VIACCESS

Пока доступна только версия на английском языке, если кто горит желанием - переведите буду рад. 

0. Disclaimer
==========
This document is provided as is and is for education only.
I am not responsible for any damage, loose of money, ...

Hop you will enjoy it ( the FAQ ).

1. What is Viaccess ?
================
The Viaccess is a scrambling system which is used in Digital Pay TV.
There is actually three "Bouquets" which use the Viaccess :
- TPS ( Television Par Satellite ) from France
- ABSAT & CANALSATELLITE(simulcrypt) from France
- SSR from Switzerland
The Viaccess is simply the new name of D2MAC but for Digital (DVB) purpose. As you will see in chapter 2, the instruction seems to be the same.
For testing you can insert a Viaccess Smartcard into a D2MAC descrambler.
You will be able to use any menu of the decoder to view the card content.

- Sagem

- XCOM
Sagem is used by TPS and is the only decoder which can operate at the moment.
XCOM is used by ABSAT and CANALSATELLITE (simulcrypt).

2. Protocol
========
Data exchange between decoder and smartcard follow this specification :

CLASS INSTRUCTION PARAMETER1 PARAMETER2 LENGTH

CLASS : For Viaccess it is CA and 87 ( like D2MAC )
Every scrambling method have an inscruction class.

INSTRUCTION : Set of instruction ( operation ) which allow the decoder

to ask the card for anything.

PARAMETER1
PARAMETER2 : These parameter are used for example to specify a key or
other information.

LENGTH : Is the length of the data transfer : number of byte to be
send or receive from / to card for one sigle instruction.

All the following have been tested with a Sagem decoder.
The data speed is 9600 bauds ( exactly like D2MAC )

--------

INSTRUCTION
-----------
02 : Direction : D-t-C ( Decoder to Card )
Meaning : General purpose data
To do : Read LENGTH byte 
04 : Direction : C-t-D ( Card to Decoder )
Meaning : Return the requested data from General purpose
To do : Send to the decoder :
00 00 00 09 00 00 00 ; 90 00

06 : Direction : C-t-D ( Card to Decoder )
Meaning : Return a requested data (?)
Special : The length of byte sent from the card is equal
to the 4th byte send in instruction 04.
To do : Send to the decoder :
10 02 CA 20 11 03 54 50 53 ; 90 00
CLASS CA
--------

INSTRUCTION
-----------
A4 : Direction : D-t-C ( Decoder to Card )
Meaning : Select a specific card information depending of the
PARAMETER1 content :
00 : Select Issuer
02 : Select next Issuer
Special : The requested information is send back with the
instruction C0.
To do : Send to the decoder :
90 00

C0 : Direction : C-t-D ( Card to Decoder )
Meaning : Return the requested information selected with the
instruction A4.
To do : depend from preview A4 instruction :
00 : send to the decoder :
FF F4 00 20 00 00 1F 74 1A 20 00 01
FF FF 04 05 FF 28 ; 90 00
02 : send to the decoder :
00 7C 08 20 00 BF 1F 1C 1A 20 00 01
FF FF FF 08 FF FF FF FF FF FF FF ; 90 00

AC : Direction : D-t-C ( Decoder to Card )
Meaning : Select an information into the card depending of
PARAMETER1 content :
A4 : Select UA
A5 : Select SA
A9 : List Subscribe
Special : The requested information is send back with the
instruction B8.
Each issuer has is own SA / UA.
To do : Send to the decoder :
90 00 for any PARAMETER1 except for A9.
For A9 read LENGTH byte.


B8 : Direction : C-t-D ( Card to Decoder )
Meaning : Return the requested information selected with the
instruction AC.
To do : depend from preview AC instruction :
A4 : send to the decoder :
A4 05 xx xx xx xx xx ; 90 08
xx represent the card serial number
A5 : send to the decoder :
A5 04 xx xx xx xx ; 90 08
xx represent ?

The number after A4 / A5 represent the number of byte
to send.

A9 : send half of the time :
A9 xx xx xx xx xx ; 90 00
and this half of the time :
80 00 07 ; 90 00

xx represent a date ( start-end date ) :
07 20 70 22 74
00000111 00100000 01110000 00100010 01110100
\-----/\---/\---/ \-----/\---/\---/
I Month Day I Month Day
I I
Year : 1980 + xx Year : 1980 + xx