If you find yourself looking for the #CEA608 #EIA608 #CTA608 #ClosedCaptions and #VChip standard on a cold winter's day... don't pay ANSI $200 for it. It's downloadable for free from the CTA:
https://shop.cta.tech/products/line-21-data-services
Add to card, check out, fill in your details, receive PDF.

#HackTV

The more work I do on the #analogcable project for #hacktv, the more I feel like I might be making a trip to the Cable Center's Barco Library in Denver, CO in the not too distant future. Assuming it's open to the public. That's a question I need to ask ... https://www.cablecenter.org/the-barco-library

Another new toy - this is a Cabletime MediaStar Evolution 775 standard-def MPEG2, MPEG4-ASP (XviD) and h.264 encoder with licences for the first two. Inputs are composite, S-video and RGB, output is Ethernet. Beats arguing with ffmpeg. #dvb #hacktv

I should have posted screenshots - but I fixed a Ferguson SRB1 BSB box for #hacktv use yesterday.
Someone had pulled a capacitor trying to add baseband input support (the same mod BITD could be use to turn an SRB1 into a D2MAC decoder-descrambler).
Shame they also blew the ACM power supply fuse (how?!) and broke a BC548 transistor in the process.
Oh well, easy fix. I bypassed the fuse with a wire, please don't tell anyone.....

One weird thing I found out on the CFT-2100: the 4000-7FFF ROM block is stored 'in the clear' in ROM. Thing is, if you try and read it, you get encrypted data back. I wonder if there's a config register to disable encryption on a per-bank basis.
My current working memory map is -
Zeropage - I/O, SFRs, possible some RAM
Page one - stack RAM
Page 2 to 1F - empty? or I/O?
2000-3FFF - battery backed RAM
4000-FFFF - EPROM
#analogcable #hacktv

me: sticks an ebay watch on a £20 cable box as a potential next project
seller: hey would you like it for a fiver? there's no remote
me: .... for a fiver, sure
#hacktv #analogcable

After some pratting around with vectors and LA triggering, I got the dumper ROM working. Looks liked the battery-backed RAM starts at 0x2000, the channel names at 0x250E, and the barker screens at 0x290E.
Although this box doesn't show a "welcome to ntl" bootscreen, it turns out it is an NTL box. #AnalogCable #HackTV

First try at dumping the RAM in the CFT-2100 #analogcable box failed... looks like the extender cable and sniffer board loaded down the CPU bus too much and made it bug out.
Trying again with the logic analyser method... #hacktv

You know what #HackTV really needs? A Lambie-Nairn inspired channel ident.

Given my success reading out the ACM RAM earlier, I'm thinking that after making stir-fry I might try and read out the RAM in one of the cable boxes. Although that might need a slightly different dumper board as I don't really want to try and solder wires to CS, OE and WE on the RAM chip. Might be a good opportunity to try out the FT245 USB dumping method. #hacktv #analogcable

I might have just found (and bought) a General Instrument / Jerrold "MVP" Modulating Video Processor ... in other words, a cable TV scrambler. Fingers crossed this one arrives! #hacktv #analogcable

And now, #BSBACM round two! This board has a GAL16V8 which decodes the dual RAM selects into a single select. Unfortunately I've cocked up, can you spot my mistake?
#hacktv #ReverseEngineering

This is what a half assembled #BSBACM RAM dumper looks like. Needs a 4-pin header, another seven Roadrunner wires, the GAL socket flipping 180 degrees, and a bit of GAL programming. #reverseengineering #hacktv

Look, what's this? A shiny new #BSBACM schematic, with corrected chip selects!
Shame the battery back-up circuit still doesn't make much sense. AS_P1 and AS_P25 go to the ASIC. But I'm still puzzled why Q1 is there, when CR1 bypasses it?
AS_P25 low would make Q1 bypass CR1, but the Vce(sat) of Q1 is higher than the Vf of CR1, so it's doing... nothing?
#ReverseEngineering #HackTV

Continuing with the #BSBACM #ReverseEngineering project tonight, for #HackTV. ICYMI, the previous thread is here: https://digipres.club/@philpem/109734418887706727

Seeing as @captainjack asked so nicely I'm going to show y'all how we do a live RAM dump on a 6502-based computer module: specifically the BSB Eurocypher Access Control Module (ACM). #BSBACM #BSB #HackTV

There are two known ROM versions: V1.20 and V1.50. Software upgrading/patching seems to be a thing too, as V1.20 units I've seem claim to be "V1.20 V1.50".

The first photo is the ACM, the second is the diagnostic screen.

May have gone overboard. #hacktv

Messing around with US-style closed captions. My decoder is very unwell but I finally managed to get it to display something for a few seconds. #hacktv

On a side note, a chat in the ABUG talk last night has led me to rethink how to approach dumping the RAM on the #BSB access control module for #HackTV.
I'm thinking it might be safer to use two test clips - one on the EPROM, the other on the RAM to pick up the write-enable, output-enable and chip-selects. Less risk of shorting out the battery-backup voltage.
I could get the whole A/D bus from the EPROM, but that doesn't give me R/!W. That's only present as decoded chip selects.

On a side note, a chat in the ABUG talk last night has led me to rethink how I was going to approach dumping the RAM on the #BSB access control module for #HackTV.
I'm thinking it might be safer to use two test clips - one on the EPROM, the other on the RAM to pick up the write-enable, output-enable and chip-selects.