The cable company would NEVER do anything like that, it wouldnt work for one thing, their boxes are just as succeptible to voltage spikes as the illegal boxes. Plus, they would get sued by the people who have no cable box and had a voltage spike blow out their cable-ready TV! The cable company is more than happy to have you beleive that the bullet is a voltage spike or some other sort of wierd surge, because that makes you afraid to buy a cable box! In reality, the bullet works something like this: Let's say that there is a very small cable system in the city of Smalltown, USA. There are 10 people on the system. 5 of these people have Basic cable. Their cable boxes have serial numbers 1,2,3,4 and 5. Three other people in Smallville have basic cable plus HBO on channel 49. These two people have converters from the cable company wiyth serial numbers 6 and 7. The last two people have illegal cable converters. They subscribed to basic cable and added a cable converter that has been modified with a test chip. One has serial number 88. The other has serial number 0000 (This guy used a test chip that set the serial number back to 0, or maybe the factory default).

One day, some consulting company calls up Smallville Cable and offers to knock out their illegal viewers for a small fee of $10,000. Smallville agrees and lets the company come to their offices to set up the "bullet". What this company does is set up some special programming that goes out on the "data" signal in the cable line that we talked about earlier.
The porgramming looks something like this: (remember, the data comes from the central headend computer and goes out to every box). Imagine the headend speaks in English commands to the converters. It might say something like this: "Attention all boxes! If your serial number is NOT 1,2,3,4,or 5, SHUT DOWN NOW!" Like magic, the two customers with illegal boxes no longer have a picture on the box. What happened? Well, their boxes were listening to the cable data and heard the command, Their serial number was not one of those listed, so they shut down. If the owners were stupid enough to call for service right at that point, the cable company knew that they were using an illegal box and threatened to sue... yuck!

Here's another scenario. The cable company ordered some test chips of their own and found out that the chips all put the same new serial number into the converters that they were installed in. Now, all they have to do is issue a command using that serial number telling all of those boxes to shut down, or worse yet... maybe it issues the command "Every one with the (illegal test chip) serial number 5656 switch to channel 92 but keep the current channel number that the customer is watching on the display." Then on channel 92 (a channel inaccessible to regular, legal customers) theres an advertisement saying "call 1-800-234-5678 right now for a free t-shirt (or some similar come-on, something to make people call) Then when you call, the cable company knows that you have an illegal cable box (remember, none of the legal customers saw the message). They all get nailed!

There are several variations on this theme, sometimes cable companies find other weaknesses in test chips that they can exploit- they may not always choose to or be able to use it to trick people into turning themselves in, but somethines it can just be used to make the boxes not work any longer. Now that you've read all of this you may be frightened about adding a test chip to a box. Don't worry! It's not hopeless. Yes, there are dangers to taking a converter that the cable company gave you and putting a chip in it. But, the test chip makers have changed their methods of making chips, and they are mostly free of the "bullet" problem. Instead of giving your box a new number, they often cut off the external data coming in to the box and replace it with their own (much like the external activators mentioned later). In that way, the cable company cannot manipulate your box without you knowing (probably :) Now, they can still have every LEGAL box switch over to another channel (because their boxes follow the computer commands correctly) while your box stays on its current channel (because it's deaf to the incoming data) and you get the "advertisement". This is dangerous, though, because if anyone on the system is NOT using any box (cable ready TV or VCR) they will see that message, too. This is not an issue, though, in places like New York City, where every customer gets a converter from the cable company- this is due to the fact that even most of the basic cable lineup is scrambled. This ensures that everyone on the system is using their converter. So, if you called up for basic service and were told that you need a 'box', even for basic service, beware, you are probably on a large, somewhat advanced system.

Note also that test chips that cut off incoming data probably also prevents extra data coming into the box like time, channel mapping, etc. The Scientific Atlanta 8590 reads the time for its built-in clock off the data line. A lot of SA boxes also read the "Channel map" from the cable data also (the channel map tells the box which channels go where. If you watch cable on a cable ready TV, HBO might come in on channel 66, but everyone with a converter gets HBO on channel 58. This is a pain in the ass because your TV Guide/Channel Guide shows HBO as channel 58. So you have to remember that its 8 channels above where it's listed. That's not a big deal, but if all 70 channels were mixed up like that, it could get annoying.
Some of the CFT series boxes from General Instruments and the newest SA boxes (SA8600) read the channel names (HBO, ABC, FOX, NBC, TNN, etc...) off the cable line. That way, when you flip to a channel, it says the name in to corner of the screen. Very handy.
If you put in a testchip that requires the data line to be cut, these functions will not work on your cable box.
  
For the above scenario, the cable company can send out a channel map to one particular box at a time, refreshing the data OR they could just send the data out to everyone at certian intervals (once a night, once a month...?) or, whenever it changes (a new channel was added). Sending the data only to specific boxes is probably more secure (illegal boxes can't just "grab" the data like everyone else does) BUT new test chips can sit and wait until some other (legitimate) customer gets his update and "grab" that one! Sneaky!
Other testchips can be ordered with a particular channel map already installed. These are popular for large cities where a test chip manufacturer can make a thousand test chips with a particular cities' channel map in them and be sure to sell a large quantity.


Here's a problem with cutting off the data from a box (either by cutting the data line inside the box, adding a data filter outside, or simply removing the cable-in line). Some boxes are set up to "die" if they don't hear headend data for a certian amount of time (7 days, 30 days are common "timeout" intervals) if you cut the data line inside a box, it will "die" when the timer expires. The definition of "die" varies- it could "barker" (this is what its called when it refuses to show any channel except what it believes is the "barker channel" This is usually a channel that advertises upcoming pay per view movies, or maybe its the cable guide for the system that that particular box is from.) Or, it could completely die, showing an error code on the display and not showing any channels on the TV.
Fortunatley, as mentioned above, most test chips nowadays "emulate" headend data and so the box is satisfied as the test chip "talks" to it all day long....

Here's another problem with test chips that cut off the data (and external activators that block the incoming data, mentioned below). The Jerrold baseband system (boxes that are DPBB-7 and above. Stuff like the DPBB-7 and DPBB-5 are baseband. Any CFT or ICFT boxes are baseband. There is a box called DPBB-212 but I beleive that it was a non-multimode system) has 256 "modes" of scrambling. A few years ago, most systems were "Single Mode" where every customer's converter is 'set' on the same mode, lets say mode #100. The signal being sent out is scrambled with mode #100, and every converter descrambled mode #100 correctly, and everyone is happy. Someone comes along and puts a testchip in a box from the cable company. The installation procedure involves cutting off the data from the box (by cutting a jumper or a trace on the PC board) for reasons mentioned above. I guess mode #100 is pretty standard, or the box just remembers what the mode it was in just before getting cut off. Anyway, the test chip repeatedly "says" this to the box: "Descramble channel 1, 2, 3, 4, 5, 6, (etc...)" This does two things- it forces the box to descramble every channel on the system, and it also ensures that the box hears a constant stream of data so that it doesnt die (even though it's fake data, from the testchip, not the headend, but the box doesn't know the diference.) All this is fine unil the system goes "Multimode"!! Now, the real headend starts changing the modes of scrambling. Lets say it starts on mode #100. Everything still works. But then, the headend says "OK, all boxes go to mode #087!" Now, your testchip box has had the data line cut, so your box doesn't "hear" this command. It still stupidly tries to descramble in mode #100. Now, you can't see a clear picture!
So, they started making testchips with an external button that you could put on the back of the converter. If your system didn't use mode #100, you could press the button to make the test chip tell the box a new mode.. every press of the button equals a new mode. You would have to press the button 255 times to go through all of the different modes. That was OK for a while, but then they started Automatic Multimode! The mode could change as quickly as once every 5 minutes!! Even if you wanted to get up and press a button every 5 minutes, you wouldn't be able to press the button fast enough to go through the modes! By the time you got the box working, the system would have moved on to the next mode. The regular (legal) customers don't notice anything wierd going on, the modes switch very quickly inbetween frames of video (or maybe during a black screen).
The latest weapon in this "war" are test chips that don't cut the data line, but transmit their signal over it every few seconds to inject the "Descramble channel 1,2,3,4,5,6 (etc)" signal. This way, you will get the mode change signal from the headend.most of the time (maybe once in a while you will miss a mode change and it will look scrambled for a little bit.)

 But, with the data line cut you also dont get some of the harmful signals on the data line. For example, the bullet signals, or some type of signal that says "Ok, every box turn off EXCEPT number 1001, 1002, 1007, 1009, 1021, ... (where of course, those are the serial numbers of customers who are legal authorized subscribers who have paid their bills!).

Ok, thats a pretty thorough coverage of test chips. We will now talk about external activators.

External activators are great because they work along with the converter that your cable company gave you. The "original equipment" converters like they give you often have the best picture quality. Also, to use an external activator, you don't have to open your converter to modify anything.

We have already shown how the cable company has a "headend" computer that sends data out to the customer's boxes. The data can disable a box completely, make it descramble a certian channel, make it show only one channel, make it switch scrambling modes, and much more.

An external activator takes advantage of the fact that these boxes (called "addressable boxes, because each one can be sent a message indivdually, like "addressing" a letter to someone) obey the data that it hears coming in on the data line. External activators generate a fake headend signal to fool your converter! Remember above where we mentioned that one advantage of addressable boxes are that the cable company doesn't have to send a technician out to your house if you decide that you want a premium channel (like they would have to in a filtered system, for example)? They would just send a signal out like this: "Box number 0192, you are now authorized to descramble channel 49. Begin descrambling ch 49 now"

An external activator for Scientific Atlanta boxes works just like this. You flip your converter over and read the serial number off of the bottom (there's usually a barcode sticker on the bottom. This allows the cable company to keep track of their cable converter inventory easily). Let's say its 4153. You then enter your converter's serial number into the external activator. Then the activator "says" this to your converter: "Converter 4153, descramble channel 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, (etc.up to

Part II, click here

Last modified on Thursday, July 22, 1999