M/A COM VIDEOCIPHER II DESCRAMBLER SERVICE ID SEED KEY DATA COMMAND STRUCTURE Commands 00 & 01 Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (80 or 81) Not Saved 6100 6180 6002 Service ID for this Command 6100 6163 6101 6181 6003 Month Key ID for this Command 6101 6164 6102 6182 6004 Byte 1 of 4-Byte Vector & Seed Key Ptr. 6102 6165 6103 6183 6005 Byte 2 of 4-Byte Vector 6103 6166 6104 6184 6006 Byte 3 of 4-Byte Vector 6104 6167 6105 6185 6007 Byte 4 of 4-Byte Vector 6105 6168 6106 6186 Notes -- 1. Byte @ 6004 is Seed Key Pointer for Decrypting Month Working Key. Status Bits are as Follows: Bits 0 & 1 are Used as a Pair to Point to the Unit Seed Key to use for DES Pass #1 of Unit ID & 4-Byte Vector of this Command. Bits 2 & 3 are Used as a Pair to Point to the Unit Seed Key to use for DES Pass #2 of Unit ID & 4-Byte Vector of this Command. 2. This Command Provides a Key Pointer and 4-Byte Starting Vector that U7 uses with the Unit ID # to Decrypt the Month's Working Key. M/A COM VIDEOCIPHER II DESCRAMBLER UNIT AUTHORIZATION DATA COMMAND STRUCTURE Commands 02 & 03 Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (42 or 43) Not Saved 6107 6187 6002 Unit ID Number Byte 4 Not Saved 6108 6188 6003 Unit ID Number Byte 3 Not Saved 6109 6189 6004 Unit ID Number Byte 2 Not Saved 610A 618A 6005 Unit ID Number Byte 1 6106 6169 610B 618B 6006 Authorization Mask Byte 1 6107 616A 610C 618C 6007 Authorization Mask Byte 2 6108 616B 610D 618D 6008 Authorization Mask Byte 3 6109 616C 610E 618E 6009 Authorization Mask Byte 4 610A 616D 610F 618F 600A Authorization Mask Byte 5 610B 616E 6110 6190 600B Authorization Mask Byte 6 610C 616F 6111 6191 600C Authorization Mask Byte 7 610D 6170 6112 6192 600D Unit Unique Subscriber Key Byte 1 610E 6171 6113 6193 600E Unit Unique Subscriber Key Byte 2 610F 6172 6114 6194 600F Unit Unique Subscriber Key Byte 3 6110 6173 6115 6195 6010 Unit Unique Subscriber Key Byte 4 6111 6174 6116 6196 6011 Unit Unique Subscriber Key Byte 5 6112 6175 6117 6197 6012 Unit Unique Subscriber Key Byte 6 6113 6176 6118 6198 6013 Unit Unique Subscriber Key Byte 7 6114 6177 6119 6199 6014 Unit Unique Subscriber Key Byte 8 6115 6178 611A 619A 6015 Pay Per View Byte 1 (Unit Credit ?) 6116 6179 611B 619B 6016 Pay Per View Byte 2 (Unit Credit ?) 6117 617A 611C 619C 6017 Pay Per View Byte 3 (Unit Credit ?) 6118 617B 611D 619D 6018 Authorized Service ID 6119 617C 611E 619E 6019 Authorized Month Key ID 611A 617D 611F 619F 601A ? (Saved @ 6222 also) 611B 617E 6120 61A0 601B Authorization Status Byte (Usually D0) 6223 6223 6121 61A1 Notes -- 1. Byte @ Offset 601B has Flag Bits as Follows: Bit 4 = 0 = Change Service ID to that in Command String Bit 5 = 0 = Reset Purchase Password Bit 7 = 0 = Convert U7 Audio Mode to Mono Bit 7 = 1 = Convert U7 Audio Mode to Stereo 2. Unique Subscriber Category Key is the Month's Working Encryption Key Scrambled Using an Iterative Process with 2 of the 4 Seed Keys of the Unit, the Unit ID # and a Common 4-Byte Vector for the Particular Service ID. When Decrypted using the Proper Seed Keys and 4-Byte Vector, it Yields the Current Month's Working Key Used to Decrypt each Program's Encryption Key contained in the AVAILABILITY DATA Command Stream. M/A COM VIDEOCIPHER II DESCRAMBLER AVAILABILITY DATA COMMAND STRUCTURE Commands 04 & 05 Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (04 or 05) 611C 617F 6122 61A2 6002 Service ID for this Data String 611D 6180 6123 61A3 6003 Month Key ID for this Data String 611E 6181 6124 61A4 6004 Availability Mask Byte 1 611F 6182 6125 61A5 6005 Availability Mask Byte 2 6120 6183 6126 61A6 6006 Availability Mask Byte 3 6121 6184 6127 61A7 6007 Availability Mask Byte 4 6122 6185 6128 61A8 6008 Availability Mask Byte 5 6123 6186 6129 61A9 6009 Availability Mask Byte 6 6124 6187 612A 61AA 600A Availability Mask Byte 7 6125 6188 612B 61AB 600B Encrypted Current Program Key Byte 1 6126 6189 612C 61AC 600C Encrypted Current Program Key Byte 2 6127 618A 612D 61AD 600D Encrypted Current Program Key Byte 3 6128 618B 612E 61AE 600E Encrypted Current Program Key Byte 4 6129 618C 612F 61AF 600F Encrypted Current Program Key Byte 5 612A 618D 6130 61B0 6010 Encrypted Current Program Key Byte 6 612B 618E 6131 61B1 6011 Encrypted Current Program Key Byte 7 612C 618F 6132 61B2 6012 Encrypted Current Program Key Byte 8 612D 6190 6133 61B3 6013 Program Cost Byte 1 (Hexadecimal) 612E 6191 6134 61B4 6014 Program Cost Byte 2 (Hexadecimal) 612F 6192 6135 61B5 6015 Program Epic Status Byte (See Below) 6130 6193 6136 61B6 6016 Program Epoch/Epic Number Byte 6131 6194 6137 61B7 6017 ? ? ? 6132 6195 6138 61B8 6018 Program End Time Value (Byte 1) 6133 6196 6139 61B9 6019 Program End Time Value (Byte 2) 6134 6197 613A 61BA 601A Program End Time Value (Byte 3) 6135 6198 613B 61BB 601B Programmer ID Number 6136 6199 613C 61BC 601C ? ? ? (Used by PPV ?) 6137 619A 613D 61BD 601D ? ? ? (Used by PPV ?) 6138 619B 613E 61BE Notes -- 1. Program End Time Values are Referenced to the Program Clock Count 2. Byte @ Offset 6015 has Status Bits as Follows: Bits 0-2 = Program Rating Code Bits (0-7) Bit 4 = 1 if Program is PREVIEW OF: Bit 5 = 1 if BLACKOUT Rules in Effect Bit 6 = 1 if Alternate Audio Channel Being Broadcast Bit 7 = 1 if Program is Pay Per View Mode 3. Byte @ Offset 6016 has bits 5-7 to point to proper Month Key for decrypting the Program Key in this data. 4. Current Program Key is Encrypted Using Month's Working Key Sent to each Authorized Unit via the Unique Subscriber Category Key. M/A COM VIDEOCIPHER II DESCRAMBLER PROGRAM DATA COMMAND STRUCTURE Commands 06 & 07 Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (86 or 87) 6139 619C 613F 61BF 6002 Status Byte (Bit 0=1 if Time Avail) 613A 619D 6140 61C0 6003 ? 613B 619E 6140 61C1 6004 ? 613C 619F 6141 61C2 6005 ? 613D 61A0 6142 61C3 6006 ? 613E 61A1 6143 61C4 6007 Program Title Text / Service Name 613F 61A2 6144 61C5 . . . . . . 30 Bytes (40 Characters) . . . . . Packed VC2 ASCII Bytes . . . . . . . . . 6024 End of Packed Text 615C 61BF 6162 61E2 6025 Programmer ID Number 615D 61C0 6163 61E3 Notes -- 1. Text is Contained in Buffer @ 6007-6024. Text is Packed VC2 ASCII. Each Character is Represented by 6 Bits. Each Byte Holds 1 Complete Character and 2 Bits of the Next, thus 3 Bytes of Packed Text Unpacks to 4 VC2 U6 ASCII Characters. 2. Note that the U6 Character Codes are not Standard ASCII! M/A COM VIDEOCIPHER II DESCRAMBLER SERVICE ID TELETEXT DATA COMMAND STRUCTURE Command 08 Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (88) Not Saved Not Processed 6002 Page # in Hex 6003 Start of Packed ASCII Text Data 6004 . . . . 6005 . . . . 6021 End of Packed ASCII Text Data 6022 Next Page # in Hex ? 6023 Previous Page # in Hex ? 6024 Service ID for this Command Notes -- 1. This command provides 1 page of packed VC2 ASCII text for the Teletext (TEXT) function. 2. The text data is packed 4 U6 ASCII Characters per 3 TEXT bytes. 3. This command is only processed when Register R32 (R20 Hex) is set to 47 Hex (TEXT enabled). M/A COM VIDEOCIPHER II DESCRAMBLER PRIVATE MESSAGE PROCESSING Command 09 Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (49) Not Saved Not Processed 6002 Unit ID # Byte 4 Not Saved 6003 Unit ID # Byte 3 Not Saved 6004 Unit ID # Byte 2 Not Saved 6005 ? ? ? 6006 ? ? ? (Must be less than 04) 6007 Status Byte (Bit 3=0, Reset Passwords) 6008 ? ? ? .... .... .... .... 6028 Service ID for this Command Notes -- 1. This command provides a means for the programmer's to send private messages to any authorized descrambler in the country via the Authorization Datastream. 2. The byte @ offset 6007 has Status Bits as follows -- Bit 3 = 0 : Reset Rating Ceiling and Purchase Passwords M/A COM VIDEOCIPHER II DESCRAMBLER SET UNIT GEOGRAPHIC LOCATION Command 0B Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (8B) Not Saved Not Processed 6002 Unit ID # Byte 4 Not Saved 6003 Unit ID # Byte 3 Not Saved 6004 Unit ID # Byte 2 Not Saved 6005 Unit ID # Byte 1 61F8 6006 Geographic Location Byte 1 61F9 6007 Geographic Location Byte 2 61FA 6008 Geographic Location Byte 3 61FB 6009 Geographic Location Byte 4 61FC 600A Geographic Location Byte 5 61FD 600B Geographic Location Byte 6 61FE 600C Service ID for this Command Not Saved Notes -- 1. This command provides a means for M/A Com to set the Geographic Location of a Unit via the Authorization Datastream. 2. The Location is coded from the Mailing Address of the subscriber. 3. This information is accessed whenever the BLACKOUT mode bit is set in the AVAILABILITY DATA command and processed along with data transmitted via commands 12 & 13 in U30. M/A COM VIDEOCIPHER II DESCRAMBLER PROGRAM RATING CEILING DATA MESSAGES Command 0D Buffer Offset Description RAM Addresses V2.4 Keymaster 6001 Command Byte (8D) Not Saved Not Processed 6002 Value for Maximum Available Rating 61C6 6003 ? ? ? 61C7 6004 ? ? ? 61C8 6005 ? ? ? 61C9 6006 ? ? ? 61CA 6007 Start of Packed Message for Rating 61CB .... Ceiling Codes .... .... .... .... Messages are >12 (18 Decimal) .... .... Packed U6 ASCII Bytes that .... .... Unpack to >18 (24 Decimal) .... .... Characters .... .... .... 601E End of Packed Rating Code Message 61E2 601F Service ID for this Command 61E3 Notes -- 1. This command provides the Program Rating Codes (G, PG, PG-13, etc) for display during the Rating Ceiling menu from SETUP 3. 2. The byte @ offset 6002 is a hex value that represents the highest available Program Rating currently being broadcast by the programmer. The Code is as follows -- 00 = "G" 01 = "G" 02 = "PG" 03 = "PG-13" 04 = "R" 05 = "X" 06 = "XX" 07 = "XXX" 3. Code 05 is generally the highest available.