Authorized channels with SPI replay

[trez]

I have been able to authorize channels with SPI replay on several boxes and I will describe the procedure here. This replay will only work on the box that the SPI log was captured on. Also you cannot replay multiple logs. By this I mean that if you have the cable company authorize a few digital channels, lets just say 2 for example and then you have them downgraded and then you have the cable company authorize 2 different channels and then downgrade them, you cannot replay the 2 different logs and have 4 digital channels working. So, if you want lots of digital channels you must subscribe to them all at once. In the future it may be possible to combine logs but not at this time. Also the cable company does a daily scan of the box and this causes it to loose those digital channels, so right now I have to replay the SPI capture daily. This happens on both downgraded and deactivated boxes until there is a modification that can block these commands. BTW, if you deactivate the box, make sure you block the uplink and if you downgrade the box subscriptions, if you remove power and plug it back in, make sure you don?t have the cable hooked up until the box has reset or it will deactivate the channels. Also I am not sure when the daily scan happens on downgraded boxes and the digital channels are removed if it reports back to the cable company what was done.

This procedure also will not increase the credit for PPV (in XC chip). Right now the best way to use PPV is to clear the count with BDM and then occasionally load original nvram that has 0 PPV on it. (not cleared with BDM) and to purchase a PPV, that way more credit is given to XC chip. One of my boxes had an error ?unable to order PPV please contact??? because the value in the XC chip had exceeded the limit. I had the box disconnected and reconnected and the last PPV info was sent to the cable company. The box can now order more PPV.

Let?s begin,

1. Run SPILog, I recommend version 0.4 as sometimes when the cable company authorizes the box it reboots it and then SPILog crashes and you have to open it up again quickly. This is not a problem in 0.4.

2. Call cable company and subscribe to digital channels you want, once they have authorized the channels close SPILog. Wait several days or however long you want and then downgrade subscriptions or deactivate the box.

3. The log file we need is the SPI0E file. What we need are the last four 80 3c lines. The easiest way for me is to scroll to the bottom on the text file and do a find for 80 3c and choose direction up. When replaying the sequence I do it in the same order as it is in the log (top to bottom). If we look at a sequence (not actual values) we will see:

80 3c 01 02 03 04 05??
55 00 00 00 00 00 00?? -Ignore this line

81 10 11 12 13 14 15??
55 00 00 00 00 00 00?? -Ignore this line

81 20 21 22 23 24 25??
55 00 00 00 00 00 00?? -Ignore this line

81 30 31 32 33 34 35??
55 00 00 00 00 00 00?? -Ignore this line

xx xx
55 00 -These short lines let us know sequence has ended and is not used

To compose the replay sequence we ignore the 80 and 81 values so a proper sequence looks like:

3c 01 02 03 04 05?10 11 12 13 14 15?20 21 22 23 24 25?30 31 32 33 34 35?

The actual sequence will be a lot longer than this example.

You repeat this process for the remaining three 80 3c sequences.

I don?t have word wrap turned on in the text file that I created for the sequence (not sure if it makes a difference) and I just copy and paste into it

4. Lets begin the replay.
Run usbbdm then click dct testing and then click SPI Commander. Type:

reset 1
init
setram ea0000 500
go= ea0000

Next run SPI Commander and type in it:

s 2
s 0 0 0
s 2
s 0 0 0
s 86 18
g 2 1 0
g 4 0
g 5 0
g
g 0e 05 30 18 19 35 85
g 3c 01 02 03 04 05?10 11 12 13 14 15?20 21 22 23 24 25?30 31..... -replay sequence you created
g 3c xx xx xx xx xx xx xx xx?? -replay sequence you created
g 3c xx xx xx xx xx xx xx xx?? -replay sequence you created
g 3c xx xx xx xx xx xx xx xx?? -replay sequence you created
g

The four g 3c lines are from the replay sequence that you created. The easiest way to put them into the SPI Commander is to paste them in with the keystrokes of ctrl-v.

5. Go back to usbbdm and type reset


You have now authorized the digital channels that you previously had.

Enjoy!

[usbbdm]

trez good work. I hope more people join the SPI group to enjoy the real testing. The NVRAM and flash are just get you started.
A new firm to block the scan to XC chip will be considered in near future.

[patsfan]

holy crap trez excellent work. quite the first post

[tester5]

try to do that on like 4 diferent boxes and see what is diferent and what changes mabe we find a dam key maker

[usbbdm]

I will modify the SIPloger to record the auth command and SPI commander play back the auth command with a single button. Currently, the procedure is very complicated for most of the people. But as I am very busy, I will strill try my best to make this happen ASAP.

[usbbdm]

OK, the SPILog.exe 0.51 and SPIcommand.exe 0.3 combination can do the job automatically. I hope more people start to look into using SPI to test. Now it is so easy that everyone should be able to do it. Look at some videos.
http://www.usbjtag.com/video

[twistedps]

is it possible to change the channel that is authorized? say if i had channel 112 authorized, logged it, but i wanted to use it to authorize channel 243, is this possible as of yet?

[usbbdm]

is it possible to change the channel that is authorized? say if i had channel 112 authorized, logged it, but i wanted to use it to authorize channel 243, is this possible as of yet?

For now, not yet. The algorithem is still unknown.

[andak]

Finally got serial to serial connection using another computer. USB to serial do not work. Run SPILog.exe and got some data by flipping chanel 1-936 to 1 again. Got data on SPI0E and SPI07 but nothing on auth00.bin file(0 bytes). If I call CC to ask for premium or other channel to be authorize and capture it thru SPILog, will auth00.bin have some data in it? Also if I run SPIcom(serial cx) I'm getting some binary data without "play" command as shown on video guide. What is this data? Can you provide procedure how to perform SPI in proper way. Thanks.

[usbbdm]

Finally got serial to serial connection using another computer. USB to serial do not work. Run SPILog.exe and got some data by flipping chanel 1-936 to 1 again. Got data on SPI0E and SPI07 but nothing on auth00.bin file(0 bytes). If I call CC to ask for premium or other channel to be authorize and capture it thru SPILog, will auth00.bin have some data in it? Also if I run SPIcom(serial cx) I'm getting some binary data without "play" command as shown on video guide. What is this data? Can you provide procedure how to perform SPI in proper way. Thanks.

If you call CC, the auth00.bin will not be 0 bytes.
Download the latest SPICommand.exe will give you play command.