Slipstream  1.00  Viaccess Smartcard Emulator - User's Guide  

Disclaimer

Please note that using this software for anything other than educational purposes, might be illegal in your country. This software is the result of a personal educational project without any commercial interest.

Feature Overview

• Runs on all Funcard Wafer card
• Compatible with most embedded and external Viaccess CAMs
• Familiar Funvxs 1.2 external eeprom format, developed by The Who Cares Group
• Operational key Auto Updating
• Operational key Remote Updating
• On Screen Display of operational key metadata
• Multi-Issuer/Virtual Cards. One card can emulate a multitude of original cards - one real card containing a set of Virtual Cards 
• Lock Control Disable. Circumvents the 24-h PIN code change lock present on some Set Top Boxes, STBs
• Built in functions for "through-AVR" Phoenix/Smart mouse eeprom access

Quick start

Slipstream uses a Funvxs 1.2 compatible eeprom layout. Hence, you edit the eeprom of Slipstream with the same editors you are used to. In fact, your good old Funvxs 1.2 eeprom file can be used without any modifications together with the flash program file (ss_flash100.hex) and the internal eeprom file (ss_intee.hex). Bundled in this release are also a couple of external hex files that can be used as templates, having pre-configured consultation configuration sections (CAAC Reply). As soon as you have edited the external hex files with issuer and provider identities and keys (possibly also FAC) you are ready to program the card and it should bring colors to your TV screen.

However, in order to take full advantage of the feature set of Slipstream, you should carry on reading this User's Guide.

Hardware requirements

The software runs on any Funcard Wafer card with a 24C64 (8kByte) or larger external eeprom. Slipstream supports Protocol Type Selection, PTS and is designed to work with a wide range of CAMs; embedded as well as external CAMs.

Configuring Slipstream

Command answers

The answers to FAC commands 87 04 and 87 06 is configurable and essential for some STBs requiring this data to be correct. The answers to consultation commands are also configurable (CAAC reply) and for some STBs make a difference. To get a setup that works for most cases, base your external eeprom hex file on one of the supplied templates.

Configuration flags

The "LCD" flag in the configuration section of your editor activates the Lock Control Disable function. When activated it will effectively circumvent the 24-h PIN code locks present on some STBs. Leave the LCD flag unchecked if your STB does not feature a code entry lock. The other two configuration flags "Control LEDS" and "Key LEDS" have no meaning in the current version.

Entity sections

An entity can be an issuer entity or a provider entity. Slipstream allows multiple issuer entities to be inserted along with multiple provider entities on the same card. The configuration of the entity section must follow these rules:

1. Issuer rules. The first issuer must be placed in the first entity position. Any additional issuers must follow in a consecutive order. The rightmost nibble of the issuer's 3-byte (6-nibble, 24-bit) identity must reflect its position. So, the first issuer has rightmost nibble 0, the second issuer 1, etc. An issuer must have a identity bit pattern in the form FF****.
2. Provider rules. The first provider entity must be placed right after the last issuer entity. Any additional providers must follow in a consecutive order. The rightmost nibble of the provider identity is used to make an association with one of the of the declared issuers, in other words; point to the position of the associated issuer. A provider must not have a identity bit pattern in the form FF****.

For providers updated using UA/PPUA issuer updates, insert mkeys and UA/PPUA in the issuer entity.
For providers updated using UA/PPUA provider updates, insert mkeys and PPUA in the provider entity. If UA updates are used, UA is needed in the UA field of the associated issuer. Hence, the same format as in an original card is used. Only an issuer can carry an UA, the UA field in a provider entity is not used.

Look at it this way, every issued original card features one issuer with an UA and one or more providers. When you edit the Slipstream eeprom you gather all issuers in the first part of the entities section and give them increasing rightmost nibble numbers from 0 and up. Then you gather the providers in the following part of the entities section. The rightmost nibble of the provider associate each of them with the previously declared issuers. Slipstream entities section is a merger of multiple cards, in effect creating several Virtual Cards held by one real card. If you prefer the feature name Virtual Cards over Multi-Issuer;  it's up to you!

In order to set the rightmost nibble to a non-zero value you must have an editor allowing this, like FunProm. Picbined, on the other hand will not allow this, and can not be used if your configuration has multiple issuers. 

An example with three issuers. One real card acting as three virtual Viaccess cards. This example for Viasat with two issuers FFF400 (UA-issuer updates using mk05) and SVT Europa with one issuer FFF450 (UA provider updates using mk00):

The total number of issuers and providers is currently limited to 23. Even if its allowed, it does not make sense to declare more issuers than providers.

Also, always insert the fixed opkey 08 for the providers as it's used as a fallback key. For other examples on how to configure the entity section have a look at the template eeprom files included in the release.

Auto updating

Slipstream supports shared group key updates, and single customer key updates. For the shared group key updates, the full PPUA is used (SA + CustWp). CustWp == 0 is not a special case, so if set to 0 will work only if that particular customer in the group receives updates. This is to prevent fake updates from interfering with card operation. 

The switch of issuers is made when it becomes necessary only.

Remote updating

Remote opkey updating is accomplished using the change PIN code menu of your STB. The used format is the MultiMac key encoding format extended with prefix. Make sure the 4 digit prefix (Sidd index) is entered first, followed by the 8 four digit key codes. If your STB have a 24-h lock on changing PIN, you should try out the LCD feature.

On Screen Display

On Screen Display, OSD is provided by means of the Subscription Information list and Provider Labels. These fields are exchanged with information about the opkeys handled by Slipstream. Only the label of the currently active provider, defined by the channel selected on your STB, will be replaced with OSD information. All other provider label fields will present the label as edited in the eeprom file. To control the OSD mode the Purchase Threshold and/or Maturity Rating controls are used. Internally these two are coupled and you can use which one of them you prefer and have available on you STB. Setting one of them means setting both. Besides controlling the OSD mode the PT/MR can be used to enter commands to Slipstream. The OSD modes and commands are explained below:

OSD modes

To set a OSD mode, enter PT/MR equal to the desired mode number. Below is a list defining what the label field of the active provider will display for each OSD mode. Default mode after reset is 2.

• Mode 0: Label mode. The label of the providers as edited in the eeprom file is displayed for all providers.
• Mode 1: Version Mode. Slipstream version string is displayed, e.g. "Slipstream 1.00"
• Mode 2: Key in use mode. Displays the hexadecimal key representation of the used key on the last active provider. Hence, if active channel on the STB is coded and decrypted the key in use will be shown. If the channel is coded but not decrypted the string "Key 0x unknown" will be displayed, where x is the hexadecimal representation of the key index (8,9,A,..,F).
• Mode 3: Entities in use mode. Displays the identity of the active issuer and provider entities, e.g. "FFF400-010C30".
• Mode 8-15: Specific key mode. Displays the specific key stored in eeprom selected by the mode number. The key is displayed regardless of if it's a correct key or not. Please note that all numbers are decimal. Dec relates to hex as: 8=8,9=9,10=A,11=B,12=C,13=D,14=E and 15=F.

For all OSD modes except for mode 0, the Subscription Information menu will present key history and information about how opkeys have been updated. When the card is taken in use it is advised to first perform a formatting of the eeprom section containing the information about the opkeys, the metadata section. This is described in Commands below.

The Subscription Information screen for the selected provider will contain a list of 8 rows that will look something like in this example:

START DATE => The date at which the opkey was first updated.
STOP DATE => The date when the opkey was last used. If START DATE > STOP DATE this means the updated key is a "next" key.
CLASS => not used.
THEME => Information about how the opkey was updated. Look at THEME as a three digit number "xyz":

LEVEL => Index of the opkey about which the row gives information. Also, if the opkey is in use by the active channel, either 100 or 200 is added to the key index. 100 + index mean that key is in use and the key is correct. 200 + index mean that key is in use but the key stored in card is not correct.

So, looking back at the example screen above with the 8 rows of key information data we can tell that:

• The key in use by the active channel is opkey 10, and it is successfully used for the decryption of the picture. As opkey 10 is in use now the STOP DATE tells us today's date is the 10:th of February.
• Opkey 10 was AU updated the 9:th of February using UA updates over issuer with mkey 5.
• Opkey 12 was AU updated the 10:th of February (today) using same method as for opkey 10. Since START DATE > STOP DATE for opkey 12, this means it's a "next key" not taken in use yet.
• Opkey 14 was updated by remote control.

Some STBs sort the rows on basis of dates. This means that the order in which the rows is presented may differ from this example and when the dates changes. Remember to check the LEVEL value to be certain for which opkey each row applies to.

Commands

To send a command to Slipstream, enter the command number in the PT/MT menu. The previously selected OSD mode will not change, e.g. when PT/MT menu is re-entered the OSD mode will remain at the OSD mode present before the command was entered.

• Command 7: Format metadata sections for all providers. All dates will be set to 01/01/1980 and THEME set to 77.

No other commands are defined in this version of Slipstream.

Phoenix Programming handles

Slipstream features built in external eeprom handles. Dedicated instructions make writing and reading of the external eeprom possible without re-programming the AVR controller with a loader. The access to the eeprom is made via any Phoenix or Smart mouse compatible ISO7816 interface.

An editor making use of the Slipstream eeprom handles offers a faster way to access provider data, as compared to a editor/programmer needing to overwrite the AVR program with a special loader or gateway software first. In Slipstream this gateway is already built in. 

The commands CB 25 and CB 26 below are implemented for accessing the eeprom. Maximum allowed length of the L byte is 100 decimal. All digits are in hexadecimal form. >> denotes data transfer in the direction towards the card. << denotes data transfer in the direction from the card.

Read instruction:
>> CB 25 < 2 bytes of address > < 1 byte, length L >
<< 25
<< < L bytes of data returned from card >
<< 90 00

Write instruction:
>> CB 26 < 2 bytes of address > < 1 byte, length L >
<< 26
>> < L bytes of data transferred to card >
<< 90 00

Release Bundle

The 1.00 release bundle consist of the following files:

Release History/Information

Version: 1.00, First public release made Mars 2003.

Author: Dauntless

Special Thanx: To all who have contributed - You know who you are!

Terms of use: Do not use the software for other purposes than educational. Do not re-bundle the release with additional or altered original files without authors approval. Violating any of these terms of use is considered disrespectful.