Writing a "Private 3M Script"
First it is important to define the term "3M." The term "3M" simply refers to a script's ability to unlock all of the channels, based on the saying "All for one, and One for all!" from the "3 Musketeers," (which came from the old days of hacking cable boxes where all channels were viewable through one channel). Anyway, "3M" now is just a generic term for a card that has all channels open and no stealth or write protection. In stealth scripts, the "3M" code refers to the actual part of the code that enables the video.All scripts that open all of the channels are 3M's, however most people are referring to scripts that auto-update on their own, when they refer to a 3M. The card auto-updates because it has no commands blocked, and it appears to be a normal subbed card, as much as possible. The EASIEST type of 3M to write is to modify a valid bin file, by editing it in BasicH. Before you can write a script to modify the card, you need to be able to edit a bin file manually to make those changes. If you read through this page carefully you will find everything you need to know to modify a valid bin file with unique jump points and a 3M code. After you are done editing your valid bin file you will have a private 3M that auto-updates, with private jump points. To remove simply do a 1-STEP clean in BasicH or BasicU. If you follow the directions you should have a fairly safe 3M to use. If you have a private 3M (that does not have code in any regions that have been changed ago updates) your card would still be running today no matter HOW long they've been you installed it. They can only send a "killer" ECM that will loop your cards if they have 8 known bytes in a row that they can hash. In order to ZAP your card with an ECM your card needs to be detected as being "hacked." In order to do this they need to know you card's "signature," and your signature is based on the "extra" data that is on your card: the jump points and 3M code. If they don't know your jump points or how exactly you broke up your 3M code then it is not possible for them to target you since they won't know the "signature" of your card. The advantage of picking your own jump point is that your card's signature is different from most people's cards. They are mainly interested in hashing the most public areas to hash. If you pick the INS54 area then you can bet that a many other people have also figured out what you have. You should really try to find a jump point outside of the INS 54 area. All were after here is to make your card's signature just enough different than the freeware script users. Anything you can change will help. If you clone your card then you have 2 known bytes that will be different from your CAM ID, and those bytes are a checksum for the CAM ID. It MAY be possible that they can check those two bytes against the CAM ID to see if your card is cloned, but they haven't demonstrated that ability yet. Remember- nothing is foolproof- If your card is in the data stream taking updates, you risk an update possibly writing over part of the 3M software and corrupting your card. Nobody ever knows where the update will occur on the card.
To make things simpler to understand and follow I have color coded this page:
„h PURPLE for the 02 (jump to) code
„h BLUE for the 3M code
„h RED for the byte's ADDRESS

Understanding How Cards Work
The signal is based on packets of data which are sent along with all the video data to every receiver out there. Some of this data is filtered out before it is passed on to the smart card, such as individual unit authorizations. Of all the millions of these, only the ones for your smart card are passed on to your smart card. This is so the smart card does not get totally overloaded with messages for everyone else. Most of the other data packets DO get to your smart card.
When the signal passes through a card the following routine happens:

„h Normal Code Cycle
The DSS signal "passes thru" the card and does certain events that are important to the function of the card.
„h "INS 54" Determines Authorization
The INS 54" is the location of code on the card that determines whether or not you are authorized to view a channel, and is responsible for returning a proper value to any authorization requests.
„h Normal Code Cycle
The signal comes back from the the "INS 54" area and either authorizes or turns off the signal, based on what value was returned.
When the signal passes through a card that has 3M code on it the following routine happens:

„h Normal Code Cycles
The DSS signal "passes thru" the card and does certain events that are important to the function of the card.
„h Jump to Fake Authorization or "3m code"
The card "jumps" from the "INS 54" area to an address you have specified that has your 3M code. The 3M code "tricks" the card in to thinking that the authorization is present by giving it a ZNT of it's own, and then returning the proper answer, which allows all of the channels to be unlocked (this is the JUMP POINT).
„h Jump back from the "3M code"
The 3M code jumps back to the address you have specified at the end of the "INS 54" area: 8D2D
„h Normal Code Cycles
The signal authorizes the signal for all channels based on what was returned from the Fake ZNT or "3M code."
The area of the card that is checked to see if the channel has authorization is called "INS 54." That area in the card's EEPROM is 827B-8D2D. That's why most, but not all, jump points are placed with in that area. Whenever you change the channel the card checks the "INS 54" area of the card to check and see if that channel is authorized. When the "check command" reaches your JUMP POINT it jumps out of "INS 54" directly to wherever your 3M code starts. the signal then bounces around to your selected "jump to" addresses and reads the 3m code (which fools it into thinking that the channel is authorized). The signal then jumps back to the last byte of INS 54 which is 8D2D where it continues it's normal cycle. During in all of this the card actually thinks it was always in the "INS 54" area of the card, even though it jumped out and back again. The instruction that is CRITICAL to learn about for writing 3M's is "INS 54". You should trace its path as far as possible in both directions so you can try to understand it completely. Not all jump points have to be within the INS54 handling routine from 8D03-8D2F (or 8D65) But, it is the INS54 that's the instruction sent when you change channels that returns authorization, so you'll probably want to intercept that instruction somewhere.
Understanding Address Locations
To gain a better understanding of address locations open BasicH and load a .bin file. Clean to USW 26 and look at the BasicH output screen:
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII

8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 XX 00 | ................
8030 is the address location of the 1st byte of data which is represented in hexadecimal format. As an example to help you better understand the addresses the address location of the byte represented by XX is 805E. You will not need to modify your 3M like the above example- it is for learning purposes only.
The datastream passes through your card and goes through it's normal code cycle at 8D17, then it hits 8D1A. 8D1A is the ZNT (Zero Number Test) which is used in authorization of the channels. You simply want to alter the code so that we can send the signal to the 3M code. Look at theEEPROM MAP and HCDT-Disassembly and study it carefully.
LJMP and LCALL
ljmp "Jump-To" byte: 02
The ljmp Jump-to byte is represented by the hexadecimal byte 02. When the signal encounters a 02, it will immediately look at the next 2 bytes in sequence. This will be the address location that the signal will go to.
To help you understand the "ljmp" command look at the following example:
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII

8060: 00 00 00 00 00 00 00 02 80 8A 00 00 00 00 00 00 | ................
8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8080: 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 00 | ................
Notice that starting at address 8067 you encounter a 02 byte. This tells the signal to look at the next two bytes (The next 2 bytes = 80 8A). The signal will then skip to (jump to) the 808A address and encounter the 99. The above is only an EXAMPLE of how to spot the "02" and what it means, and how it works. You will not need to modify your 3M like the above example- it is for learning purposes only.
The format for the ljmp instruction is:
02 XX XX (The x's are a 2 byte address).
With the ljmp instruction you can jump to the ppv area, and then jump back to
any address, however the code is a little longer than when using lcall.
Here is a jump code (to address 8032):
8D1B: 02 80 32 <-- ljmp to address 8032
Here is the 3m code at address 8032 and the jump back to 8D1B:
8032: E4 <-- 3M code
8033: F5 45 <-- 3M code
8035: 75 27 03 <-- 3M code
8038: 02 8D 1B <-- ljmp back to address 8DIB
Let me give another example. Here is what the code might look like before we alter it:
8332: 08
8333: E2
8334: 79 18
8336: 47
Now let us say we want to jump to our 3M code from address 8333 using
ljmp. We will pretend our 3M code will go at address 8333.
Here is our new code with the ljmp:
8332: 08
8333: 02 80 31 <-- ljmp to 8032 at address 8031
8336: 47
Since you are skipping the instructions at 8333 by putting the ljmp code there, and then skipping back to 8336, you are missing any instructions on 8333 as well as bypassing 8334 You must add those instructions (E2 79 18) to the beginning of our 3M code before you jump back to 8336.You must be careful when writing your jump code over original code, and also to be careful when jumping back so that you do not skip execution of any important code.
Here is our 3M code for the ljmp beginning at address 8031:
8031: E2 <-- the instruction from 8333
8032: 79 18 <-- the instruction from 8334
8034: E4 <-- 3M code
8035: F5 45 <-- 3M code
8037: 75 27 03 <-- 3M code
803A: 02 83 36 <-- ljmp back to address 8336
lcall
The format for the lcall instruction is: 12 XX XX (the x's are a 2 byte address)
When you use lcall to jump to your 3M, the address immediately following the jump is pushed onto a stack, and you can return to that address simply by using the 1 byte instruction: 22 (return). This means you do not have a choice of where to return to, but you can do so in 1 byte.
By using lcall instead of ljmp our 3M footprint is 2 bytes smaller. A smaller footprint makes a more difficult target. However, there is no choice of a return location, making it more difficult to randomize the jump signature.
Here is the beginning EXAMPLE unmodified code:
8332: 08
8333: E2
8334: 79 18
8336: 47
We will change the address at 8333 and use lcall to branch to our 3M CODE we will add at address 8032:
8332: 08
8333: 12 80 32 <-- lcall to 8032
8336: 47
Since you are skipping the instructions at 8333 by putting the lcall code there, and then skipping back to 8336, you are missing any instructions on 8333 as well as bypassing 8334 You must add those instructions (E2 79 18) to the beginning of your 3M code before you jump back to 8336. You must be careful when writing
your jump code over original code, and also to be careful when jumping
back so that you do not skip execution of any important code.
Here is our 3M code for the lcall beginning at address 8032:
8032: E2 <-- (the instruction from 8333)
8033: 79 18 <-- (the instruction from 8334)
8035: E4 <-- 3M code
8036: F5 45 <-- 3M code
8038: 75 27 03 <-- 3M code
803B: 22 <-- RETURN command (we do not specify a return address because instruction 22 will automatically take us to the address immediately following the lcall at address 8336)
NOTE: DO NOT USE THE ABOVE EXAMPLES, OR ANY EXAMPLES IN THIS GUIDE. THE EXAMPLES CONTAIN 3M CODE THAT IS TOO LONG, AND WILL CAUSE YOU TO GET HASHED, IT IS JUST TO HELP YOU UNDERSTAND THE CONCEPTS INVOLVED WITH LCALL AND LJMP.
Jump Points
The "jump point" is a command in the program that reroutes the program operation to the PPV (or tier) area to execute the 3m routine and turn on the video and audio for our selected channel. Hiding our 3m routine within either the PPV or tier area is not the real problem. What you need to do is look for a routine ALWAYS gets executed when you change channels, and then locate that address to find a point where we can jump from (and back to following our 3M code). It also has to be an address that you can overwrite without disturbing the normal card cycle. Jump points are determined by analyzing the disassembled code that is on the card and carefully choosing a point at which to intercept program flow while at the same time keeping both security from attack and integrity of the card's routine in mind. Remember to always have a picture of the EPROM table in your head and plan on where your sections will be located. Count the bytes you need to write and make sure you can fit them in your area. It is also a good idea to take notes on what your starting addresses will be and what are the bytes you will be overwriting with your jump points.
You have to be very careful when choosing your jump points. You'll want your jump to come back just after your orginial jump point so it does not encounter that jump again in the cycle and cause a loop. If you do not have an unlooper I would not try to many things as you will have to send your card out to a cleaner or buy an unlooper and fix your card. If you place the jump point after the return jump point at 8d2d then you will have a continuous loop, in other words a "looped" card.
A jump point is not just any random number- it's an EEPROM address within the card where you can place a jump command, or similar instruction, to intercept the normal program flow, redirect it to your routine that forces channel authorization (known as a 3M routine) and then jump back to a point somewhere after your jump point (again, it is not just another random address). You have to know where to jump from, it cannot be any random address. The only way to do this is to know how the program on the card operates. If you point to an area of the card which has fixed values in every legitimate card, then every legitimate card will generate the same new 10 keys which ultimately become the correct keys used to get the video.
Until you learn more about how the card operates then you can use any of the known jump points. Jump points can be tricky to pick. You must have at least SOME knowledge of what those bytes mean and how many of them go together to do something. If you break up the 3M code correctly the most that they can do is hashing. When choosing a PRIVATE jump point it would be best to avoid one of these jump points for your private 3M, since they are known and used by freeware, and have been targets of hashing:
8250-8257
8260-8267
8278-827F
8560-8567
8590-8597
8658-865F
8688-868F
8690-8697
8860-8867
8980-8987
89A0-89A7
89B0-89B7
89B8-89BF
8CF8-8CFF
8D00-8D07
8D08-8D0F
8D18-8D1F
8D60-8D67
8F28-8F2F
99A0-99A7 (wrap around address for 89A0 to 89A7)
9D00-9D07 (8D00-8D07)
Update 0001h/1 (8568h-856Bh)
Update 0002h/2 (8FF1h-8FF4h)
Update 0003h/3 (8FF5h-8FF8h)
Update 0004h/4 (8FF9h-8FFCh)
Update 0005h/5 (84F8h-84FBh)
Update 0006h/6 (8588h-858Bh)
Update 0007h/7 (8670h-8673h)
Update 0008h/8 (8460h-8465h)
Update 0009h/9 (8605h-860Ah)
Update 000Ah/10 (8F3Bh-8F46h)
Update 000Bh/11 (8F2Fh-8F3Ah)
Update 000Ch/12 (8F47h-8F52h)
Update 000Dh/13 (8F53h-8F5Eh)
Update 000Eh/14 (8F5Fh-8F5Fh)
Update 000Fh/15 (8965h-8966h)
Update 0010h/16 (8BA5h-8BAAh)
Update 0011h/17 (8F60h-8F68h)
Update 0012h/18 (865Ch-8660h)
Update 0013h/19 (8297h-8297h)
Update 0014h/20 (8F44h-8F44h)
Update 0015h/21 (858Bh-8592h)
Update 0016h/22 (8F70h-8F78h)
Update 0017h/23 (8C05h-8C06h)
Update 0018h/24 (8F79h-8F7Fh)
Update 0019h/25 (85D0h-85D1h)
Update 001Ah/26 (8591h-8594h)
Update 001Bh/27 (8F80h-8F86h)
Update 001Ch/28 (85D0h-85D7h)
Update 001Dh/29 (85CAh-85CBh)
Update 001Eh/30 (8660h-8667h)
Update 001Fh/31 (85D0h-85D7h)
Update 0020h/32 (8658h-865Fh) same as 18
Update 0021h/33 (8687h-8692h)
Update 0022h/34 (8702h-870Dh)
Update 0023h/35 (8693h-869Eh)
Update 0024h/36 (86F6h-8701h)
Update 0025h/37 (8762h-876Dh)
Update 0026h/38 (8732h-873Dh)
Update 0027h/39 (870Eh-8719h)
Update 0028h/40 (869Fh-86AAh)
Update 0029h/41 (86B7h-86C2h)
Update 002Ah/42 (86CFh-86D9h)
Update 002Bh/43 (8867h-8872h)
Update 002Ch/44 (874Ah-8755h)
Update 002Dh/45 (885Bh-8866h)
Update 002Eh/46 (86ABh-86B6h)
Update 002Fh/47 (871Ah-8725h)
Update 0030h/48 (85CFh-85D3h)
Update 0031h/49 (8756h-8761h)
Update 0032h/50 (86C3h-86CFh)
Update 0033h/51 (873Eh-8749h)
Update 0034h/52 (8709h-8710h)
Update 0035h/53 (888Bh-8896h)
The hard part is figure out what address you can use and have the card still work. You need to figure out what "jump point" addresses have been used by freeware scripts because you want to stay away from those. Get as many scripts as you can find and make a list of the jump point so you will know which ones to stay away from. Also you will want to know what addresses are SAFE to use because you don't want to "loop" your card. Get a card's EEPROM image file open it up in a text editor (like NotePad). Disassemble it and trace the instruction 54 (which starts at 827B). Look at the HCDT-Disassembly and try to figure out what all of these jump points have in common, and soon you will discover private jump points of your own. To find a new jump point first find an instruction group in the original H card programming which is executed frequently (INS54 is a good example). Next, find a set of individual code instructions that is EXACTLY 6 bytes long when complete (such as: three 2 byte instructions, OR 2 three byte instructions, OR one 3 byte instruction and three one byte instructions, etc). You may then replace the code with your 6 bytes (3 byte jump instruction and 3 random bytes). Make sure the instructions you replace may be replicated in the 3M (no ajmp or acalls). Then rewrite the 3M code and include the replaced instructions, and change the jump back in the 3M to the address 6 bytes after your replaced jump instruction. Also notice: Only 8000-8FFF (User area) gets hashed (the 9000's that got hashed are are "wrap-around" addresses). If one location can not be split to make a jump then carry out the necessary bytes with your 3M string. A jump can always be inserted in between the code only to take it to a different location. Try to jump to a different location other then PPV (like 83XX or Old nano area). Learn to use other ways of intercepting such as Lcall (12 address 22 for ret) Sjump (80 XX for number of bytes to jump down). New ways to check for authorization, hash checking and normal writes can be created making some code obsolete. You should always keep your code to a minimum exposure to public, and keep it only to yourself. Try to avoid using public jump points and obvious bytes that shouldn't be on your card. Avoid having empty areas that should have bytes on a normal card. USe your common sense and try to make your card appear as much like a "normal" card as possible. REMEMBER- there are other areas to jump from aside INS 54, as evidenced on the list. You can't always simply jump back to 8d2d, because doing so will skip over necessary code. If you are jumping outside the ins54 area you USUALLY need to return to the command immediately following the point you jumped from, and you will also most likely need to cycle the overwritten code back in after you jump, before the 3M. Akso- You can't use data areas as jump points because it never gets executed. A jump point has to be part of the code that gets executed every time you change a channel, and the card seeks authorization.
"Pay Per View" Area
The Pay Per View Area is the part of the card where information is written to record the authorization of PPV events and movies. When you clean your card the PPV area gets wiped clean so no information is present. When the PPV area is cleaned the area is "zeroed-out" (represented by NULL or 00 values). The PPV area starts at 8028 and ends at 80EF. Refer to the EEPROM MAP to find the PPV area). We can easily use the PPV area of the card to store data such as 3M code. You can use any part of the PPV area that you want, but remember that "valid" PPV's are 8 bytes long, so you will need to add random bytes (any number from 00 to FF) before and/or after your 3M code in order to cloak it, as well as appear to be a valid PPV purchase. The card expects that your PPV purchases will all start at either the "0" address or the "8" address. There are 25 PPV slots. Each PPV slot is 8 bytes long. The first PPV slot is "8028-802F," the second slot is "8030-8037," the third slot is "8038-803F," and so on.
It is a good idea to work out all of the "jump to's" on paper prior to editing your bin, so you can mark the jumps clearly, etc.. Here is a PPV area scratch pad for you to work from:
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII

8020: 00 00 00 00 00 00 00 00 | ................
8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
PRINT OUT THE ABOVE WORKSHEET TO MAP OUT YOUR JUMP POINTS PRIOR TO EDITING YOUR BIN
REMEMBER
„h The PPV (and tier area) are not where you put your jump point. These are the areas that the 3m activation routine is stored.
„h It is best not to have the jump to addresses overlap across the "07" and "08" address, UNLESS you fill in the entire line with additional random bytes to make it appear as 2 purchases.
„h You should also never start your 3M code on a 0 or an 8 in order to hide your code from the checking routine.
„h Make the 80x6 and 80xE addresses appear to be valid PPV purchases.


Here are a few examples of "valid" PPV purchases:
87 D9 69 D8 01 8F 01 00
8A C8 69 D8 01 8F 01 00
8B B6 69 D8 01 8F 01 00
81 1E 69 DA 01 8F 01 00
83 4C 69 D9 01 8F 01 00
81 DD 69 DA 01 8F 01 00
85 13 69 D8 01 8F 01 00
81 E9 69 DA 01 8F 01 00
81 52 69 DA 01 8F 01 00
81 9A 69 DA 01 8F 01 00
8E F3 69 D9 04 4B 01 00
81 12 69 DA 01 8F 01 00
83 E9 69 D8 01 8F 01 00
83 1D 69 DA 01 8F 01 00
82 89 69 DA 01 8F 01 00
82 7D 69 DA 01 8F 01 00
81 3B 69 DA 01 8F 01 00
81 6E 69 DA 01 8F 01 00
81 CB 69 D9 01 8F 01 01
91 07 69 D7 01 F3 01 01
8E CB 69 D7 03 1F 01 01
8E E9 69 D7 04 4B 01 01
8F 4B 69 D7 03 83 01 01
90 16 69 D7 03 83 01 01
80 FC 69 D9 07 CB 01 01
81 11 69 D9 01 8F 01 01
81 1D 69 D9 01 8F 01 01
81 2A 69 D9 01 8F 01 01
81 51 69 D9 01 8F 01 01
81 6D 69 D9 01 8F 01 01
81 82 69 D9 01 8F 01 01
81 E8 69 D9 01 8F 01 01
82 F2 69 D9 01 8F 01 01
83 41 69 D7 01 8F 01 01
85 03 69 D7 01 8F 01 01
88 A7 69 D7 01 8F 01 01
8C 8F 69 D7 01 8F 01 01
8D E1 69 D7 03 E7 01 01
8C 7A 69 D8 04 AB 09 01
82 88 69 D9 01 8F 00 01
85 9C 69 D7 01 8F 00 01
00 59 6B C1 22 C4 09 01
90 29 69 D8 03 83 01 00
You will note that the above PPV code has many addresses that are roughly the same, and once in awhile a few oddballs. The most important ones to keep the same are the beginning (1 or 8 ppv address slots) and the end (7 or F address slots). The best thing to do is get your own PPV examples to work from, so you can see the code for yourself. Load an activation script on your card, and purchase a few PPV's and you will notice that they will follow the above patterns with few exceptions.
Some people have noticed that a while after they install the P3M on their card that one of the "random" bytes, or one of their 3M string changed to an 06. If you clear the byte and put the card back in the IRD and check it again a few minutes later it is back to 06, 20 or 26. This sometimes results in the 3M code failing to authorize the channel (call Ext. error) or even a fake Ext. 745 error. The "PPV status byte" is changing. Changes to bytes at XX06h and XX0Eh in the PPV area only occur when certain bit patterns exist in those locations. Some bytes are fine, others are not. Look at a valid PPV string to see what the card "needs" to see at certain addresses. Storing anything in the PPV area without knowing exactly how it is affected by the card could be dangerous. Some cards have been looped by having these bytes change.
Many other instructions can and have been changed, sometimes resulting in the 3M code failing to authorize the channel (call Ext. 721, 711, etc.) all the way to a fake Ext. 745 error being generated.
The BEST way to avoid this is to break up the 3M string and jump from chunk to chunk. You'll have to know the instructions so as not to break apart an instruction and its parameters. If you do this you may have to fix part of your 3M code if it supports locks/limits via a 20 4E xx type instruction. Instruction 20 is JB (Jump if bit set) and has a relative address as a parameter that normally jumps XX bytes ahead if bit 4E is set. If you move the bytes after that command around, it may be more bytes away and you'll need to correct this.
What is happening is the card is updating the status of what it thinks is a valid PPV entry. The card has logic to set status bits to indicate what state the PPV is in. They are being updated by cmd18 which gets called from instruction 36 and command 29/49. Instruction 36 is called to get card info, probably for delivery of info via phone line if connected. Cmd 29/49 seems to be related to buying/viewing PPV.
It only affects the 80x6 and 80xE addresses of the PPV area. The offending routine that writes the x6's looks like it's Cmd18/MatchFound/Ins46 at 165Bh in the ROM specifically with the four instructions at 1682h. When it gets to this section of the routine, it sets bits 1 and 2 of the 7th byte of the PPV slot (80x6 and 80xE), but it would seem to avoid that area of the code completely if both bits 0 and 1 are already set (i.e. second digit = 3, 7, B, or F). Now, depending on how it gets there, it may skip over it if only one or the other is set.
The PPV area is touchy, which is why most scripts restrict their code to the tier area, which is not affected by normal operations of the card. Addresses in the PPV area that end in 06h or 0Eh could be modified (depending on exactly what the value in those locations is) Your best bet is to be aware of the fact when constructing a 3M string in the PPV area, and either work around it (you could skip over the 06h/0Eh addresses by SJMP'ing over them) or only use the tier area.
If you decide to use the tier area, you aren't disabling processing of the deferred command buffer (i.e., a simple 3M that is stored in the tier area), then it is conceivable for it to be affected by a packet containing special Cmd41 or Cmd42 entries ("Add or update tier" or "Drop tier" commands). You can also prevent tier wipes by corrupting the global key Group Key 0.
3m Code
The 3m Code we will be using includes the following sequence of bytes:
75 27 03 20 4E 08 E4 F5 45 028D 2D
There are many combinations and variations you can use. If you don't use the locks & limits you can use the following 3M code:
E4 F5 45 75 27 03 028D 2D
If you DO want the locks & limits use this code:
20 4E 06 E4 F5 45 75 27 028D 2D
The byte 02 means "ljmp" or "JUMP TO," and the address that follows is "8D 2D," which means that our 3M code returns back to the 8D 2D address. Until you become more advanced at writing 3M's you MUST jump from "8D 1A", and you MUST jump back to "8D 2D."
The 3M code can be broken up into parts:
„h Part 1 : 75 27 03
„h Part 2: 20 4E 08
„h Part 3: E4
„h Part 4: F5 45 028D 2D
We do this because it makes it harder for your test card to be looped, hashed, or destroyed, since ECM's are hashed on a basis of 8 bytes, so we split our code to avoid this. You can split up your 3M code as much as you want, jas long as the bytes are in order.
Writing the 3M code to your Card using "LCall" and jump points
Note: Do NOT use the addresses that we use in this example if you want to be private! In other words, choose your own random points to jump to.
In the Basic H screen dump you will notice at 8D1A the bytes = 20 38 10. You need to change this value to include a jump to and the address you want to jump to. 20 38 10 will now be replaced with 02 XX XX (XX XX = The address location of your 3m code)
It is safest to use the PPV area to store your 3M code at first. The PPV area is between addresses 8028 - 80EF.
Aside from 8D1A other known jump FROM points are: 8D11, and 8D20. Experiment a bit, and you can find your own spot to jump FROM to make your 3M TOTALLY private.
As mentioned earlier, you can break the 3m code up into parts, and jump around to addresses within different areas of the PPV area.
(NOTE: THE FOLLOWING IS AN EXAMPLE ONLY! DO NOT USE THIS EXAMPLE!! MAKE ONE OF YOUR OWN TO AVOID BEING TARGETED BY DTV!)
Start BasicH and insert your card in to your programmer. Read your EEPROM and save your bin file, and remove your card. Load a VALID .bin file into BasicH and clean it to 26 updates by clicking on the AMBULANCE icon (clean EEPROM in memory), and selecting "clean to 26 updates". Enable Edit mode in BasicH. NOTE: You are editing the bin file in memory, and not the card itself! Be careful when editing the bin file to make sure you are editing the CORRECT addresses.


„h Replace the code at 8D1A with "0280 61" (jump to address 8061)
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8D10: 00 00 00 00 00 00 00 00 00 00 02 80 61 00 00 00 | ................
„h At address 8061 write "75 27 03 02 80 51" (First part of the 3M & jump to 8051)
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8060: 00 75 27 03 02 80 51 00 00 00 00 00 00 00 00 00 | ................
„h At address 8051 write "20 4E 08 02 80 49" (Second part of the 3M and jump to 8049)
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8050: 00 20 4E 08 02 80 49 00 00 00 00 00 00 00 00 00 | ................
„h At address 8049 write "E402 80 31" (Third part of the 3M and jump to 80D3)
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8040: 00 00 00 00 00 00 00 00 00 E4 02 80 31 00 00 00 | ................
„h At address 8031 write "F5 45 02 8D 2D" (fourth part of the 3M and jump back to 8D2D to continue the normal code cycle)
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8030: 00 F5 45 02 8D 2D 00 00 00 00 00 00 00 00 00 00 | ................
Now your edited bin should look something like this:
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8020: 00 00 00 00 00 00 00 00 | ................
8030: 00 F5 45 02 8D 2D 00 00 00 00 00 00 00 00 00 00 | ................
8040: 00 00 00 00 00 00 00 00 00 E4 02 80 31 00 00 00 | ................
8050: 00 20 4E 08 02 80 49 00 00 00 00 00 00 00 00 00 | ................
8060: 00 75 27 03 02 80 51 00 00 00 00 00 00 00 00 00 | ................
8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
8D10: 00 00 00 00 00 00 00 00 00 00 02 80 61 00 00 00 | ................
(note: at line 8D10 in this example, do NOT change the other addresses to "0"'s,
just change the address at 8D1A. Again- this is an EXAMPLE- design your own!).
NOTE: It is also a good idea to add random bytes (any hex number from 00 to FF) BEFORE and AFTER your 3M code to further "stealth" the code. For example: the first part of our 3M code would look like:
XX 75 27 03 0280 A3 XX
The XX's represent random hexidecimal bytes (any hex number from 00 to FF), and the first set of random bytes would start one address earlier than our jump point, and the last set of random numbers would be at the address after our "jump back to" address (in the above example the "jump back to" address is "80A3"). For example: If our "jump to address was "8005," and we are adding ONE set of random bytes before the jump address then the random bytes would go at 8004." PPV code is displayed as sets of 8 bytes, so remember to add only enough random code to bring the string to 8 bytes. Remember, bytes are sets of 2 numbers, so 00 00 00 is 3 bytes.
let's say we want to put the 1st part of the code at 8061:

Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8060: 00 75 27 03 02 80 51 00 00 00 00 00 00 00 00 00 |
We would want our string to be eight bytes long, and the 1st part of our 3M (with the jump command and address) is only 6 bytes long, so we add a random byte (any number from 00 to FF) BEFORE our 3M code at address 8061, and another random byte AFTER our 3M code, at 8066 and 8067. At a glance it appears to be a "valid" PPV purchase which are 8 bytes long. KEEP IN MIND WHAT A "VALID" PPV PURCHASE LOOKS LIKE!
Here is what the 1st part of our 3M code a 8061, with RANDOM BYTES added will look like:

Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8060: XX 75 27 03 02 80 51 XX 00 00 00 00 00 00 00 00 |
Now your edited bin WITH RANDOM BYTES should look something like this:
Addr: 0 1 2 3 4 5 6 7 8 9 A B C D E F | ASCII
8020: 00 00 00 00 00 00 00 00 | ................
8030: XX F5 45 02 8D 2D XX XX 00 00 00 00 00 00 00 00 | ................
8040: 00 00 00 00 00 00 00 00 XX E4 02 80 31 XX XX XX | ................
8050: XX 20 4E 08 02 80 49 XX 00 00 00 00 00 00 00 00 | ................
8060: XX 75 27 03 02 80 51 XX 00 00 00 00 00 00 00 00 | ................
8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
80E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
8D10: 00 00 00 00 00 00 00 00 00 00 02 80 61 00 00 00 | ................

XX= random bytes
REMEMBER: Never start your 3M code on a 0 or an 8 address, and if it crosses the "border" between the two address be sure to fill in the bytes to make it look like a valid PPV purchase. The best thing to do is to either use the above examples, or load an activation script on your card and "buy" some PPV's and look at the code in BasicH. When constructing your own jump to areas in the PPV, keep in mind that it fills in slot one, then slot two, and so on until 25, so it is best to avoid large gaps like in the above example. Also, if your 3M string ends on a 7 you may have problems. Also try to follow the pattern that the card expects to see in the PPV area, by referring to the above examples.
Again, the card expects that your PPV purchases will all start at either the "0" address or the "8" address. There are 25 PPV slots. Each PPV slot is 8 bytes long, so it is best not to have the jump points overlap across the "07" and "08" address, unless you fill in the entire line with additional random bytes to make it appear as 2 purchases. The first slot is "8028-802F," the second slot is "8030-8037," the third slot is "8038-803F," and so on.
Disable "Edit Mode" and save the edited bin with a different name. Clean your card with a One-Step clean with BasicH, twice to 26 updates, or until zero file differences. Then write the modified bin to your card (NOTE: do not clean the bin after you have modified it or you will lose your jump point data in the PPV area- clean the bin BEFORE you modify it). Next use WHISPER, which is a script that will activate your card, but it won't work unless you have a modified bin. It is possible to edit your bin manually to include this data, however it is not necessary. Reboot your IRD, insert your card and watch TV!

Understanding Packets (advanced)
The DTV system is based on packets of data which are sent along with all the video data to every receiver out there. Some of this data is filtered out before it is passed on to the smart card, such as individual unit authorizations. Of all the millions of these, only the ones for your smart card are passed on to your smart card. This is so the smart card does not get totally overloaded with messages for everyone else. Most of the other data packets DO get to your smart card. There are dozens of types of data packets, but only a few are of vital importance.
The first vital packet is the 4840 packet, which is what you get immediately after you tune to a new channel (and at regular periods afterwards too) An example could look like this:
48 40 00 00 XX 40 09 10 10 00 01 4A 12 34 02 41 03 33 42 00 0C AA BB CC DD EE
Let's break this down:

„h 48 40 00 00 XX

Here 48 40 describes the type of packet and the XX is the number of bytes to follow
„h 40 is an echo of the packet type back to the receiver to show the smart card is working
„h 09 10 10 00 Here 09 is the command to set the key to be used in all subsequent decryption routines. In this case, key 10 is pointed to, which is a generic key shared by all smart cards. The smart card uses an algorithm which generates 10 bytes every time it is called. It uses the previous value for these 10 bytes and a new value found in the "A register" or accumulator. Once the 09 command has been issued, almost every byte read in after that goes through this algorithm and so causes a new set of 10 bytes to be generated. So the only time you can predict in advance what these 10 bytes are is just after the 09 command has been issued. The algorithm is complex enough that trying to calculate the correct result would take years of processing even with a super-computer.
„h 01 4A 12 34 Here 01 is the command to load the time and date, where 4A would be the month and 12 34 the digital hour, minute (not directly related to our 24 hour clock). You should note following the above description of the 10 byte key process that reading in these 4 bytes causes a unique new set of 10 keys to be created after each of the 4 bytes is read in so any attempt to intercept and modify these dates causes the wrong 10 bytes to be created.
„h 02 41 Here 02 is the command to load the program rating and the viewing status. The 1st digit '4' means you need a subscription to watch, it would be '8' if it was a preview or free. The 2nd digit is the parental rating. It should be repeated that any attempt to change the '41' (you need a subscription) to '81' (you can watch for free) will also generate the wrong 10 keys.
„h 03 33 42 00 Here 03 is the command to check the subscription list in the smart card to see if the smart card is valid for channel 3342 at this time. So here is where the smart card response starts to change depending on whether it does have a valid entry for channel 3342 or not. Again, you can't intercept and change the data from the 3342 that the system demands you have to a different number that you know your smart card does have without creating the wrong 10 keys. This 03 command can be repeated a number of times because any channel may have more than one channel identifier that it will accept. (This is to simplify selling packages of channels without needing a unique subscription for every single channel). On a Pay-Per-View movie (PPV) the 03 command is replaced by an 06 command but the end result is the same.
„h 0C AA BB CC DD EE Here 0C is the command to check the integrity of all the received data, everything that is after the initial 09 command was issued, right up to and including the final byte 'EE'. As explained, every single byte read causes yet another call to the decryption algorithm to generate yet another new set of 10 keys. The purpose of the 'AA BB CC DD EE' is that these 5 bytes are checked against the first 5 bytes of these newly created 10 keys and all 5 of them must match exactly. If they do not, because of noise say, or because the data was intercepted and altered, then no match occurs and the process which generates the correct video keys will not execute. You can't guess these 5 numbers as there are 256*256*256*256*256 possibilities (which is a lot)


That is the end of the 4840 packet. The smart card goes back to idle waiting for the next packet. What it is has stored however, is a set of 10 keys and a status for whether it is allowed to watch this channel or not. The receiver as yet does not know what this status is, so no video is being shown.
Almost immediately after this comes the next vital packet, 4854. This has a simpler format: 48 54 00 00 00 with nothing else to follow. The smart card recognizes the 48 54 type and echoes the 54 back. Then it uses the status it created with the '4840 packet' to generate a further version of the 10 keys. It crunches them through the on-die ASIC so that a pure software emulator can't be used. Then it does a final software encryption and sends the resulting 10 keys over to the receiver, together with the status info. What is vital is that the correct 10 keys are only sent if the accompanying status shows the smart card is valid for that channel at that time. Otherwise, a different set of 10 keys will be sent, created earlier by the '484A packet', and these will NOT result in any video.
These 10 keys are then fed to the MPEG decoder to sort out the video which will be turned on if the sequence is correct. (The audio is not encrypted, it will be turned on if the correct status is sent even if the wrong keys are sent)
You should have learned by now that
¡P     These two packets are crucial
¡P     If you change ANY byte between the 09 command in the 4840 packet and the last byte of the 4840 packet, you will generate the wrong 10 keys and get no video/audio.
You can add other commands in the 4840 packet than the simple 01 (time) 02 (rating) and 03 (subscription), as long as the correct final 5 bytes are calculated by the system to generate the required 10 keys correctly. You can, for example, include a 60 command, followed by a sub command string B5.
60 B5 03 81 23 01
What this does is cause yet another new set of the 10 keys to be created 8 times, one for every value it finds in the EEROM at location 8123. You can specify the number of 8 byte blocks to check (the example shows 01 for 1 block) and you can specify a list of addresses to check. The actual address would not be 8123 but another address (or list of addresses) in the 8XXX area which corresponds to code altered by 'pirates'.
If you point to an area of EEROM (or ROM for that matter) which you know has fixed values in every legitimate card, then every legitimate card will generate the same new 10 keys which ultimately become the correct keys used to get the video. If any 'pirate' cards have different code in that area, then they will generate different 10 keys and get no video. They won't be damaged, they simply won't work! Because you can use a list to specify addresses to check, you can with a few short key strokes cover most of the so-called free space where any 3M type routines might be written.