I have found a method to extract the unit keys from a good VC2000 unit which
 can then be used to clone another VC2000(Brain dead unit) back to life. The
 clone will be an exact copy of the original and will have the same address
 ID. Any service the original has, the clone will have.
 ****************************************************************************
 Note: I have tested this only on version 2.4 boxes.
 ****************************************************************************
 The steps are as follows:
 1 - Make a eprom copy of UKEYREAD.U30. This code will run on a good VC2000
     version 2.4 and extract the unit keys from the U7 chip. The information
     will be displayed on your TV. This program should not modify any code
     in the good VC2000. The data displayed on the TV is the unit keys in a
     semi-scrambled form. Write this data down as you will need it to generate
     the unit keys for cloning another unit. With this information you can now
     replace U30 chip with what was there.
	Format is:
	  0234 5678 0ABC DEF0	  (line one top of display)
	  2222 4444 6666 8888	  (line two)
	  1111 3333 5555 7777	  (line three)
	  FFFF EEEE DDDD CCCC	  (line four)
	  0105 E325 FF		  (line five should be unit address)
 2 - Run the PC program UKEYGEN.EXE. This program will convert the unit keys
     from the semi-scrambled form above to what is needed for use in cloning
     another VC2000.
     A:ukeygen
     Enter the 4 Hex words from row 1
     0234 5678 0ABC DEF0		     Note: use leading zeros if req'd
     Enter the 4 Hex words from row 2
     2222 4444 6666 8888
     Enter the 4 Hex words from row 3
     1111 3333 5555 7777
     Enter the 4 Hex words from row 4
     FFFF EEEE DDDD CCCC
     Enter the 2 Hex words from row 5
     0105 E325

     Rkey1=  234 5678  ABC DEF0  ---
     Rkey2= 2222 4444 6666 8888    - This is echo of what was entered as input
     Rkey3= 1111 3333 5555 7777    - used to check for entry errors.
     Rkey4= FFFF EEEE DDDD CCCC  ---
     U ID=  105 E325		     This is the unit address ID.
     Ukey1=  369 a20d  e45 a300  ---
     Ukey2= d245 ea39  b21 9300    - This is the Unit keys data. Replace the
     Ukey3= a153 c229 1447 ac00    - leading blanks with Zero's. These 7 bytes
     Ukey4= 1267 3b52 182d d200  --- become the 56 bit keys. There are 4 sets.
				     This is the keys to use when you clone.
 3 - You now have the data needed to clone. I am currently testing a set of
     code which will use the Ukey information above to do the clone step and
     will send it along when I know that it works ok. If you need to clone
     and can't wait, then this is what you need to do:
     Look at a listing of Version 2.4 code and at address F307. This routine
     will initialize and write the Unit address into U7 (4 byte address key).
     Modify the instruction at F320 to point to the unit address key(4 bytes)
     written low byte to high. Ex. 0103 F239 -> 39F2 0301. The next step is
     to write the Unit keys into U7. The routine for this is at address F34B.
     This routine needs to be run executed 4 times. Modify the instruction
     at F37B to point to the Ukey string. The 7 byte Ukey string must have
     a leading byte to make it 8 long. The leading byte must be 00 for Ukey1,
     01 for Ukey2, 02 for Ukey3, and 03 for Ukey4. You have now restored U7.
     Now you can tune to a VC transponder and wait for the monthly Box keys
     to be sent or copy the correct data from U20. If you copy the data from
     address 6100 to 62ff(512 bytes) then the cloned unit will start working
     immediately. Like I said I'm testing a chip which does all this and should
     be sending it along soon.

 Note: I am working on making a generic version of an XACT KEYMASTER V9.0 chip.
       I will also make this available when complete.

     Happy Viewing,
     New York VC Hacker








Downloaded From P-80 International Information Systems 304-744-2253