ACM hardware

The ACM is a relatively simple board with only four major components:

• NCR-manufactured custom ASIC
  • General Instrument part number 72523-2 F840590 A9023
  • Western Design Centre embedded CMOS 6502 CPU core with extended instructions
  • 8-bit parallel (6502-style) interface to communicate with the set-top box
  • Serial ACM-bus interface to communicate with e.g. an external modem for impulse pay-per-view features
  • Possibly some kind of encryption processor
    • The key only changes every 256 frames (~10 seconds), so this doesn't have to be particularly fast.
    • According to (ref: Bennett, Moroney and Cutts, “The Architecture and Security Design Goals of the Eurocypher system”), the algorithm used is proprietary to Eurocypher. This is unlike VideoCipher II, which uses DES.
    • (ref: Chippindale and Franks, “Dished!”) suggests that the algorithm change may have been done at the behest of the NSA and GCHQ.
• Signetics 27C256 OTP EPROM (main program code)
  • General Instrument part number 72524-2 (V1.20 V1.50 firmware) or 72524-5 (V1.50 firmware)
• 8-kbyte low-power RAM, with battery back-up
  • Either a Mostek/ST MK48H64LN-120 or MK48H64UN-120 (most common) or Fujitsu 8464A-20L.
• General Instrument 72522-1 OSD controller
  • 16 lines of 31 characters
  • Display attributes seem to be per-line. According to (ref: Bennett, Moroney and Cutts, “The Architecture and Security Design Goals of the Eurocypher system”):
    • Text is always white; font supports upper and lower case characters.
    • Double height, underline and blinking.
    • Background transparent (TV picture show-thru), blue or black, with shadowing or blocking of characters.
  • The RGB output and OSD Enable (fast blanking) is fed to the VCU2133 video processor in the receiver.

The ROM can be dumped by desoldering the chip and reading it in an EPROM programmer. There is no encryption.

Be careful not to short any of the pins or solder joints, as this may clear or corrupt the RAM contents.

I'm investigating ways to dump the RAM. There are several options.

This option involves a piggy-back board which plugs into the EPROM socket. This would carry the EPROM, a Dallas DS1225 battery-backed RAM chip, and some logic ICs.

• The DS1225 is preprogrammed to known values, then fitted to the socket. The EPROM is installed, and the piggy-back board is fitted into the ACM.
• A wire would be soldered to RAM pin 27 to pick up the RAM write signal (/RAMWR).
• Logic would:
  • Convert /CS1 and CS2 (from the MK48H64 RAM) into a single /CS chip select signal for the DS1225.
  • Merge /OE and /WR into a single /WE write signal for the DS1225.
• This would mean any access to the RAM would result in a copy to the DS1225.

The disadvantage with this option is that only accessed RAM locations would be backed up. Essentially, this assumes that the ACM firmware does some kind of checksum or access of the RAM data when it boots.

This method involves building a piggy-back board with an FTDI FT245 USB-FIFO chip, an EPROM, and some glue logic.

• Accesses to the lower part of the EPROM cause a byte to be latched into the FT245.
• The EPROM code sends a short sync message, then reads the contents of RAM and sends it to the host via the FT245.
• Optional: add a means of reading from the FT245, allowing the RAM to be cloned.

This is a more involved option, but would allow the entire RAM to be dumped and restored as needed.

These two scans show the PCB in more detail. The PCB is single-sided, and these can be used to derive a schematic diagram.