Jump Points And 3 M Code example essay topic

Writing a 'Private 3 M Script' First it is important to define the term '3 M. ' The term '3 M's imply refers to a script's ability to unlock all of the channels, based on the saying 'All for one, and One for all! ' from the '3 Musketeers,' (which came from the old days of hacking cable boxes where all channels were viewable through one channel). Anyway, '3 M' now is just a generic term for a card that has all channels open and no stealth or write protection. In stealth scripts, the '3 M' code refers to the actual part of the code that enables the video. All scripts that open all of the channels are 3 M's, however most people are referring to scripts that auto-update on their own, when they refer to a 3 M. The card auto-updates because it has no commands blocked, and it appears to be a normal subbed card, as much as possible. The EASIEST type of 3 M to write is to modify a valid bin file, by editing it in BasicH. Before you can write a script to modify the card, you need to be able to edit a bin file manually to make those changes.

If you read through this page carefully you will find everything you need to know to modify a valid bin file with unique jump points and a 3 M code. After you are done editing your valid bin file you will have a private 3 M that auto-updates, with private jump points. To remove simply do a 1-STEP clean in BasicH or Basich. If you follow the directions you should have a fairly safe 3 M to use. If you have a private 3 M (that does not have code in any regions that have been changed ago updates) your card would still be running today no matter HOW long they " ve been you installed it. They can only send a 'killer' ECM that will loop your cards if they have 8 known bytes in a row that they can hash.

In order to ZAP your card with an ECM your card needs to be detected as being 'hacked. ' In order to do this they need to know you card's 'signature,' and your signature is based on the 'extra' data that is on your card: the jump points and 3 M code. If they don't know your jump points or how exactly you broke up your 3 M code then it is not possible for them to target you since they won't know the 'signature' of your card. The advantage of picking your own jump point is that your card's signature is different from most people's cards.

They are mainly interested in hashing the most public areas to hash. If you pick the INS 54 area then you can bet that a many other people have also figured out what you have. You should really try to find a jump point outside of the INS 54 area. All were after here is to make your card's signature just enough different than the freeware script users. Anything you can change will help. If you clone your card then you have 2 known bytes that will be different from your CAM ID, and those bytes are a checksum for the CAM ID.

It MAY be possible that they can check those two bytes against the CAM ID to see if your card is cloned, but they haven't demonstrated that ability yet. Remember- nothing is foolproof- If your card is in the data stream taking updates, you risk an update possibly writing over part of the 3 M software and corrupting your card. Nobody ever knows where the update will occur on the card. To make things simpler to understand and follow I have color coded this page: "h PURPLE for the 02 (jump to) code "h BLUE for the 3 M code "h RED for the byte's ADDRESS Understanding How Cards Work The signal is based on packets of data which are sent along with all the video data to every receiver out there. Some of this data is filtered out before it is passed on to the smart card, such as individual unit authorizations. Of all the millions of these, only the ones for your smart card are passed on to your smart card.

This is so the smart card does not get totally overloaded with messages for everyone else. Most of the other data packets DO get to your smart card. When the signal passes through a card the following routine happens: "h Normal Code Cycle The DSS signal 'passes thru' the card and does certain events that are important to the function of the card". h 'INS 54' Determines Authorization The INS 54' is the location of code on the card that determines whether or not you are authorized to view a channel, and is responsible for returning a proper value to any authorization requests". h Normal Code Cycle The signal comes back from the the 'INS 54' area and either authorizes or turns off the signal, based on what value was returned. When the signal passes through a card that has 3 M code on it the following routine happens: "h Normal Code Cycles The DSS signal 'passes thru' the card and does certain events that are important to the function of the card". h Jump to Fake Authorization or '3 m code' The card 'jumps' from the 'INS 54' area to an address you have specified that has your 3 M code. The 3 M code 'tricks' the card in to thinking that the authorization is present by giving it a ZNT of it's own, and then returning the proper answer, which allows all of the channels to be unlocked (this is the JUMP POINT)". h Jump back from the '3 M code' The 3 M code jumps back to the address you have specified at the end of the 'INS 54' area: 8 D 2 D "h Normal Code Cycles The signal authorizes the signal for all channels based on what was returned from the Fake ZNT or '3 M code. ' The area of the card that is checked to see if the channel has authorization is called 'INS 54.

' That area in the card's EEPROM is 827 B-8 D 2 D. That's why most, but not all, jump points are placed with in that area. Whenever you change the channel the card checks the 'INS 54' area of the card to check and see if that channel is authorized. When the 'check command' reaches your JUMP POINT it jumps out of 'INS 54' directly to wherever your 3 M code starts. the signal then bounces around to your selected 'jump to' addresses and reads the 3 m code (which fools it into thinking that the channel is authorized). The signal then jumps back to the last byte of INS 54 which is 8 D 2 D where it continues it's normal cycle. During in all of this the card actually thinks it was always in the 'INS 54' area of the card, even though it jumped out and back again.

The instruction that is CRITICAL to learn about for writing 3 M's is 'INS 54'. You should trace its path as far as possible in both directions so you can try to understand it completely. Not all jump points have to be within the INS 54 handling routine from 8 D 03-8 D 2 F (or 8 D 65) But, it is the INS 54 that's the instruction sent when you change channels that returns authorization, so you " ll probably want to intercept that instruction somewhere. Understanding Address Locations To gain a better understanding of address locations open BasicH and load a. bin file. 8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |... 8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 XX 00 |...

8030 is the address location of the 1st byte of data which is represented in hexadecimal format. As an example to help you better understand the addresses the address location of the byte represented by XX is 805 E. You will not need to modify your 3 M like the above example- it is for learning purposes only. The datastream passes through your card and goes through it's normal code cycle at 8 D 17, then it hits 8 D 1 A. 8 D 1 A is the ZNT (Zero Number Test) which is used in authorization of the channels. You simply want to alter the code so that we can send the signal to the 3 M code.

Look at the EEPROM MAP and HCDT-Disassembly and study it carefully. LJMP and LCALL ljmp 'Jump-To' byte: 02 The ljmp Jump-to byte is represented by the hexadecimal byte 02. When the signal encounters a 02, it will immediately look at the next 2 bytes in sequence. This will be the address location that the signal will go to. 8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |...

8080: 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 00 |... Notice that starting at address 8067 you encounter a 02 byte. This tells the signal to look at the next two bytes (The next 2 bytes = 80 8 A). The signal will then skip to (jump to) the 808 A address and encounter the 99.

The above is only an EXAMPLE of how to spot the '02' and what it means, and how it works. You will not need to modify your 3 M like the above example- it is for learning purposes only. The format for the ljmp instruction is: 02 XX XX (The x's are a 2 byte address). With the ljmp instruction you can jump to the ppv area, and then jump back to any address, however the code is a little longer than when using lcall.

Here is what the code might look like before we alter it: 8332: 08 8333: E 2 8334: 79 18 8336: 47 Now let us say we want to jump to our 3 M code from address 8333 using ljmp. We will pretend our 3 M code will go at address 8333. Here is our new code with the ljmp: 8332: 08 8333: 02 80 31 -- ljmp to 8032 at address 8031 8336: 47 Since you are skipping the instructions at 8333 by putting the ljmp code there, and then skipping back to 8336, you are missing any instructions on 8333 as well as bypassing 8334 You must add those instructions (E 2 79 18) to the beginning of our 3 M code before you jump back to 8336. You must be careful when writing your jump code over original code, and also to be careful when jumping back so that you do not skip execution of any important code.

Here is our 3 M code for the ljmp beginning at address 8031: 8031: E 2 -- the instruction from 8333 8032: 79 18 -- the instruction from 8334 8034: E 4 -- 3 M code 8035: F 5 45 -- 3 M code 8037: 75 27 03 -- 3 M code 803 A: 02 83 36 -- ljmp back to address 8336 lcall The format for the lcall instruction is: 12 XX XX (the x's are a 2 byte address) When you use lcall to jump to your 3 M, the address immediately following the jump is pushed onto a stack, and you can return to that address simply by using the 1 byte instruction: 22 (return). This means you do not have a choice of where to return to, but you can do so in 1 byte. By using lcall instead of ljmp our 3 M footprint is 2 bytes smaller. A smaller footprint makes a more difficult target. However, there is no choice of a return location, making it more difficult to randomize the jump signature.

Here is the beginning EXAMPLE unmodified code: 8332: 08 8333: E 2 8334: 79 18 8336: 47 We will change the address at 8333 and use lcall to branch to our 3 M CODE we will add at address 8032: 8332: 08 8333: 12 80 32 -- lcall to 8032 8336: 47 Since you are skipping the instructions at 8333 by putting the lcall code there, and then skipping back to 8336, you are missing any instructions on 8333 as well as bypassing 8334 You must add those instructions (E 2 79 18) to the beginning of your 3 M code before you jump back to 8336. Here is our 3 M code for the lcall beginning at address 8032: 8032: E 2 -- (the instruction from 8333) 8033: 79 18 -- (the instruction from 8334) 8035: E 4 -- 3 M code 8036: F 5 45 -- 3 M code 8038: 75 27 03 -- 3 M code 803 B: 22 -- RETURN command (we do not specify a return address because instruction 22 will automatically take us to the address immediately following the lcall at address 8336) NOTE: DO NOT USE THE ABOVE EXAMPLES, OR ANY EXAMPLES IN THIS GUIDE. THE EXAMPLES CONTAIN 3 M CODE THAT IS TOO LONG, AND WILL CAUSE YOU TO GET HASHED, IT IS JUST TO HELP YOU UNDERSTAND THE CONCEPTS INVOLVED WITH LCALL AND LJMP. Jump Points The 'jump point' is a command in the program that reroutes the program operation to the PPV (or tier) area to execute the 3 m routine and turn on the video and audio for our selected channel. Hiding our 3 m routine within either the PPV or tier area is not the real problem. What you need to do is look for a routine ALWAYS gets executed when you change channels, and then locate that address to find a point where we can jump from (and back to following our 3 M code).

It also has to be an address that you can overwrite without disturbing the normal card cycle. Jump points are determined by analyzing the disassembled code that is on the card and carefully choosing a point at which to intercept program flow while at the same time keeping both security from attack and integrity of the card's routine in mind. Remember to always have a picture of the EPROM table in your head and plan on where your sections will be located. Count the bytes you need to write and make sure you can fit them in your area. It is also a good idea to take notes on what your starting addresses will be and what are the bytes you will be overwriting with your jump points.

You have to be very careful when choosing your jump points. You " ll want your jump to come back just after your orginal jump point so it does not encounter that jump again in the cycle and cause a loop. If you do not have an unlooper I would not try to many things as you will have to send your card out to a cleaner or buy an unlooper and fix your card. If you place the jump point after the return jump point at 8d 2d then you will have a continuous loop, in other words a 'looped' card. A jump point is not just any random number- it's an EEPROM address within the card where you can place a jump command, or similar instruction, to intercept the normal program flow, redirect it to your routine that forces channel authorization (known as a 3 M routine) and then jump back to a point somewhere after your jump point (again, it is not just another random address).

You have to know where to jump from, it cannot be any random address. The only way to do this is to know how the program on the card operates. If you point to an area of the card which has fixed values in every legitimate card, then every legitimate card will generate the same new 10 keys which ultimately become the correct keys used to get the video. Until you learn more about how the card operates then you can use any of the known jump points. Jump points can be tricky to pick. You must have at least SOME knowledge of what those bytes mean and how many of them go together to do something.

If you break up the 3 M code correctly the most that they can do is hashing. You need to figure out what 'jump point' addresses have been used by freeware scripts because you want to stay away from those. Get as many scripts as you can find and make a list of the jump point so you will know which ones to stay away from. Also you will want to know what addresses are SAFE to use because you don't want to 'loop' your card. Get a card's EEPROM image file open it up in a text editor (like NotePad). Disassemble it and trace the instruction 54 (which starts at 827 B).

Look at the HCDT-Disassembly and try to figure out what all of these jump points have in common, and soon you will discover private jump points of your own. To find a new jump point first find an instruction group in the original H card programming which is executed frequently (INS 54 is a good example). Next, find a set of individual code instructions that is EXACTLY 6 bytes long when complete (such as: three 2 byte instructions, OR 2 three byte instructions, OR one 3 byte instruction and three one byte instructions, etc). You may then replace the code with your 6 bytes (3 byte jump instruction and 3 random bytes).

Make sure the instructions you replace may be replicated in the 3 M (no ljmp or a calls). Then rewrite the 3 M code and include the replaced instructions, and change the jump back in the 3 M to the address 6 bytes after your replaced jump instruction. Also notice: Only 8000-8 (User area) gets hashed (the 9000's that got hashed are are 'wrap-around' addresses). If one location can not be split to make a jump then carry out the necessary bytes with your 3 M string.

A jump can always be inserted in between the code only to take it to a different location. Try to jump to a different location other then PPV (like 83 XX or Old nano area). Learn to use other ways of intercepting such as Lcall (12 address 22 for ret) Jump (80 XX for number of bytes to jump down). New ways to check for authorization, hash checking and normal writes can be created making some code obsolete. You should always keep your code to a minimum exposure to public, and keep it only to yourself. Try to avoid using public jump points and obvious bytes that shouldn't be on your card.

Avoid having empty areas that should have bytes on a normal card. USe your common sense and try to make your card appear as much like a 'normal' card as possible. REMEMBER- there are other areas to jump from aside INS 54, as evidenced on the list. You can't always simply jump back to 8d 2d, because doing so will skip over necessary code.

If you are jumping outside the ins 54 area you USUALLY need to return to the command immediately following the point you jumped from, and you will also most likely need to cycle the overwritten code back in after you jump, before the 3 M. Also- You can't use data areas as jump points because it never gets executed. A jump point has to be part of the code that gets executed every time you change a channel, and the card seeks authorization. 'Pay Per View' Area The Pay Per View Area is the part of the card where information is written to record the authorization of PPV events and movies. When you clean your card the PPV area gets wiped clean so no information is present. When the PPV area is cleaned the area is 'zeroed-out' (represented by NULL or 00 values).

The PPV area starts at 8028 and ends at 80 EF. Refer to the EEPROM MAP to find the PPV area). We can easily use the PPV area of the card to store data such as 3 M code. You can use any part of the PPV area that you want, but remember that 'valid' PPV's are 8 bytes long, so you will need to add random bytes (any number from 00 to FF) before and / or after your 3 M code in order to cloak it, as well as appear to be a valid PPV purchase. The card expects that your PPV purchases will all start at either the '0' address or the '8' address.

There are 25 PPV slots. Each PPV slot is 8 bytes long. It is a good idea to work out all of the 'jump to's' on paper prior to editing your bin, so you can mark the jumps clearly, etc.