back
15 comments
Did a lot of this when I was younger (and the PCB feature sizes were larger with fewer layers). One of my early triumphs was figuring out exactly where to drill in the blue brick to permanently enable subscription television service. Fun!

https://en.wikipedia.org/wiki/ON_TV_(TV_network) https://en.wikipedia.org/wiki/SelecTV_(American_TV_channel)

Brave man, confessing to your crimes juuuuuust after the statute of limitations runs out. /s
LOL! I doubt that the statute of limitations for my (prior to DMCA) activities lasted anywhere near 40 years. Either way, I was a juvenile when I did these things.
How did you do that, what was the signal you disabled?
I somehow obtained an "ON TV" box. (From a friend of a friend who cancelled and never returned it.) I took a look at the innards and most of it looked a lot like a TV (RF front end, video demodulator, RF remodulator), Attached to the top (steel) cover was a module that was completely covered in blue potting material. I already knew about the scrambling techniques being used. (Sine wave mixed with video, but out of phase with horizontal sync pedestal. Sound encoded on narrow-band FM similar to SCA.) The blue module had only a few connections (from memory): 1) +12VDC and ground 2) Video input/output (via coax) from video demodulator. 3) Yellow wire which when driven with +12VDC, enabled FM demod of hidden sound channel.

With nothing to lose, I took a blowtorch to the potted module. After about half an hour I had removed all of the potting (and many of the components). There was a large (40-pin) ASIC, a 14-pin (74xx TTL) chip, a few other chips, a row of drilled holes (24?) that coded the unique serial number of the box and fed it to the ASIC, and a one-transistor class-A inverting video amplifier/filter/mixer. The video amp had a bias input from the TTL chip (probably a 7400 configured as a S/R flip-flop). The ASIC had outputs to the yellow wire (sound) and to the 7400. It would receive coded instructions (sent to all boxes during the horizontal blanking interval) via the video input, but would only act on the "enable" or "disable" messages targeted to its serial number. Enable would set the flip-flop and disable would clear it. The bias from the 7400 flip-flop to the transistor came from pin 8 (NAND output). I deduced that the (destroyed) transistor had been NPN so I put in a 2N2222. I deduced the needed bias resistors and a DC-block capacitor and installed those too. I saw that when the NAND output was "low", it would bias the transistor to remove the sine wave from the video (by mixing it with an out-of-phase version provided by the ASIC). I was happy to find that my deductions were correct and that the (mostly destroyed) blue module actually worked well enough to decode the encrypted signals. I kept that box for myself and used it for years.

When friends learned what I had done, they all wanted me to do the same thing to their boxes. I carefully measured the dimensions of blue module and the location of the 7400. By drilling into the lower part of the chip and shorting pin 7 (ground) to pin 8 (/enable) with a small blob of solder, the video decode would be enabled. Enabling sound was just a matter of cutting the yellow wire and connecting it to +12VDC.

I got it all right on the first try and enabled many boxes for friends and acquaintances. It was my first real reverse-engineering/hardware hacking puzzle and I had a lot of fun doing it.

A few years later I came across a "SelecTV" box (a competing over-the-air scrambled subscription TV service). Their box was more advanced. It had the same basic sine-wave/SCA scrambling, but they had added an additional scrambling feature that would periodically invert, or not invert the video. It also had a set of four hex thumbwheel encoders on the front panel. (Subscribers would be given their unique enable code each month after they had paid.) By this time I had my own oscilloscope and lots of computer components. I built a circuit that would decode the (22-bit) data stream (coded in the same place that now includes Closed Caption data), and fed a magnitude comparator circuit fed with 3-position toggle switches (one/zero/don't care). I could hone in on the needed enable code for the invert/normal video signal in just a few minutes. SelecTV stayed in business for a few years beyond after ON TV went bankrupt.
Ha! Thanks, interesting read, and amazing memory :).

Reminds me of being a kid when we got a de-scrambler by my uncle, who worked as an engineer at Ericsson. It consisted of two large metallic cylinders (coffee containers really) in series, with what I assume is a turnpot or turncap in between them. Tuning was done by adjusting that turnpot, until the horizontal noise and rolling was removed. And that's the story of how we got TV1000.

Discussed a bit in 2012: https://news.ycombinator.com/item?id=3503521
Great article!

Related thought: Someone should reverse engineer schematics from all old legacy ISA PC Cards -- and place those schematics online -- to preserve that historical legacy into the future...

I looked into doing this for a daughter board of a old ISDN terminal that utilized a strange, confusing, poor documented interface. After asking around, I was told I was mostly out of luck unless I was willing to destroy it because it was a 4 layer board.

I still haven’t figured that damn thing out and will probably have to resort to even more tedious methods.

Not only are there blind vias, some multilayer boards have capacitors in the middle of the stack.
Buried capacitance is typically just a thin layer for improved sheet capacitance and used primarily for supply decoupling. As such, it's not really a relevant circuit element for reverse engineering.

I've yet to see a consumer board with a buried resistance or capacitance layer. Nor have I seen discrete components somewhere in the laminate. Even things like rigid-flex or nonuniform laminate stacks across the PCB are extremely rare. Not even my cell phone has has such fanciness.

Looking forward to tearing something apart that does, however!

Blind vias and components between layers are too expensive for consumer boards.
If you have anything that's even a bit more complex (4 layer with a power and GND layer) this technique fails. However, pretty cool if you're working on 2 layer boards!
I want to make a schematic for a kbdfans keyboard. 2-layer pcb. Their tech support is negligible and their products aren’t very reliable. So my idea was to spend the money to get a schematic so at least I can debug them myself. Looked super tedious to do this myself and I have no experience anyway. So hired a guy on Upwork to do it. He ended up being a flake so I cancelled the contract. Reminds me that I should find another candidate.