167 lines
6.9 KiB
Plaintext
167 lines
6.9 KiB
Plaintext
|
|
|
|
|
|
==========================
|
|
|
|
|
|
VIDEOCRYPT
|
|
|
|
|
|
==========================
|
|
|
|
|
|
|
|
|
|
VideoCrypt is without doubt a resilient system. It has been hacked
|
|
in the past eighteen months and it has recovered successfully. The
|
|
fact that it has been hacked illustrated that it is not pirate proof or
|
|
indeed hacker proof.
|
|
|
|
|
|
When the system was launched, some of the public relations
|
|
people claimed that it was the most pirate proof system yet devised.
|
|
This pirate proof attribute was a myth. A myth is an attempt to explain
|
|
a reality with the mental tools available. Therefore since the public
|
|
relations people neither understood the abilities of hackers or
|
|
security of the system it would be, to them at least, pirate proof.
|
|
|
|
|
|
The philosophy of the VideoCrypt system is that of the Detach;
|
|
Secure Processor. The decoder itself is merely a dumb terminal.
|
|
detachable secure processor is the smart card. Theoretically
|
|
smart card contains the Critical data and the decoder contains not
|
|
of significance. This "dumb terminal' idea has been echoed by N
|
|
Datacom and Sky executives.
|
|
|
|
|
|
The scrambling technique used in VideoCrypt is line cut and rotate.
|
|
The video is digitised and then cut at one of 256 possible points. the
|
|
digitised video segments are then rotated about this point and the
|
|
digital video is converted back to analogue.
|
|
|
|
|
|
The fact that the cut point is one of 256 points means that it can be
|
|
defined as an eight bit word. This byte is supplied by a Pseudo
|
|
Random Number Generator. The PRNG is sixty stages long and is
|
|
reset approximately every two and a half seconds. The seed is sent in
|
|
an encrypted format in the vertical blanking data.
|
|
|
|
|
|
VideoCrypt transmits addressing and access control data in a few
|
|
lines of the VBI. The data rate is slower than that of teletext. Each of
|
|
the packets of data has a checksum. This checksum is a product of
|
|
the active data in the packets.
|
|
|
|
|
|
The checksum is apparently not a standard one. It is, according to
|
|
sources, some sort of message digest or hash function. The data is
|
|
fed into a routine that generates a fixed length output. This output
|
|
block is attached to the data packet. If any of the bits in the data are
|
|
changed, the change will be detected. The decoder will run the data
|
|
through the same routine. The output block should be the same as
|
|
that transmitted with the data packet. If the comparison check fails
|
|
then the data has been altered.
|
|
|
|
|
|
Only 585 lines or so in each frame are scrambled. This is to enable
|
|
the VBI signals to be checked without descrambling the video. The
|
|
reason for this is so that the signal quality can be checked on SMATV
|
|
and cablenets without having to descramble the signal. It is a
|
|
standard feature on most scrambling systems.
|
|
|
|
|
|
|
|
Decoder Architecture
|
|
====================
|
|
|
|
The VideoCrypt stand alone decoder is a hybrid design. It uses
|
|
both discrete components and surface mount components. This is
|
|
necessary to reduce the size of the board. The board type used in the
|
|
early stand alone decoders is SRBP or synthetic resin bonded paper.
|
|
It is not the most reliable of board materials but it is one of the
|
|
cheapest. It does reject the television manufacturing industry as most
|
|
of the boards in television receivers are SRBP.
|
|
|
|
|
|
In the IRD version, the power supply is part of the main receiver
|
|
PSU. There are four voltage rails in the decoder: +21V, +12V5, +15V
|
|
and +5V. The main part of the circuitry runs off of the +5V0 rail.
|
|
|
|
|
|
The House Keeper microcontroller
|
|
================================
|
|
|
|
The main processor in the descrambler is the 8052 from Intel. This
|
|
is a microcontroller and has an on-chip ROM and RAM. There are
|
|
also two types of this microcontroller available; the BASIC ROM
|
|
version and the Mask programmable version. It is probable that the
|
|
version used in the descrambler is the Mask version. This means that
|
|
there is an 8K program running the descrambler. The 8052 can be
|
|
forced to disgorge the control program.
|
|
|
|
|
|
Many veteran hackers who examined the Sky decoder were
|
|
suspicious of the ease with which the 8052 could be forced to
|
|
disgorge the control program. By putting a finger across pins on the
|
|
ICs, some very strange messages came up on the screen. One of
|
|
these was "FALSE CUT POINT". The control program when
|
|
disassembled proved to be little more than house keeping with a few
|
|
card zap routines.
|
|
|
|
|
|
|
|
The incriminating text proved that the ZC404044 was a secure
|
|
Microcontroller. There was one other way of getting confirmation -
|
|
phone Motorola, the manufacturers of the chip, and ask them about
|
|
the IC.
|
|
|
|
|
|
Of course the fact that the program in the 8052 could be read and
|
|
examined meant that the whole card to secure processor interface
|
|
could be monitored and where necessary the data could be modified.
|
|
This has led to the most devastating hack on VideoCrypt - The
|
|
KENtucky Fried Chip.
|
|
|
|
|
|
The Secure Processor
|
|
====================
|
|
|
|
The real heart of the Sky decoder is the ZC404044 or in later
|
|
versions the ZC404047. The earlier decoders have an eight pin
|
|
EEPROM. The later versions incorporate the EEPROM data on the
|
|
ZC404047. The control program is held in masked ROM and as such
|
|
is very difficult to read. Ordinary attempts to disgorge it failed and
|
|
there are rumours that the ICs are being reversed in the Far East.
|
|
|
|
|
|
The Custom Logic
|
|
================
|
|
|
|
TCllOG03AP is custom logic. It handles the control of the video
|
|
descrambling circuitry. This is also the most likely area for the PRNG.
|
|
On same of the later versions of VideoCrypt decoders this part is
|
|
labelled TCE mV-2. The TCE possibly standing for Thomson
|
|
Consumer Electronics. This IC also handles the clock generation for
|
|
the whole decoder. The IC's clock is derived from a 28 MHz crystal.
|
|
|
|
|
|
The Video Descrambler
|
|
=====================
|
|
|
|
The video section of the VideoCrypt decoder is elegantly simple.
|
|
The scrambled video is digitised by a TDA8703 ADC. This turns the
|
|
video into a sequence of 8 bit words. The digitised video is then fed to
|
|
a set of two FIFO memories. FIFO stands for first in first out. These
|
|
ICs are capable of storing 910 8 bit words each.
|
|
|
|
|
|
Each FIFO holds one segment of the line so that reassembling the
|
|
video is merely a question of switching between the two FIFOs when
|
|
clocking out the data. The descrambled digitised video, with the
|
|
segments in the correct order, is fed to a TDA8702 DAC.
|
|
The multiplexing and latching is controlled by the custom logic IC.
|
|
The analogue video is then fed to the output stage. This stage is a
|
|
discrete transistor design. The video signal is clamped and the on
|
|
screen graphics are added. The resulting signal is filtered before
|
|
being routed to the SCART connector or back into the receiver.
|
|
|