

up to channel 100 or whatever the maximum capacity is)" Now your converter descrambles every available channel. This may be fine for some systems.
But, a possible problem is that the pesky headend often issues this command: "Box 0192, you are authorized to descramble channel 49, box 8765, you are authorized to descramble channel 36, box 9782, you are authorized to descramble channel 58 and 76. All other serial numbers: YOU ARE NOT AUTHORIZED TO DESCRAMBLE ANY CHANNELS, TURN OFF ALL DESCRAMBLING!. " Or something similar. Your box, being "any other box" then shuts down the descrambler and you are left with basic cable. To combat this, the external activators are usually sold with a data filter. This is NOT the same type of filter mentioned above. These filters are for blocking out the data signal coming down the cable line. They have nothing to do with filtering out the channel or filtering out noise on top of the channel. These data filters remove a very narrow piece of the total cable bandwidth. The cable data is often in or near the FM broadcast band (88-108 Mhz). This is why FM filters are often used (Radio Shack sells FM filters for customers who live near large FM radio stations and experience interference from the FM signal leaking into the cable tv.) to block data. So, you put the filter on and the data is blocked from entering your box.
As mentioned above, some systems do not require the filter, or, they issue the "all other boxes shut off" command so infrequently that you can just reattach the external activator and re-"zap" the converter.
On Jerrold systems, theres an added bonus. The converters are succeptible to a "change serial number" command. This feature was exploited by a certian kind of external activator that "says" this to a converter: "Converter, change your serial number to this: 111222333" then it simply issues this command : "Converter 111222333 you are now authorized to receive channel 1, 2, 3, 4, 5, 6, 7, 8, (etc)" Very nice huh? The buyers of this type of external activators don't even have to try to obtain their converter's serial number and enter it into the activator.
There are some problems with this. I'm not exactly sure, but it seems that if your external activator changes your serial number, it remains that way permanently until and unless it's re-programmed remotely by the cable company. if you buy and use one of these activators, I suppose that, just before you have to return the box (because you are moving out or because the cable company is upgrading and asks you to swap it for a new one). call up the company and say that you were away for a month (If you have been using an external activator, you will have been getting all the channels for free, but nonetheless, make sure that nobody has called in a Pay Per View movie order or any other activity (service calls, bill disputes) in a month if you want your story to hold) and you unplugged the box (accidently?) while you were out, now it "doesn't work". Just say that it doesn't change channels or something, be vague.... they probably won't ask. If they do press you on this, you could say that the channel numbers change but all you get is the movie preview channel or the cable guide. They will probably send a "refresh packet" to your box that reprograms it with its proper serial number and channel map (how does the box know that that packet is intended for it when its serial number has been changed? I believe that there is a second number in the box, which does not change, that the cable company can address it by (sort of like in a cellular phone. The MIN (telephone number) can be changed but the ESN (the phone's unique serial number) cannot.) Remember, this only needs to be dealt with one time, whereas you could be using an activator to get free cable for years and years....
At any rate, Jerrold (General Instrument) customers on non-automatic multimode systems can just use an external activator with a filter and flip the activator on. The box will be activated until the timeout timer shuts the box down. The owner simply walks over to the activator and turns it on again for a few seconds. They are ready to go for another month (or however long the internal timeout timer is set for. Some external activators are advanced enough to actually send your coverter commands that can CHANGE the timer length to the maximum (30 days) if it was set shorter by the cable company (7 days, for example))
BUT!
What about automatic multimode? If you get a mode-switch signal coming down the system, the filter will block it out and your converter won't know what mode to descramble! This is not a problem in non-multimode systems, but where the multimode runs automatically, they use newer external activators. These have no filter, and only send their signal every few seconds, just like the previously mentioned test chip that sends its signal over the incoming data. That way, the mode switching signals come through, but the exteral activator still can send its own commands to the converter.
See below to find out what type of descrambler you need based on what kind of equipment is in use in your area.
WHAT YOU NEED:
Try to match the model number that you've got with something below, sorted by manufacturer.
=================================================================================
Jerrold/ General Instrument (they are mostly the same thing):
This is the most popular system in the world, and of course, the most complicated as far as model numbers and options.
If you have a Jerrold 400 or 450, I beleive that this is a very simple sync suppressed system. Thi is the most simple scrambling. There is a version that skips between 2 different levels of sync suppression, and this is called Bi-mode. There is another system that supports 3 levels of suppression, and this is called tri-mode. This was an improvement to help thwart cable theft.
The 400-DIC, DRZ, 450-DRZ and DIC type boxes I think are one-level sync suppression. Also any SB- model number.
The tri-mode boxes are Jerrold SBD-#A, SBD-#DIC, Jerrold Starcom V(DP5/DPV models) like DPV7 , etc.
Keep in mind that any system can be descrambled by getting the box used on that system and adding a test chip.
Also, you could get a converter from the cable company and add an external activator. (In this case, the FTG, RFT, RFT-DAM, T2, etc... all would work I think. I don't know at what point in the Jerrold/GI line of boxes they started being addressable, maybe the older boxes wouldn;t even respond to the data from an external activator. If so, just get a stand-alone descrambler for Jerrold non-baseband like the See-More)
Aside from that, there are a lot of "pans" that descramble both types of sync-suppression Jerrold descrambling.
A "pan" is an external descrambler that goes along with a plain converter.
I don't beleive that you could get the one-level sync suppresion boxes if you want to. There's no need to manufacture them, as the tri-mode boxes handle 1-mode.
Some examples of Jerrold tri mode pans are:
Original equipment Jerrold SB series descramblers.
The "See-more" box, which also handles Scientific Atlanta, see below.
===================================================================================
The newer Jerrold/General instrument boxes are all "baseband"... This is an out-band type of descrambling system. If your box is a model DPBB, or CFT, you are in a baseband system. There are 256 different scrambling/descrambling modes in this system.
As always, you could add a test chip to a box from the cable company to force it to descramble, but some chips only descramble one mode at a time. There is a pushbutton switch to select which one of the modes you want the box to be in. You install the chip and press the button until the channel comes in. Remember how many times you pressed it, just in case you have to do it again. Now here is the problem. Because of people using chipped boxes, FTGs, etc...they came up with an improvement. (This was meentioned above) What the "headend" (the computer at the central office that talks to each of the converter boxes) does, is rapidly switch between the 256 different modes of scrambling. So, if you have a chipped box, yours is stuck on the one mode that you set it on, while all of the legitimate customers' boxes are all switching modes along with the headend and descrambling everything correctly.
Also, if you use an FTG, or any other non-multimode external activator, you usually use a data filter. This is not the same type of filter (positive/negative) as mentioned above. This data filter blocks the data coming down the line to address the legitimate boxes.
So, you can get a "multi-mode" external activator, which does NOT have a filter. It just tries to send the descramble codes every few seconds and hope that the multi-mode signal can get through. These type of external activators are the: RFT-DAM, T2, and others.
There is a 'Boss' descrambler box that is compatible with this baseband system. Multi-mode is not an issue, the Boss will descramble it regardles of which mode it is in and it doesnt need to hear the 'mode switch' command. There are some problems with the Boss or other stand-alone descramblers that work on the GI/Jerrold baseband system: Inversion and Audio privacy.
Advanced GI/jerrold baseband systems use two elements called "audio privacy" and "random inversion"
Audio privacy: US specifications for television transmission (NTSC) specify the frequencies that each TV channel occupies, and where within that rage the video, color, and audio are in. Every TV and 'plain' converter produced for US use is set up to receive these channels correctly. What Jerrold did with Audio privacy was to MOVE the audio information. Now, in addition to having the video scrambled, your tv or cable box can't even 'find' the audio signal. Of course, the legitimate converter is pre-programmed to know where the audio signal is. Right now, there are no standlone types of descramblers that can deal with this. (I beleive that there was one called the Maestro but it is no longer available). On the other hand, I beleive that a test chipped box from your cable system or your legitimate box equipped with an external activator will correctly find the audio privacy channels. I think they are pre-programmed by your cable company. I am unsure if a 'legitimate' box from another system or a dealer would be able to 'find' the audio privacy. Maybe someone will release a test chip that allows you to change the audio privacy settings.
Other ways around audio privacy:
There are usually just one or two channels with audio privacy (remember, if you are on a hybrid system or one switching over to the Jerrold CFT system, only the pure GI baseband channels will have the capability to have audio privacy. Sometimes they actually set up double channels, say, HBO for the GI system with audio privacy and GI baseband scrambling, and HBO on another channel, with SA scrambling, for those people who haven't yet switched out their SA boxes ). And often, the audio will still be audible just very low. Otherwise, you could try to use a second TV with an analog tuner to try to pull in the audio. If you are trying to watch a sports event, check and see if its is being simulcast on radio.
Random inversion:
Some channels are scrambled and also inverted. this was briefly discussed earlier. Inversion is a process where each color in the TV picure is switched with it's complementary color (remember Roy G. Biv?) take a look at the negatives that come from your next roll of color film. This is exactly what an inverted picture looks like. The older Boss descramblers had no provision for this. The newer ones had a switch on the unit to turn the internal inverter on and off. This would be fine if every channel on a system were either inverted or not inverted. But if only one channel was inverted, you would have to get up and flip the switch if you wanted to watch that channel. Also, the newer GI baseband multi-mode systems have 'auto inversion' where the screen is inverted every few minutes.. kind of like an extra mode in a multimode system. This would make it really annoying to have to get up every few minutes and flip a switch to watch a clear picture. So, the newest boss descramblers have a button on the remote to turn the inverter on and off.
=========================================================================
I am not as familiar with other systems as I am with Jerrold/GI boxes. I do know a little about the Scientific Atlanta systems: they tend to be mostly simple 'sync suppression' type systems (like the GI tri-mode systems mentioned above, but Jerrold/GI boxes will not work on SA systems and vice versa except for the See-More, which has a switch to go between SA and GI)
All of the SA systems I have seen have either been plain sync-suppressed systems, or a sync-suppressed system with some GI baseband channels, where they were slowly phasing into a GI system using GI CFT2200 boxes.
I think that there is an SA baseband system, but it is not all that popular.
So, for most Scientific Atlanta systems, you could probably get away with either:
A 2-piece system, using a regular converter and a See-More descrambler
An SA box with a test chip installed
The box that your cable company provided, and an SA external activator. (this will cover you even if your system is SA Baseband)
=============================================================================
Other systems, like Pioneer, Tocom (made by GI!), Oak, Zenith, and other stuff are pretty straight-forward. Often they only need a simple 2-piece descrambler or an external activator.
The Zenith ST series boxes have a replacement descrambler avialble. Really, the only large system for which there are no descrambler options is the Zenith PZ or PM series converters.
==============================================================================
There are new descramber boxes called the "Boss" series. In reality, the Boss is the descrambler board that is installed into a regular cable converter, so you could see Boss descramblers showing up as Pioneer, Panasonic, or other converters. They are often touted as "universal", but in reality, you do need to get a specific 'boss model' for your system.
There is only one universal decoder, and I have not seen anyone selling it. It is usually offered as plans. I have built one and it does work, on every system I've tested! It's just called the "universal descrambler"
Also, there are a large number of legitimate boxes that can be fooled into descrambling just by modifying the cable box. The older boxes are expecially susceptible to this. The bad part is that these modifications are kept very secret, usually figured out by a local technician and offered as a 'service' for a fee. As a result, there are no text files avaialble anywhere to show you how to do them. If you have a TV or appliance repair shop nearby, check with them, often their tech will offer to 'do' your box for a fee, or they will sell you a new box or descrambler.
OTHER CONCERNS ABOUT DESCRAMBLING
Ok, the box that the cable company gives you belongs to them and they will want it back after you cancel service, move away, or get disconnected for non-payment.
Of course, you do not want to return the box and have them find your modification, test chip, etc.
I don't know what the cable comapny does with returned boxes. it's possible that they are just thrown on a pile and left there. If they run out of 'new' boxes to give to customers, maybe they will go to that pile, I don't know.
If they are doing an upgrade, where they collect all of the 'old' boxes and hand out new ones, they probably wont bother with looking at the old one that you hand in, but you never know...
On the other hand, maybe they hook them up and see if they are getting the channels that you were paying for. Maybe they even open the box and look for signs of tampering.... who knows?
I would think that it's probably safe to assume that the boxes are tested when you hand them in or at some later date. So, if you have a test chip installed, just remove it, and reconnect the data line if you cut it. Then hope that they never look inside and see evidence of your handiwork.
test chips:
Some of them install without soldering and so can be removed very simply. Just remove it and see if your box returns to normal service. If not, call up the cable company and say that you unplugged the cable box by accident and now it's not working right. They will send your box a "refresh packet" that re-programs it so that it 'knows' what channels it's supposed to be getting (the ones you are actualy paying for). Then, just hand the box back in.
External Activators:
As above, remove the activator and wait to see if your box returns to 'normal'. You might have to wait over 30 days. Some boxes on some systems may never return to normal. If your box is still getting channels that you arent paying for, call up the cable company and tell them that you unplugged the box by accident. They will send a 'refresh' packet, and your box should return to normal. When you hand it back in, everything will be normal.
Cable companies may be getting wise to this, so try not to do it more times than you need (only one time in the many years that you are on the system should be fine).
Modifications:
If you have added jumper wiers or other modifications to get extra channels, simply remove them, and everything should return to normal.
2-Piece units, standalone descrambler, Boss, universal, etc...
Obviously, if you got a 2-piece converter/descrambler, or a standalone, or a 'hot box' or you baught an aftermarket box and added a test chip, you will not be handing this in.
DETECTION:
Everyone wants to know if the cable company can tell if you are using a descrambler or any other methods to get free cable.
1) Illegal hookups. Ok, some people don't even pay for basic cable, they just hook up illegally and use a descrambler. That way, cable is totally free! The downside is that illegal hookups are a LOT easier to find than a customer who is paying for basic but using a descrambler. There are several types of illegal hookups. The most dangerous is when you re-connect your own line after a cable company disconnection. Depending on your situation, your cable line may be delivered in several ways. It could just be tacked onto the side of your house, or it could go to a small metal box (usually locked) or, if you live in an apartment building, it could be in a large metal distribution box. So, to reconnect, you may need to go up on the pole (wher you usually run into a security sleeve, or some other sort of locking terminator, which prevents you from reconnecting your cable to the outlet that it was removed from), or open the metal box (its usually locked or at least has a tamper-proof seal on it.) or even re-splice a cut wire.
All of these methods are detectable. Climbing the telephone pole to reconnect your cable is the most dangerous method, not only because of the high voltages present up there and the danger of falling, but because it is very clear that you illegally hooked up the cable line. On the other hand, why would they ever go up there to check? If you are not a cable subscriber, they would have no reson to even think about your cable drop. Well, I hear that some companies do an audit (on a yearly basis?) to check if everyone that is hooked up is a paying customer. Aside from these dangers, its very very difficult to reconnect your cable line up on the pole. They sometimes put in a rotating sleeve that you need a special tool to remove. Other times, theres a special locking terminator that covers the jack that you need to connect to.
If your cable line is just snipped where it enters your house, that is also easy to see. If you re-connect it, and they notice, they will probably disconnect it on the pole. I don't think that snipping the cable line near the house is a very common practice, though.
If your cable is disconnected inside a metal distribution box, (and you want to reconnect it) then you need to open the box. If you live in an apartment building, sometimes the boxes are not even locked. This is especially true if you are in one of those buildings that has controlled access to the basement or roof (wherever the box is) you could try to make friends with the superintendant, tell him that you want to see your gas meter, water meter, electrical meter, or whatever. If its on the roof, tell him that you want to take some pictures of your city from the roof, or go bird watching, or look at the starz (oops, I mean stars!).
If your building has open access to the area where the cable lines are, the box may be locked. In a lot of situations though, the other cable-theiving people in the building have busted off the lock and the service man got tired of replacing it every month. You may be able to just open it up and reconnect your line. It might be impossible to know which one is yours if there are more than one disconnected lines. You could try to reconnect all of them and hope that none of the people you reconnect are scrupulous and decide to call the cable company and tell them that their cable was accidentally turned back on. Also, reconnecting all of them will make it more difficult for the cable company to pin it on you personally. If you want to find only your line, buy a 'tone tracer' look in electronic catologs that specialize in telecomunications test equipment.
If the box is locked and the lock is intact, then you will need to do a little work to get in. You could attempt to pick the lock. you *could* try to bust the lock off, but this is bad for obvious reasons, you could try to contact a cable repairman or installer and try to buy a key. If you are very industrious and you have a lot of time, you could try to remove the box from the wall and take it apart without unlocking it. Sometimes the boxes are constructed from a solid piece of sheet metal so this will not work.
If the box has a *SEAL* on it, and that's the only thing keeping it closed, you can try to cut the seal flush and hope it isn't noticed. If the box is also locked and you have found a way around that, you can probably just remove the seal and throw it away, the 'cable guy' will just assume that the last guy was too lazy to put on a seal.
2) Descramblers (2-piece, standalone, BOSS-type, etc)
When you hook up a descrambling box to your line, there is really no way that the cable company can determine that you are using it. Some people claim that the cable company uses a TDR to detect your box (a TDR is a Time Domain Reflectometer, look it up somewhere, it's description is beyond the scope of this file)... This is a pretty bogus argument, since they would have to have an exact electrical profile of the cable box that they think you might be using and match it to what they see from the TDR sweep at your house. Aside from that, they would have to disconnect your cable outside your house to check. You will probably notice 4 guys standing around your house as your cable goes out. In addition, a TDR is an extremely expensive piece of equipment and doesnt produce really great results. Also, if you have an amplifier or splitter as the first thing on your cable line, it is difficult to get a reading of anything else beyond those devices. In short, don't worry about this.
There are some things to be aware of, however.
You will most likely want to leave your original cable box hooked up. Aside from the fact that you don't want it to lose it's programming,(it needs to be hooked up to the system all the time to keep its programming) you will have to:
A) have it installed if the cable guy ever comes over to service your cable so he doesn't get suspicious.
B) use it to check if your cable system is really down. If you are watching cable on your illegal box and one or more channels go out, you need to check it on your legitimate box to make sure that the channel is really 'out' before you call for service. It is possible that your illegal box has a problem, or the cable company is doing something 'wierd' with their system to see who calls in. Remember, the cable company controls the legitimate boxes, so that they can make them switch channels on command. Then, whoever calls in to complain gets busted.
Also, if you are on a two- way system (your cable box talks back to the headend) such as the GI system that uses CFT-2200 boxes (not ALL cft-2200 systems actually use the 2-way) you will want to leave it hooked up because it will routinely 'check in' with the headend. If the headend doesn't hear from the box after a while, the company might call or visit to see whats wrong.
3) External Activators
There is a possibility of these being detected. The multi-mode capable activators for the GI/Jerrold system are most succeptible. They are continuously transmitting a signal to your cable box. Sometimes they transmit this signal towards the box AND ALSO back out the other way (towards the headend). So, if the cable guy disconnected your incoming line and connected some sort of receiver, he could hear the data from your activator. I doubt that this happens very often if at all, but it is possible. I'm not sure what this would mean, though... the cable company can't then bust down your door and seize your activator. They would probably threaten you with a lawsuit or something. Even though I can't see this happening you may want to at least unplug your activator when you are not home.
Remember, this is only a problem with the multi-mode activators that transmit almost constantly. If you use one of the older non-multi-mode activators like the original FTG where you have to press a button to transmit the signal, then you are safe.
I'm wondering if there is some way on the two-way system to interrogate the box to see what its up to (this is bad if it has been test chipped or externally activated) This can be avoided by using a standalone box or one that works on the GI multimode baseband system yet is not a CFT2200, such as a DPBB series box.
Conclusion
NOTE: none of this stuff applies to DSS. Also, the boxes used for 'wireless' cable may be different from the stuff they use for regular cable.
Well, that's about all I have to say about cable descramblers. Except that it IS LEGAL to own a descrambler, I guess you're supposed to alert the cable company that you are getting all the channels so that they can bill you. Oh, and another thing, if you buy a descrambler, DON'T ask about 'getting all the channels' or anything illegal, they will hang up on you or ignore your email. I guess that they can get busted for 'aiding cable theft' so the only way they can sell products is to claim that it's for avoiding box rental fees.

| [Up] | Or view howtotxt on-line here. |
| [Home] | Home Page |
| [Mail] | Send EMail to Hacker Central |
| [Contents] | Hacker Central Contents |

Last modified on Thursday, July 22, 1999