M/A COM VIDEOCIPHER II DESCRAMBLER

M/A COM VIDEOCIPHER II DESCRAMBLER

SERVICE ID SEED KEY DATA COMMAND STRUCTURE
Commands 00 & 01

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (80 or 81) Not Saved 6100 6180
6002 Service ID for this Command 6100 6163 6101 6181
6003 Month Key ID for this Command 6101 6164 6102 6182
6004 Byte 1 of 4-Byte Vector & Seed Key Ptr. 6102 6165 6103 6183
6005 Byte 2 of 4-Byte Vector 6103 6166 6104 6184
6006 Byte 3 of 4-Byte Vector 6104 6167 6105 6185
6007 Byte 4 of 4-Byte Vector 6105 6168 6106 6186

Notes -- 1. Byte @ 6004 is Seed Key Pointer for Decrypting Month Working Key.
Status Bits are as Follows:

Bits 0 & 1 are Used as a Pair to Point to the Unit Seed Key
to use for DES Pass #1 of Unit ID & 4-Byte Vector of this
Command.

Bits 2 & 3 are Used as a Pair to Point to the Unit Seed Key
to use for DES Pass #2 of Unit ID & 4-Byte Vector of this
Command.

2. This Command Provides a Key Pointer and 4-Byte Starting Vector that
U7 uses with the Unit ID # to Decrypt the Month's Working Key.

M/A COM VIDEOCIPHER II DESCRAMBLER

UNIT AUTHORIZATION DATA COMMAND STRUCTURE
Commands 02 & 03

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (42 or 43) Not Saved 6107 6187
6002 Unit ID Number Byte 4 Not Saved 6108 6188
6003 Unit ID Number Byte 3 Not Saved 6109 6189
6004 Unit ID Number Byte 2 Not Saved 610A 618A
6005 Unit ID Number Byte 1 6106 6169 610B 618B
6006 Authorization Mask Byte 1 6107 616A 610C 618C
6007 Authorization Mask Byte 2 6108 616B 610D 618D
6008 Authorization Mask Byte 3 6109 616C 610E 618E
6009 Authorization Mask Byte 4 610A 616D 610F 618F
600A Authorization Mask Byte 5 610B 616E 6110 6190
600B Authorization Mask Byte 6 610C 616F 6111 6191
600C Authorization Mask Byte 7 610D 6170 6112 6192
600D Unit Unique Subscriber Key Byte 1 610E 6171 6113 6193
600E Unit Unique Subscriber Key Byte 2 610F 6172 6114 6194
600F Unit Unique Subscriber Key Byte 3 6110 6173 6115 6195
6010 Unit Unique Subscriber Key Byte 4 6111 6174 6116 6196
6011 Unit Unique Subscriber Key Byte 5 6112 6175 6117 6197
6012 Unit Unique Subscriber Key Byte 6 6113 6176 6118 6198
6013 Unit Unique Subscriber Key Byte 7 6114 6177 6119 6199
6014 Unit Unique Subscriber Key Byte 8 6115 6178 611A 619A
6015 Pay Per View Byte 1 (Unit Credit ?) 6116 6179 611B 619B
6016 Pay Per View Byte 2 (Unit Credit ?) 6117 617A 611C 619C
6017 Pay Per View Byte 3 (Unit Credit ?) 6118 617B 611D 619D
6018 Authorized Service ID 6119 617C 611E 619E
6019 Authorized Month Key ID 611A 617D 611F 619F
601A ? (Saved @ 6222 also) 611B 617E 6120 61A0
601B Authorization Status Byte (Usually D0) 6223 6223 6121 61A1

Notes -- 1. Byte @ Offset 601B has Flag Bits as Follows:

Bit 4 = 0 = Change Service ID to that in Command String
Bit 5 = 0 = Reset Purchase Password
Bit 7 = 0 = Convert U7 Audio Mode to Mono
Bit 7 = 1 = Convert U7 Audio Mode to Stereo

2. Unique Subscriber Category Key is the Month's Working Encryption
Key Scrambled Using an Iterative Process with 2 of the 4 Seed
Keys of the Unit, the Unit ID # and a Common 4-Byte Vector for
the Particular Service ID. When Decrypted using the Proper Seed
Keys and 4-Byte Vector, it Yields the Current Month's Working Key
Used to Decrypt each Program's Encryption Key contained in the
AVAILABILITY DATA Command Stream.

M/A COM VIDEOCIPHER II DESCRAMBLER

AVAILABILITY DATA COMMAND STRUCTURE
Commands 04 & 05

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (04 or 05) 611C 617F 6122 61A2
6002 Service ID for this Data String 611D 6180 6123 61A3
6003 Month Key ID for this Data String 611E 6181 6124 61A4
6004 Availability Mask Byte 1 611F 6182 6125 61A5
6005 Availability Mask Byte 2 6120 6183 6126 61A6
6006 Availability Mask Byte 3 6121 6184 6127 61A7
6007 Availability Mask Byte 4 6122 6185 6128 61A8
6008 Availability Mask Byte 5 6123 6186 6129 61A9
6009 Availability Mask Byte 6 6124 6187 612A 61AA
600A Availability Mask Byte 7 6125 6188 612B 61AB
600B Encrypted Current Program Key Byte 1 6126 6189 612C 61AC
600C Encrypted Current Program Key Byte 2 6127 618A 612D 61AD
600D Encrypted Current Program Key Byte 3 6128 618B 612E 61AE
600E Encrypted Current Program Key Byte 4 6129 618C 612F 61AF
600F Encrypted Current Program Key Byte 5 612A 618D 6130 61B0
6010 Encrypted Current Program Key Byte 6 612B 618E 6131 61B1
6011 Encrypted Current Program Key Byte 7 612C 618F 6132 61B2
6012 Encrypted Current Program Key Byte 8 612D 6190 6133 61B3
6013 Program Cost Byte 1 (Hexadecimal) 612E 6191 6134 61B4
6014 Program Cost Byte 2 (Hexadecimal) 612F 6192 6135 61B5
6015 Program Epic Status Byte (See Below) 6130 6193 6136 61B6
6016 Program Epoch/Epic Number Byte 6131 6194 6137 61B7
6017 ? ? ? 6132 6195 6138 61B8
6018 Program End Time Value (Byte 1) 6133 6196 6139 61B9
6019 Program End Time Value (Byte 2) 6134 6197 613A 61BA
601A Program End Time Value (Byte 3) 6135 6198 613B 61BB
601B Programmer ID Number 6136 6199 613C 61BC
601C ? ? ? (Used by PPV ?) 6137 619A 613D 61BD
601D ? ? ? (Used by PPV ?) 6138 619B 613E 61BE

Notes -- 1. Program End Time Values are Referenced to the Program Clock Count

2. Byte @ Offset 6015 has Status Bits as Follows:

Bits 0-2 = Program Rating Code Bits (0-7)
Bit 4 = 1 if Program is PREVIEW OF:
Bit 5 = 1 if BLACKOUT Rules in Effect
Bit 6 = 1 if Alternate Audio Channel Being Broadcast
Bit 7 = 1 if Program is Pay Per View Mode

3. Byte @ Offset 6016 has bits 5-7 to point to proper Month Key for
decrypting the Program Key in this data.

4. Current Program Key is Encrypted Using Month's Working Key Sent to
each Authorized Unit via the Unique Subscriber Category Key.

M/A COM VIDEOCIPHER II DESCRAMBLER

PROGRAM DATA COMMAND STRUCTURE
Commands 06 & 07

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (86 or 87) 6139 619C 613F 61BF
6002 Status Byte (Bit 0=1 if Time Avail) 613A 619D 6140 61C0
6003 ? 613B 619E 6140 61C1
6004 ? 613C 619F 6141 61C2
6005 ? 613D 61A0 6142 61C3
6006 ? 613E 61A1 6143 61C4
6007 Program Title Text / Service Name 613F 61A2 6144 61C5
. . . . .
. 30 Bytes (40 Characters) . . . .
. Packed VC2 ASCII Bytes . . . .
. . . . .
6024 End of Packed Text 615C 61BF 6162 61E2
6025 Programmer ID Number 615D 61C0 6163 61E3

Notes -- 1. Text is Contained in Buffer @ 6007-6024. Text is Packed VC2 ASCII.
Each Character is Represented by 6 Bits. Each Byte Holds 1
Complete Character and 2 Bits of the Next, thus 3 Bytes of Packed
Text Unpacks to 4 VC2 U6 ASCII Characters.

2. Note that the U6 Character Codes are not Standard ASCII!

M/A COM VIDEOCIPHER II DESCRAMBLER

SERVICE ID TELETEXT DATA COMMAND STRUCTURE
Command 08

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (88) Not Saved Not Processed
6002 Page # in Hex
6003 Start of Packed ASCII Text Data
6004 . . . .
6005 . . . .

6021 End of Packed ASCII Text Data
6022 Next Page # in Hex ?
6023 Previous Page # in Hex ?
6024 Service ID for this Command

Notes -- 1. This command provides 1 page of packed VC2 ASCII text for the
Teletext (TEXT) function.

2. The text data is packed 4 U6 ASCII Characters per 3 TEXT bytes.

3. This command is only processed when Register R32 (R20 Hex) is
set to 47 Hex (TEXT enabled).

M/A COM VIDEOCIPHER II DESCRAMBLER

PRIVATE MESSAGE PROCESSING
Command 09

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (49) Not Saved Not Processed
6002 Unit ID # Byte 4 Not Saved
6003 Unit ID # Byte 3 Not Saved
6004 Unit ID # Byte 2 Not Saved
6005 ? ? ?
6006 ? ? ? (Must be less than 04)
6007 Status Byte (Bit 3=0, Reset Passwords)
6008 ? ? ?
....
....
....
....
6028 Service ID for this Command

Notes -- 1. This command provides a means for the programmer's to send
private messages to any authorized descrambler in the country
via the Authorization Datastream.

2. The byte @ offset 6007 has Status Bits as follows --

Bit 3 = 0 : Reset Rating Ceiling and Purchase Passwords

M/A COM VIDEOCIPHER II DESCRAMBLER

SET UNIT GEOGRAPHIC LOCATION
Command 0B

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (8B) Not Saved Not Processed
6002 Unit ID # Byte 4 Not Saved
6003 Unit ID # Byte 3 Not Saved
6004 Unit ID # Byte 2 Not Saved
6005 Unit ID # Byte 1 61F8
6006 Geographic Location Byte 1 61F9
6007 Geographic Location Byte 2 61FA
6008 Geographic Location Byte 3 61FB
6009 Geographic Location Byte 4 61FC
600A Geographic Location Byte 5 61FD
600B Geographic Location Byte 6 61FE
600C Service ID for this Command Not Saved

Notes -- 1. This command provides a means for M/A Com to set the Geographic
Location of a Unit via the Authorization Datastream.

2. The Location is coded from the Mailing Address of the subscriber.

3. This information is accessed whenever the BLACKOUT mode bit is
set in the AVAILABILITY DATA command and processed along with
data transmitted via commands 12 & 13 in U30.

M/A COM VIDEOCIPHER II DESCRAMBLER

PROGRAM RATING CEILING DATA MESSAGES
Command 0D

Buffer Offset Description RAM Addresses
V2.4 Keymaster

6001 Command Byte (8D) Not Saved Not Processed
6002 Value for Maximum Available Rating 61C6
6003 ? ? ? 61C7
6004 ? ? ? 61C8
6005 ? ? ? 61C9
6006 ? ? ? 61CA
6007 Start of Packed Message for Rating 61CB
.... Ceiling Codes ....
.... ....
.... Messages are >12 (18 Decimal) ....
.... Packed U6 ASCII Bytes that ....
.... Unpack to >18 (24 Decimal) ....
.... Characters ....
.... ....
601E End of Packed Rating Code Message 61E2
601F Service ID for this Command 61E3

Notes -- 1. This command provides the Program Rating Codes (G, PG, PG-13, etc)
for display during the Rating Ceiling menu from SETUP 3.

2. The byte @ offset 6002 is a hex value that represents the highest
available Program Rating currently being broadcast by the programmer.
The Code is as follows --

00 = "G"
01 = "G"
02 = "PG"
03 = "PG-13"
04 = "R"
05 = "X"
06 = "XX"
07 = "XXX"

3. Code 05 is generally the highest available.