DOC FILE FOR "RUN-MON8.OBJ" (works in 018x units only) This is modified version of the Blues Brothers "RUN" chip for 018X units. U20 must be loaded with seed keys and monthly unit data by means of a U20 loader chip you already have. The stock "RUN" chip was designed to prevent the user from discovering the true unit id number or location code. The "RUN-MON8" chip (MON means monitor) is designed to give the user full access to all information in U20. It does not mask the unit id or location code and includes a "RAM-VIEW" function. The user can also directly observe the unit monthly authorization data (tier mask and month key). You can also observe authorization data for other units! It should also work in IRDs. It was only tested in a TRACKER VIII. To view unit authorization data press the "HELP" key. Example: 0100 0000 0000 33 <---- UNIT TIER MASK (HBO/CINEMAX) EE 5610 F2C5 903E A6 <---- UNIT MONTH KEY FOR MONTH 24 00 0000 A524 <---- LAST 4 BYTES ARE SERVICE ID & MONTH NUMBER 0100 0000 0000 33 <----SAME AS ABOVE BUT FOR MONTH 23 16 DF4E 71DC 5F42 B1 00 0000 A523 E980 CFD9 9EAD AE00 <----Current decrypted month key. Same for all units with same service id (A5). Changes every 2 months. 1st 7 bytes are the key. Last byte should always be 00. This example really IS the A523 month key! Month 23 is Feb. & Mar. 1988. RAM-VIEW To access the RAM-VIEW function do SETUP-0 then hit "7" several times until you get a screen full of HEX numbers. The ram address of the first byte displayed is in the upper left hand corner. The next 8 lines are the actual data (8 bytes per line). To change the block of memory displayed hit the "->" or "<-" keys to go forward or backward. The addresses wrap around at 67FF and 6000. To get back to normal SETUP-0 screen hit the "CANCEL" key. Some addresses of interest are: 6740 The first 4 lines are the units scrambled seed keys. The fifth line is the key used to de-scramble them prior to use. It is usually 11223344556677. This is a Blues Brothers innovation to keep the user from knowing the seed keys. 6600 This is a special function of "RUN-MON8". Authorization data for ALL OTHER units with the last byte of their unit ID the same as this unit is moved here when received. The user can observe their tier mask to see what services are popular with other VC-2 owners. Format: 6600 <--this memory address 0187 2DFA A524 0000 <--UNIT ID PLUS SERVICE ID & MONTH # 0100 0000 8000 0000 <--1st 7 BYTES= TIER MASK CDF4 029F FEC3 6789 <--MONTH KEY #24 FOR UNIT 0187 2DFA 0080 00A5 2400 D095 <-- ? The "D0" goes to 6223 in U20 A524 3853 1308 0000 <--- ** see note 1 below 0181 1234 FF00 0000 <--the ID of THIS unit in U7 (see note 2) E980 CFD9 9EAD AE00 <--current decrypted month key 6600 0700 0000 FF00 <--Misc. junk for ramview (pointers) note 1: This line is the service ID and unit key selectors for ALL units being served by this programmer. The first byte will cycle through C4,A0,A5.... going through all service IDs being served. For example CNN (G1-7) will cycle through A5,A0,C4,E3. "E3" is their commercial service ID for cable companies. Some services such as Telstar channels, have only a commercial service ID and don't serve C4 or A5. That's why you don't get any audio from them! note 2: If the 5th byte in this line is FF then the keys in U7 are probably OK and the unit could be restored to normal service. PROGRAM TIER MASK: 6100, 4th line, last byte plus 1st 6 bytes on line 5 is the PROGRAM tier mask for the current or next program. Usually only one bit will be set. In a normal VC-2 this will be and'ed with the UNIT tier mask to see if you are allowed to view this program. ie: any matching bits win. For example G1-19, Cinemax, uses a mask of 0000 0000 0000 20. Any units with bit 6 set in their tier mask can watch it. Select-TV is 0000 0000 8000 00 (bit 24). You can tune in different services, observe their program tier mask, then develop a map of bits vs services. You can then observe the data at 6600 to see who subscribes to what. All zeros mean that the unit is either out of service or GI may be doing electronic counter-measures. Electronic counter-measures IF GI SENDS YOUR UNIT A TIER MASK OF ALL ZEROS WHEN YOU HAVE A VALID SUBSCRIPTION TO 1 OR MORE SERVICES THEY ARE TESTING TO SEE IF YOU HAVE A MODIFIED DECODER!!!! 0000 0000 0000 00 <--bad news tier mask 0100 0000 0000 00 <--also bad news (everybody gets that bit plus one or more others) If your decoder had not been modified you would see the "NO SUBSCRIPTION" message when attempting to view the services you paid for. You would then call the service to complain. They would then send out the proper tier mask bits to restore service. IF YOU DON'T CALL TO COMPLAIN WITHIN A SEVERAL WEEK TIME SPAN GI WILL ASSUME YOU CAN WATCH REGARDLESS OF THE ZEROED TIER MASK AND MUST HAVE A MODIFIED UNIT. They then program their addressing computer to send your unit incorrect month keys which shut down the audio in your unit. Their is NO WAY to fix this. That unit ID number is forever useless! (Unless you can reprogram THEIR computer ) Please remember that GI sends the NEXT month key many times during the current month(s). They only send the current month key if the user calls for a change of service. They will most likely zero the tier mask for the NEXT month if they want to do it. If you call in to complain before it takes effect you will give yourself away. If you see a all zero tier mask for your unit be sure it is for the current month. The current month number is on the setup "0" screen directly above the "SA" or "FA" indicator. ** Note: For several hours on April 1st, the month number indicated that they had changed to key "24" but were actually still using key "23" . They could fool you!  Downloaded From P-80 International Information Systems 304-744-2253