DSS Abreveations and terms

[smilingjack]

People are always asking what does this or that mean.
Here is a DSS dictionary of terms


007 - 007 is the $E007 map byte, this cannot be FF or 00, if so then the map function is
killed and the cam will loop endlessly.
ACCESS CARD - This is a term referring to your Cam or card.
ACTIVATION - Activation is what happens to your card/cam when you subscribe to a
package from Dish Network Dish Network sends an activation code in the satellite signal
that is picked up by the receiver/IRD, which in turn writes the code to your card/cam. We
have been able to read this info off the card/cam and load it to different cams. This is very
good when loaded it makes you cam look like nothing has ever been done to it. You can
only get channels that come in a package. No P.P.V. But you can credit it to the cam the
erase it later.
ATMEL - The company that manufactures one of the more popular micro controller
families for EchoStar hacks. Atmel chips are widely used on AVR boards.
ATR - Answer To Reset. A string of data sent by an ISO7816-compliant smart card when it
comes out of reset. The data tells the host device what communication parameters the card
expects, what type of card it is, and so on.
AUTOROLL - Autoroll is the term used for when the public keys change by their self.
Your cam, E3M or AVR will write them as they change. That way you don't lose video.
Auto rolling is the process of determining current decryption keys or other changing
information that a hack requires in order to function automatically.
AVR / AVR1 / AVR2 / AVR KEYPAD / AVR3 / AVR4 / AVR5 / AVR6 - AVR is an
acronym for AUDIO VIDEO REPLICATOR. This is basically a PCB with a chip on it that
you stick your card into, then plug the board into the receiver. You program the chip on the
AVR board with HEX files and EEP files. And hopefully you will be able to watch what's
on TV. There are 4 real versions of the AVR Some people just call it AVR for short instead
of AVR3 and so on. With an AVR you will need to FLASH the chip about every other day
with the new KEYS. Takes two seconds but that's the price you pay for free TV. An AVR
board should work in all receivers.
The AVR1 consisted of a PCB with an ATMEL AT90S8515 chip. You would program it
and watch TV. But they have fixed that so now you need a cam with it also in order to get
video. The AVR1 did not come with an lpt connector so you would have needed to have a
programmer also. The AVR1 will work for BEV Cause it doesn't need a cam to get video.
Some variations to this but all are about the same. Today the price for one of these should be
$25 us dollars.
The AVR2 about the same as the AVR1 but had a few more parts. It was what dealers hyped
up and sold. This just like the AVR1 one dose not work any more. Some variations to this
but all are about the same. Today the price for one should be $25 us dollars
The AVR KEYPAD was an AVR1 with a keypad on it so you could update keys with out
having to take it out of the receiver. This was short lived after the keys started to change
more often. It was quicker just to take your AVR to the computer and change them right
there. Don't know about the price for these at this date cause they were so short lived. But
when they were working they were around $250 us dollars. The 02 command killed this, I
think price was also a factor. The keypad was not a new idea. It was a freeware idea for
awhile that came about on dr7 then later was made possible by a commercial dealer. It was
released a few months before dish started the 02 command.
The AVR3 is in use today. It consists of a PCB, an ATMEL AT90S8515, some resistors and
a lpt connection so you could program it with your computer (if you use a cable to connect it
to your computer make sure it's a straight through cable not all will work) It also has a
CARD SLOT to put the CAM in so your receiver can get the 02 command. The 02
command is on the cam we have not been able to put it on any other chip that's why you
need a CAM to test Dish Network You will need to update the keys. Some variations to this
but all are about the same. Price should be around $50 us dollars.
The AVR 4-5-6 are numbered by the dealers to distinguish it from the non-autoroll avr3.
With the addition of the external eeprom (24LC256 or 24C256 chip, necessary for autoroll
since Charlie changed the key packets). Some of the avr4's were "live flash" avrs. This
simply meant that the board could not be flashed unless in an iso7816 programmer or inside
the ird (board took power from external source). With the advent of mcgar101 etc, the avr's
needed the jumper pins 10 to 12 for functionality. Some avr4's were simply these jumpered
models. so the avr4, 5, 6 designations varies from dealer to dealer as to what it incorporates.
but all are really the same basic Tucker design. There is really only one avr board, and it was
designed by Tucker, and stolen by the dealers.
AVRH - This programming to the AVR3 that allows you to use your cam to update the
keys. You do need a readable cam. You would put you cam in the IRD when you need to
update the keys. The AVR then takes the keys from the cam and uses them. Not the best
way to update the keys but it works.
AZIMUTH - This is a word that describes directional angle or compass degree
measurement. Dish uses azimuth calculations for pointing your dish at their satellites.
BACKDOOR -This is a term used to describe an access route to the data on a Dish card.
When programming or reading cams, we go in through the backdoor. The backdoor has a
password, but all of the software that we use knows how to pull the backdoor password.
Rom 3 cards had an ECM close there backdoors. That's why some can't be programmed or
read.
BELL EXPRESS VU / EXVU / EXPRESSVU - This is the sister company up in Canada.
They have the same receivers as Dish Network They don't send down ECM's as much as
Dish Network They get all their receivers after Dish Network does.
BEV -Short for Bell Express VU
BLOCKER - This is programming put on the card/cam to Block Dish Network from
looping you cam. Make sure you load it properly or you may get looped later. Many
versions are out there, use the most current. Also make sure you get the right one for the
type of card you have. Different Rom's take different blockers and code.
BLOCKER BOARD / BLOCKER AVR / BLOCKER - These were used back a while
ago. They had programming put on the chips to block the kill packets sent down by dish
when you cancel your sub. You would sub to a package with Dish Network, then plug your
cam in to this AVR3 looking thing and then cancel your sub. This filtered out the kill packet
and kept your system running with what you had subbed to.
BOARD REVISION - Every Receiver/IRD has a revision it uses in conjunction with the
TSOP. The revision can be found on a sticker on the main PCB board. It can be 3 or 4 letters
long, and has a bar-code on the sticker.
BOOTSTRAP - This is ? It can be found on the system info
screen of the receiver.
BOX KEY - This a 16 characters long = 8 bytes long. A BOX KEY should look something
like this, AA B0 11 2F 66 F6 BB 99. This number is stored in the TSOP in the
Receiver/IRD. It is also stored on the cam if it is married to the receiver. Everyone's Box
key is different. You can use JTAG to read the info on the TSOP to get the Box keys on
some models. It's not necessary to know the box key to test as long as your cam is married to
the receiver. You will need to know the Boxkeys on both the cam and receiver if you are
going to use a non-married setup for AVR
There are 3 ways you can get the boxkeys for your receiver.
1. If you have a married subbed or ex-subbed system with a Rom 2 card, or an open Rom3
card, you can use a 3.68 crystal programmer to dump the contents of the cam using any of
the following programs, NagraEdit, xcel, sorry Charlie, sorry shakes or freetalk, to get the
boxkeys
2. If you have a receiver that has a JTAG port on the bottom, you can build a JTAG interface
and dump the content of the TSOP of the receiver and retrieve boxkeys. You can build a
JTAG interface yourself by downloading the files named "Very simple JTAG" from the files
section and following the simple instructions.
3. Remove the TSOP chip from the receiver and have it professionally read. Needless to say,
that would be the most difficult of the 3 choices and the most expensive.
CAM / ROM / Dish Network CARD - Conditional Access Module. This is the blue card
that came with the receiver. It looks like a credit card, with gold colored contacts for the
chip. There are 3 different cards. A Rom 2, a Rom3, and a Rom10. Rom2's can be read and
written to using a card programmer. Rom3 have had security features added to them. If it
has have been in the stream after July 2001 they can't be read or written to. Dealers have had
luck at unlocking Rom3's but it will cost you. Now Rom10's as of this date can't be read or
written to, but who knows what the future has in store for us. There are Rom7's but are BEV
cams.

[smilingjack]

You will also need to know the HEX equivalent of your CAM for programming purposes.
Here is how you figure it. Lets say that your CAM number is S0007424521-31. To get the
HEX equivalent, open calculator in windows, click on the view tab, make sure that scientific
is selected. Then on the calculator screen make sure that DEC is selected. Now type in your
CAM number. (Don't use the S, the first 0's, the dash, or the 2 numbers after the dash.
(Example: you would enter 7424521.) Once that is entered, select the HEX button. You
should now see the change to the number you entered. If you did it correctly, you should
now have the following 714A09. Now, since CAM HEX numbers are 4 bytes (8 digits), and
we only have 6, we must add 2 zero's to the beginning. So your CAM number
S0007424521-31 in HEX would be 00714A09. Also, remember when dealing with code of
any type, the only valid characters are, 1,2,3,4,5,6,7,8,9,0, A,B,C,D,E,F. If you see anything
other than these in any dump, info, or script you are working with, something is wrong.
To tell what ROM type you have, you will need a receiver and a TV, or a conversion chart.
To use TV, put the cam in the IRD turn the receiver on. Press the system info button on your
remote (if you don't have that button look in the menu for system info) a screen should
appear like this:
MODEL ID: 2700 (what ever receiver you have)
RECEIVER CA ID: R00xxxxxxxx-xx
SMART CARD CA ID: S0xxxxxxxxx-xx
(Card Rom version) => DNASP003 Rev 3xx <== software version
DNASP003 is a ROM 3 card - A2012 or 288-02 great card - programmable and repairable
when reliable public E3M's are available. Also works with an AVR.
DNASP002 is a ROM 2 card - 288-01 Programmable but not repairable and works with an
AVR.
DNASP010 is a Rom10 card and hasn't been hacked. Only good for legit Subscriptions and
AVR's if you are subbed or ex-subbed.
To use conversion chart to determine your Rom, look under ROM in this terms guide.
CAMLESS - This term refers to to any type of testing Dish, without the use of a card/Cam.
As far as I know, the only to camless setups are with the use of an AVR, or using Emulation.
CHARLIE - The CEO of Dish Network This guy doesn't have a brain. If you watch him on
Charlie Chat he doesn't answer any questions he has all his yes men in the audience answer
for him. Plus he's funny looking. Charlie is also a nickname for Dish Network.
CLOCK SPEED This refers to the speed at which your card read/writes at. Dish cards need
a 3.686 crystal to work at the correct speed.
CLONE - To make a copy of something. You can clone cams and receivers. To clone a
receiver you'll need to read the TSOP and program the TSOP in the exact same receiver.
CODE - This term refers to any type programming language used with Dish. The contents
of a dump of any kind, are code. Any script used for 3M is code. Also, see script and Dump.
CODEGEN - A program used to create a script/3M for writing to your card. It can create
scripts that also generate Blockers, revision reloads, among others. See a Codegen how to
for further options and use.
DESUBBED/EXSUBBED - Refers to a subscription to the Dish Network that has been
canceled.
DISH / DISH 500 / SATELLITE DISH / ANTENNA - This is the antenna that gets the
signal from the satellites in the sky. They mainly come in 2 shapes a 18" that's only has one
LNB and gets about 400 channels depending on what satellite you have it pointed at. The
20" is a dish 500 and gets about 1000 channels when pointed at the 110 and 119 satellites.
The Dish500 has 2 LNB's to get two different satellites.
DISH NETWORK / DICKNET / CHARLIE - The company with the programming. They
are whom we pay all this money to for programming. They also are the ones that rip their
customers off. They control ECM's, the satellites in the sky and what channels we get. DISH
NETWORK is based in Colorado. Although they have satellite uplinks all over the US and a
few out of the US
DUMP - A dump is info that was removed from a Dish component. When you use a
program, or hardware, to remove information from a TSOP, EEprom, Card, or any other
item that holds information, the data that you get is called a dump. The Dump contains code
that operates a the component you dumped it from.
E3M / 3M / EASY3M / E*3M - Programming put on the cam that gives you access to
every channel. If you use E3M make sure you use a blocker. You may also want to lock you
TSOP and EEprom. There are many Freeware E3M scripts out there. Some work and some
don't. Your best bet is to do a lot of research. Be careful some don't let the keys roll.
ECM - Is an acronym for ELECTRONIC COUNTER MEASURE or Entitlement Control
Message for the tech buffs out there. Basically DISH NETWORK doesn't want anyone
getting free TV. They surf the net and see how all of us are doing it. Then they put lots of
research in to find a way to stop you from getting TV. They then send down a signal in the
STREAM that detects what you have in the card slot and if it doesn't like it then the receiver
will either LOOP your CAM or reprogram your TSOP and/or EEPROM. To protect your
self from ECM's you need to lock your TSOP, EEPROM, and use an AVR3 protect your
CAM. Or Lock your TSOP, EEPROM and have a good blocker on your cam that you
programmed.
EchoStar / E* - EchoStar is the company that makes the receivers. DISH NETWORK and
BEV buy receivers from them and resell them to us.
EEPEDIT _____ (version) - EEPEDIT is a program used to enter your info for your
receiver cam and other useful info. It is used to flash the AVR3 with the MCG306 hex file.
This is the Program you'll need to use an AVR3.
EEPROM - The EEPROM is where you keep all of your settings. Like what channels you
have blocked, what your password is and what other settings you have. This also keep's the
info from the switch you are using. See picture under EEprom Lock.
EEPROM LOCK - If you are testing you need may want to lock your EEPROM. This is a
hardware modification to your receiver. One way is to pry up pin 7 and solder a jumper wire
to pin 8. Another way is to install a switch that allows you to lock, and unlock the chip.
Most are labeled 24LC16B. This mod is a little harder then the TSOP lock.
To determine where pin 1 is, look for the small circular indent on top of the chip, or half
moon cutout. With either on top, pin 1 is on the top left corner, and 2-8 are in a counter
clockwise direction. The one pictured is the half moon cutout.
EMM - Entitlement Management Message. A message, which contains the information,
required to transfer subscription information and EEPROM updates to the CAM.
EMULATION / EMU / EMULATOR - A hack, which performs all (or a significant
amount) of the functions of a real CAM. There is very few EMU's for dish it's to new right
now. Most emu systems use a computer connected to the card slot in the IRD.
EPG - Stand for ELECTRONIC PROGRAM GUIDE. It's the info that tells you what's on.
Most receivers don't have the option to re-download the guide but the DishPlayer dose. With
the receiver off press 72250000 the lights will flash to confirm it took the info.
Excel - A windows based program for working with dish cards. It reads/ writes and has
some other functions including a option that can help to unloop Dish cards.
EXPRESSVU - See BEV
FBPRG16 - This is a DOS based program for flashing the AVR You use hex and EEP files
to flash to the AVR
FREEWARE - This is the best software you can get. FREEWARE is what it sounds like
free programs or free scripts to aid in your pursuit for free TV. If you have seen some one
that has made Freeware say thanks. If it weren't for them a lot of us wouldn't be in this
hobby. They put a lot of thankless hours into creating software for us. To top it off they don't
get paid for it so give your thanks.
FULL MONTY - A term used for full write, used in Jeepers.
FUNPROM___ (version #) - This is a Windows based program for flashing the AVR. You
use hex and EEP files to flash to the AVR. It's faster then FBPRG16
HEX / Hexadecimal - Base 16 numbering system used in all microcontrollers, it has 16
digits ranging from 0 to F (0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F), and no others.
IR BLAST - Some receivers have the option to turn your VCR on and record a show. You
IRD would send out an IR signal and turn your VCR on. Nice feature. It's kind of like the
DishPlayer but cheaper.
IRC/IRC CHAT - It is a type of instant messaging, kind of like a chat room.
ISO - International Standards Organization. The standards organization that established the
ISO-7816 protocol used by most of the smart cards on the planet today, including the Cams
used by EchoStar
ISO-7816 - The international standard for interfacing with smart cards. The ISO-7816
includes standards relating to the physical properties of smart cards.
IRD / RECEIVER - IRD is an acronym for Integrated Receiver-Decoder. An IRD is your
receiver. Need I say more? I do? Well OK here I go. Are you all listening? "MORE". OK
here is something else. Your RECEIVER can only receive signals and information as long
as you don't plug in the phone line. You will also need to know the HEX equivalent of your
IRD for programming purposes. Here is how you figure it. Lets say that your IRD number is
R0027316735-42. To get the HEX equivalent, open calculator in windows, click on the view
tab, make sure that scientific is selected. Then on the calculator screen make sure that DEC
is selected. Now type in your IRD number. (Don't use the R, the first 0's, the dash, or the 2
numbers after the dash. (Example: you would enter 27316735.) Once that is entered, select
the HEX button. You should now see the change to the number you entered. If you did it
correctly, you should now have the following 1A0D1FF. Now, since IRD HEX numbers are
4 bytes (8 digits), and we only have 7, we must add a zero to the beginning. So your receiver
number R0027316735-42 in HEX would be "01A0D1FF". Also, remember when dealing
with code of any type, the only valid characters are, 1,2,3,4,5,6,7,8,9,0, A,B,C,D,E,F. If you
see anything other than these in any dump, info, or script you are working with, something is
wrong. Lastly, when reading or applying IRD numbers to card, they are wrote backwards.
So your IRD hex number above would be read or wrote as "FFD1A001".
JEEPERS - A windows based program used for progamming AVR boards.
JTAG - JTAG stands for "Joint Test Access Group". In 1990, the Institute of Electrical and
Electronic Engineers (IEEE) refined the concept and created the 1149.1 standard, known as
IEEE Standard Test Access Port and Boundary Scan Architecture. It is a way of reading the
info on the TSOP JTAG does not read the EEprom. The most common JTAG connection
consist of 5 resistors (100 ohm), an LPT connector (male), and wires (Cat 5 is works good)
that you connect to pads on the PCB board through an opening under the receiver. If you
have a rectangular hole under your receiver with some square spots to solder to you may
have JTAG port. A JTAG port is a very valuable tool in Dish testing. If you get ECM that is
aimed at your TSOP, you should be able to load the old firmware and be back in business.
Not all receivers have JTAG check with SatTech.net. Not all have the same connection
setup known JTAG supported IRD's are
2700,2800,3061,3700,3800,3900,4061,4700,4900,6000, and the Dp501 and 301. Below are
pictures of a JTAG port, and a homemade JTAG connector, connected to it. For more
information on JTAG, download "Very simple JTAG" zip from files section. Note: the
second picture shows the orange wire connected to the long ground bar that you can see in
the first pic. It is not reccommended to use ground bar. Use the IRD case as your ground
using an alligator clip.

[smilingjack]

KEYS / PUBLIC KEYS - These are security decryption keys sent down by DISH
NETWORK almost daily. The keys on the cam or AVR need to match the ones that are in
the stream or you wont get video. If you have a sub then the keys will roll on you cam.
Some E3M won't roll the keys. The keys are a set of bytes used to encrypt or decrypt a
video. The key is a block of data to be used to either encrypted or decrypted. This is a set of
16 characters = 8 bytes. It is one of the Public keys either key0 or key1. One is the active
key. This active key changes every time the keys change in the stream. The active key is
stored on the cam and/or AVR If your cam hasn't been in the stream then the key hasn't
changed. You'll have to put the cam in the receiver to get the new keys put on it. Go to
Dishnethack.net to find out what key is active. If you are using an AVR3 the CAM PUBLIC
KEY won't ever change unless you put the cam in the IRD without the AVR3.
LNB / LNBF - The LNB (Low Noise amplifier Block down converter) is a small, soda can
sized, piece of electronics that sits at the end of the dish boom. Simply put, a single LNB
will let you lock on 1 sat for one receiver. A dual LNB will let you lock on one sat for 2
receivers. A Twin LNB will let you lock on 2 sats for 2 receivers. A Quad LNB will let you
lock on 2 sats for 4 receivers. Look further down in this guide for install notes and pics.
LOCKED CAM - Rom3 cams took the initial lockout in Feb of 2001. These cams were
closed until freetalk 1.2c and sorry shakes 3.1.1 were released. These programs utilized an
old dish ecm to re-open the locked rom3 cams but the cam was then marked at E010= FF.
As a result, Charlie re-closed the cam to prohibit the old ecm. Thus rom3's were locked until
na_worm.hex. that is also the reason for the current rev 380, which prohibits na_worm.hex
from re-opening closed rom3 cams. You can still use these cams with the AVR3. If you try
to read or write a cam that has been locked you will put a "mark" in the write once area. The
area of the cam can only be written to only once. If you get the mark, your card can be
looped or made so it won't roll the keys.
LOOP / LOOPED - When DISH NETWORK sends down ECM's to check to see if your
running something your not suppose to they can loop your cam. A looped cam can't be used
unless you get it unlooped. When your cam gets looped it puts the card in a repeat pattern
when the programming is ran. Some looped cams can be fixed but not by most people.
MARRIED - This is a concept that refers to the joining of card and receiver by Dish
Network when subscribing. When you subscribe to DISH NETWORK, they send down info
to your receiver that writes the receivers secret boxkeys to the card you are using. This info
makes it so you can only use that cam with that receiver. Once this happens, they are
"married".
MEMORY DUMP SCREEN - Your memory dump screen has some good info. You can
find on some models the boxkeys( Only on systems that have not been used since
somewhere around early 98. It is not likely.) You can also find Password for channel locks.
( For more on password, see RESET). The most important thing you can find in the memory
dump, is the first 3 lines of your EEprom. Bring up the Memory Dump (see RESET) and
look at the first 3 lines, NMV-0000, NMV-0010, NMV-0020. These are the first 3 lines of
your EEprom. This is good to have in case your EEprom is hit by an ECM. When you
replace an ECM'ed or damaged EEprom, your TSOP can write (flash) it's info to a new
EEprom, but it will not write the first 2 (or 3, depending on your receiver) lines to the
EEprom. You will need to know these lines so that you can program them in yourself before
flashing with the TSOP. Write these numbers down before you begin testing. You may need
them someday.
MCG****(version) - This is a HEX file and an EEP file that gets programmed on the AVR.
MCG was a group of coders who designed the mcg305 hex to work with Tucker's avr3
design. They have not been active since mcg306. The guys that made this are great. An
ECM came back in April and they had us all back up in under 24 hours. This file comes with
EEPEDIT. Mcg307 was coded by Bull62. The current version at time of this file is
MCG306.
MCGAR****(version#) - This is a hack to the MCG hex file to allow the keys roll on an
AVR. Thanks bull62. Just goes to show you that Freeware is better then dealerware.
MULTI_DISH SWITCH - A device, which allows one or more IRD's to be connected to
more than one antenna. This is critical for EchoStar, because EchoStar splits their
programming between satellites in more than one orbital slot such that their core
programming can be received from satellites in one slot, local-into-local programming can
be received from satellites in another, and specialty programming can be received from
satellites in a third or fourth slot. EchoStar offers multi-dish switches that can connect 2
dishes or signals to 1 IRD (the SW21), 2 dishes to 2 IRD's (the SW42),2 dishes or signals to
3 or 4 receivers(SW44), and 3 dishes or signals to 4 IRD's (the SW64).
NAGRA / NAGRAVISION - This is the company that makes the Dish Network
cards/cams.
NAGRABLOCKER - ??? A blocker in NagraEdit. ???
NAGRAEDIT - A windows based program for reading/writing to Dish cards. It also has a
function that can help to unloop some Rom3 cards. Nagraedit 1.1 (beta2) coded by AoD and
Niko.
NAG SCREEN - This refers to any of the many screens that pop up while watching TV.
Most nags are generated by way of ECM programming. If a screen comes up every so often
that annoys you, that's a nag screen. Error messages are considered nags also.
NAWAPO - A .eep file used for programming a EEprom on an AVR board for camless avr
autoroll. ( I think)
NIPPER - A hacker who was involved in much of the early release of information about the
EchoStar/NagraVision conditional access system. If the CAM EEPROM dumps that have
been released on the internet are to be believed, then the guys at S.A. Kudelski are already
familiar with Nipper (or someone else called Nipper), because there is ASCII text inside the
Rev313 and higher EEPROM images that reads "Nipper is a buttlicker", which leads us to
believe that for one reason or another, the people at Kudelski don't like him very much.
PASSWORD - There are 2 different passwords that we deal with using Dish. The first is the
password for the backdoor on your cam. Being able to get this password allows us to
program are cams to watch TV. (See Backdoor in this guide for more) The other password is
in the IRD's EEprom. This password is set by us. It is used for parental controls and channel
blocking. (See reset in this guide for more info.)
PCB - Printed Circuit Board. This is a board that that you find in most electronic items. It
has metal traces, and components soldered to. Most are usually covered with a PCB green
solder mask..
PM - A PM s a Private Message, or sometimes referred to as a Personal Message. In the
forums you can send people Private Messages or E-mail (if they have E-mail turned on) by
clicking on there user name anywhere in the forums, and then clicking on send a Private
Message, or send an E-mail..
PONYPROG - A program used to read and write your EEprom
PPV - Pay-Per-View. An event (or group of events), which is presented to the viewer at a
fixed cost for a single viewing (or single day of viewing).
PROGRAMER / ISO PROGRAMER / CARD READER/WRITER - This is a piece of
Hardware used to read and write to card/cams. DISH NETWORK uses a 3.686 crystal to
write to the cam. DTV uses 3.579. Ask your dealer what crystal you have. You can use a
3.579 crystal and use talk to calibrate but chances are you loop your card. Cost should be
around $50 us dollars for one with out a case. There are programmers that are multi sync,
and will read multiple types of cards. Below is a typical card reader with case..
PUBLIC KEY / ACTIVE KEY - This is a set of 16 characters = 8 bytes. It is one of the
Public keys either key0 or key1. One is the active key. This active key changes every time
the keys change in the stream. The active key is stored on the cam and/or AVR If your cam
hasn't been in the stream then the key hasn't changed. You'll have to put the cam in the
receiver to get the new keys put on it if you don't know them. Go to Dishnethack.net to find
out what key is active. If you are using an AVR3 the CAM PUBLIC KEY won't ever change
unless you put the cam in the IRD without the AVR3.
QUAD LNBF - This is another type of LNBF that is used for multiple receivers on a
Dish500 setup With a Quad-LNBF you can run 4 receivers without the use of any switches.
The Quad has 4 built in switches, with four connections for RG-6 cable. Each cable can run
to a separate receiver carrying the 119 and 110 signal. See LNBF in this guide.
RAIN FADE - This problem is caused by heavy rain, often miles away, between your dish
and the satellite. Generally, this is uncommon. What happens is you won't get any signal
from the sats just wait and it will pass.
RECEIVER / RECEIVERS / IRD - The receiver is a VCR sized box that decodes the
digital data from the satellite into viewable TV. pictures and sound. A receiver will only
decode one channel at a time. EchoStar is coming out with new ones that can have 2
channels at a time. See IRD also.
REMOTE ADDRESS - This is found in the System Info screen. Your remote can be
programmed for different frequencies, so it does not effect other receivers in close
proximity. I believe that there are 6 different addresses that you can specify. ???????To
change the remote address, press the Address button, enter the remote address you want,
(must be done while the light is flashing), then Address again. The remote should flash 3
times, then press the record button???????.
RESET / MASTER RESET - This will reset you receiver to the factory settings. Your
EEPROM will need to be unlocked for it to work. Turn on the IRD - Go to the memory
dump by pressing the following keys on your remote....MENU, 6, 3, INFO, BROWSE (right
arrow), THEME (left arrow). a display of the memory dump should come up on the screen.
Once you see this, press the TV./VIDEO button, then press the IRD's front power button, or
unplug for 10 seconds.. This will erase all the memory in the EEprom, to include the
password that's locks channels.
The object in the first part of the sequence above (Menu, 6, 3) is to get to the Diagnostic
Screen. Some units may require a different sequence to get there. Use whatever sequence
dictates to get to the Diagnostics Screen. Also, sometimes you may have to push the buttons
Info, Right, Left, in quick sequence.
Let's say you don't want to erase password, but rather find out what it is. This way you could
be watching those channels your not supposed to be, and no one would know the difference.
If this is the case, once you get to the memory dump, don't hit the TV./Video button. Instead,
scroll down in the memory dump until you get to the line 01C0. Look at the 3rd group of
digits. The first 4 are the password. It is reversed by 2's. (I.e. If the password is 1234, it
would be displayed in the Dump in the 3rd group of digits as 3412.
DishPlayer MASTER RESET with the IRD off press 32768 the lights on the IRD should
flash to confirm it took it.
Some of the new receivers reset by holding down the power button on the receiver for a few
seconds. Below is a picture of a memory dump on screen. It also shows the password line
01C0. The password is 4882.
RESISTER - Comes in dozens of sizes and shapes but all do the same thing, they limit
(resist) current. It does not matter what direction a resister is installed.
REVISION / REV - This is Dish's version of software updates that change the
programming on a cam. Usually we put a call number with it, so REV378 would be the
revision to a Rom3 The newer the REV the less likely your card will get noticed for an

[smilingjack]

ECM. You can see what REV your cam is at in the system information screen.
RG-6 CABLE - RG-6 quadshielded cable is the higher quality cabling that you want to use
for your dish to receiver runs. The difference isn't huge, but RG-6 has lower losses and is the
recommended cable for all of the DBS manufacturers. You don't have to use RG-6 but it is
recommended.
RG-59 and - RG-59 is conventional coax cable.
ROM - This refers to the type of card/Cam you have. The most popular are the Rom 2
Rom3 and Rom10. To identify the card you have, just look in the lower right hand corner of
the card on the side with the gold contacts. There, you should find in very small print, one of
the following numbers.
Card / ROM version / Read-Write
A2012.....ROM3......YES
A2013.....ROM3......YES .
AA-01..... ROM3 .....YES
AA-02..... ROM3.......YES
AA-03..... ROM10..... NO
288-01..... ROM 2 .....YES
288-02.... ROM3 .....YES
288-03..... ROM10..... NO
288-04..... ROM3 .....YES
288-05..... ROM3.......YES
288-06..... ROM3.......YES
288-07..... ROM3.......YES
288-08..... ROM3.......YES.
288-09..... ROM10..... NO
288-11..... ROM10..... NO
Just because you see a YES in the read/write column for your card, does not mean it will
read/write. It just means that it is possible. As stated earlier, cards can be looped or have
backdoors closed.
RS / Rat Shack -Radio Shack. One of the best local stores to get electronic supplies.
S.A. Kudelski - The name of the Swiss company, which produced the NagraVision
conditional access system, which is the conditional access system, used by EchoStar and
many other satellite systems worldwide.
SATELLITE / SAT / BIRDS - These are the satellites that float over the equator in space.
DISH NETWORK has 4 main sats.
119.0° West - Main Dish Network Programming (E* I/II)
61.5° West - East Coast local channels and Sky Angel (E* III)
148.0° West - West Coast local channels (E* IV)
110.0° West - Main Dish Network Programming (E* V/VI - future use)
175.0° West - 32 transponder license (future use) (not sure if this is true)
SCP / SWISS CHEESE PRODUCTIONS - The name of a group (or perhaps a single
individual) which was responsible for much of the technical information initially released
pertaining to the EchoStar/NagraVision conditional access system and Cams.
SCRIPT/CODE - This refers to code that is written or generated for use on Dish cards. It is
what gives you the ability to watch TV. Script also refers to Blocker. Any code that is wrote
for cards could be called script.
SKY VISTA - The name of a digital satellite service available to subscribers in the United
States, Puerto Rico, and other territories in the Caribbean. Sky Vista doesn't offer a very
large selection of programming, but they do offer a lot of specialty Ethnic channels. They're
really only mentioned here because, being operated by EchoStar, they use the same Cams
and IRD's as EchoStar
SLAVE RECEIVER - The term "slave" is used to refer to an add-on or second receiver.
DISH NETWORK came up with this term. You don't have to have the master receiver
running to make the slave work. So the term isn't completely true, except in the fact that the
slave receiver will only receive the channel that the main one is tuned into.
SMART CARD - This is another term for your cam/card.
SOFTWARE REVISION - This is refers to the Firmware that is running your receiver.
You can find what revision you are running by looking at the system info screen. This
should match the build config sticker on PCB Board.
SOLAR OUTAGE - A solar outage occurs when the sun passes directly behind the satellite
you are receiving from as viewed from the point of view of your satellite dish. The sun's RF
(Radio Frequency) radiation overwhelms the LNB's on your dish (as compared to the
satellite signal) and causes noise to occur on the signal. This manifests itself as a signal
degradation and possibly loss much like a rain fade. It lasts for several minutes as the sun
passes behind the satellite. Solar outages occur twice a year (near the autumnal and vernal
equinoxes) and will occur once a day for about a week or so while the sun is in just the right
position. The rest of the year, the sun would appear to pass above or below the satellite as it
arcs across the sky.
SORRY CHARLIE / SORRY SHAKES / SORRY ______ (fill in the blank) - Sorry
Charlie is a program by a guy called Shakes Blows. This program is a windows based
program to read and write to cams with a card programmer. Shakes later tried to scam
people by selling an AVR4. So he was sent back to the hole he crawled from. Later some
one else picked up the program and called it SORRY SHAKES (which is not supported)and
so on. There are many versions of these programs the newest one should work the best.
nagraedit, xcel, and to some extent for the old timers, freetalk, are the programs of choice.

[smilingjack]

STATUS BYTE - Status byte is the status of the ird, 00=normal, 80=suspended. (This is the
commonly referred to de-sub byte.) For it's location, look under topic "The Card" in this
guide.
STREAM - This is a stream of info. This info comes from the satellites in the sky. If you
receiver is plugged in and connected to a sat then it's in the stream. Same with a cam.
STUNTS
VIA DIGITAL - The name of a digital satellite service available to subscribers in Spain
(and probably most of the rest of Europe and northern Africa). They're mentioned here
because they use IRD's, antennae, and Cams provided by EchoStar
WEDGE - A style of hack or other device, which involves a PC board, that plugs into the
smart card slot on the IRD and into which a CAM is plugged. Wedge-style hacks offer an
advantage not generally available to most other hacks: Because they have a genuine CAM
plugged into them, they have the ability to use the CAM to perform complex tasks that
would be otherwise difficult to deal with in their own micro controller. The AVR is a
wedge.
WIN EXPLORER / WINEX - This is a program for windows created by Dexter. It is use
with a card programmer and script files. You can use this with MCG306 to program the
AVR You will need the script file. There are other script files used to read and write to
cams.
XFILE ___(version #) - Old hex files used with the AVR Just like the MCG306 just
outdated.
Zip Code - Zip codes are used in the install Dish section of your IRD, to give you an
azimuth, so that you can find the proper location of satallite. Zip codes are also used when
programmng AVR's, and E3M. When using for programmng, it may be nessacary to know
your zip code in HEX. Here is how you figure it.
Lets say that your zip code is 12345. To get the HEX equivalent, open calculator in
windows, click on the view tab, make sure that scientific is selected. Then on the calculator
screen make sure that DEC is selected. Now type in your zip code. Once that is entered,
select the HEX button. You should now see the change to the number you entered. If you
did it correctly, you should now have the following 3039. Now, since zip code HEX
numbers are 4 bytes (8 digits), and we only have 4, we must add 4 zero's to the beginning.
So your zip code in HEX would be 00003039. Also, remember when dealing with code of
any type, the only valid characters are, 1,2,3,4,5,6,7,8,9,0, A,B,C,D,E,F. If you see anything
other than these in any dump, info, or script you are working with, something is wrong.
There is also a Time Zone byte that s added to the HEXed zip code. Depending on where
you live in the US, and the time of year, you would use the code below for your next 2
digits.
D8=STANDARD TIME HAWAII
DC=DAYLIGHT SAVINGS TIME HAWAII
DC=STANDARDTIME ALASKA
EO=DAYLIGHT SAVINGS TIME ALASKA
E0=PACIFIC STANDARD TIME
E4=PACIFIC DAYLIGHT SAVINS TIME
E4=MOUNTAIN STANDARD TIME
E8=MOUNTAIN DAYLIGHT SAVINGS TIME
E8=CENTRAL STANDARD TIME
EC=CENTRAL DAYLIGHT SAVINGS TIME
EC=EASTERN STANDARD TIMEST
F0=EASTERN DAYLIGHT SAVINGS TIME
Your last 2 digits would be 00.
So, if your zipcode was 12345, and you lived in New York, and it was July, your full zip
entry would be, Zip 00003039, Zone F000.
(The following people helped with the terms: Me....LSD4Me....Zed075...A few things from
the alt_dbs_echostar FAQ
Some from the esfaq. Thanks to all)