TBS-3101 Phoenix interface

[gw1]

Here is another commercially made Phoenix interface I've seen recently. Its distinguishing feature is a USB socket for powering from PC. Communication is not USB based though - that is still done via an RS232 serial port.



A slider switch selects between 3.58 and 6.0 MHz options. A single LED indicates data activity.



Besides the USB power option there is also a 2.1mm DC jack but it must only be used with 5V regulated plugpacks! (eg Jaycar or Altronics ). You must not use 6-12V DC plugpacks otherwise damage is likely to occur. Positive tip is required. As the plugpack is likely to be switchmode type you should always connect the RS232 cable before applying power to avoid damage.

Most of its parts are SMD but as the board is only single-sided there are a bunch of zero ohm links. The product supports both Phoenix and SmartMouse reset modes but you can change the mode only by desoldering and moving one of the links (R7/R8).



The schematic is shown below. As you can see it's very similar to the SMP01 product I reviewed the other day. They've basically just moved to surface mount components, added the USB power option and omitted a bunch of things to cut costs - most notably the voltage regulator IC.



Though the circuit works OK it's inferior to most other products.

• No protection resistors means card insertion while power is applied carries a (slight) risk of damage.
• Routing of high impedance oscillator inputs to slide switch is bad practice and makes it susceptible to instability from noise (unlikely to be a problem in practice).
• No over-voltage protection on plugpack input is dangerous; at minimum a warning sticker should have been provided.
• A user-configurable link for Phoenix/SmartMouse mode selection could have been accommodated with a little extra routing work but it seems they were too lazy.
• There is no supply decoupling for the smartcard to speak of.
• C7 placement/routing is very poor, unhelpful for stability of the 6MHz oscillator.
• The LED connection to pin 9 avoids loading the smartcard but means that only host commands are signalled - card replies are not. That's why you don't see an ATR flash when cards are inserted.

I didn't bother measuring the capacitor values but you can bet they'll be identical to those on other products. Diode D1 appeared to be an ordinary LL14 rather than a schottky, but I tested the product with an ACS 4.1 Irdeto card and it worked fine.

Curiously they've routed handshaking signal DTR to CTS but not to DSR. If you own this product but have trouble with some software then you might like to try linking pin 6 to pin 8. While you're there I recommend you also link pin 9 to pin 5 (GND) to suppress spurious RI events.

The unit I received was faulty due to a damaged 74HC00 gate - there was nothing on clock output pin 11. Presumably that gate was damaged at some stage due to the momentary short circuit that occurs while cards are inserted and removed. Other products have current limiting resistors on RST, CLK and I/O signals to prevent that kind of thing from happening.

[fandtm666]

thanks once again for your review

[OSIRUS]

Thanks gw1

very informative

[vespas125]

How can i buy TBS-3101 Phoenix interface ?

[gw1]

Several people stock it. Here are a couple that come to mind.



This isn't a recommendation. As I indicated above, the design works but doesn't have many protection measures, ie its not as rugged as others and is more prone to burn out.

And remember, it's really designed for USB power. If you use a plugpack it should be a 5V regulated one - don't use anything higher! (It may survive 6V DC but not recommended - it may damage the ICs or your card.)

[badass]

buy them on ebay $55 from sa dreanbox clone seller

[gw1]

I've had a couple of these sent to me for repair in recent weeks but I've given up with them. They are absolute rubbish product, not built to last. I'm fairly patient but have decided they're so bad they're not worth repairing.

• Users need to remove power before inserting or removing smartcards from this unit. It has no overcurrent protection which means momentary short circuit on CLK or RST pins during insertion/removal runs risk of damaging one or both ICs. I have seen cases where this happened.
• You must NEVER use any DC adapter except for 5V regulated ones. Not even a 6V one - that's too high. If you do so there's likelihood of partial or complete failure of both ICs.
• You must connect the RS232 cable before plugging in or removing a DC adapter otherwise you run the risk of damaging the MAX232 transceiver (because of charge at switchmode output). This isn't a problem if you use USB power option, only with 5V plugpack.
• Even when damaged the MAX232 transceiver sometimes appears to be working. Eg its voltage pump may be producing 6V instead of 9V. If that happens you need to replace it for it to be reliable.
• The slide switch is a very cheap one with high failure rate. I've seen several faulty ones and replacements are hard to find. When it goes open circuit the clock signal gets corrupted (both frequencies mix together).
• The PCB material is inferior quality, as a result it's likely that several pads will lift and/or tracks be broken during SMD IC desoldering, no matter how careful you are (even if you use ChipQuik rework alloy).
• Hairline fractures on the PCB are also common, especially at the slide switch, due to poor PCB quality.

Do yourself a BIG favour and avoid this interface. Buy something else.

[jmc96]

I wish I saw this a week ago. Mine didn't even get off first base.

[princecharming]

Hi everone i am new to this but i have this programmer TBS-3101 Phoenix interface and was trying to make it work but i dont know which software to use and which card. i have gold card with me. I wanted to know how can i copy a gold card with this programmer. PLEASE HELP.

[gw1]

Phoenix interface is for sending ISO7816 commands, that's all. There aren't any standard commands for card copying that work on cards unless the program running on your particular card is designed to allow it.

A common Irdeto 1 emulator program for Gold cards is GhostGold. If you track down files for GhostGold you'll see there are 'extract CRD' scripts containing commands which ask the card program to return certain pieces of information. You can run those CRD scripts in programs like FMCard 4 and extract keys that way, but only for GhostGold. You can also do the same thing using GGEdit and LMEdit - they are programs which automatically run all the commands to extract and write card details for GhostGold.

Some emulators like GhostGold were designed for easy access to keys. Others, like AusGold and Gamma, intentionally make it difficult to obtain those keys.

So I suggest you start with GGedit or LMedit and see if they are able to get a recognisable ATR from the card and extract other card details. If not then it's probably not running GhostGold.

It's always possible to read the external EEPROM data from gold cards by reprogramming their PIC code with a loader (ICProg can do this). However you need a programmer with JDM mode to achieve that. You can't do it with Phoenix-only device like TBS-3101.

You may also be able to read the code and internal EEPROM data from a gold card using JDM programmer, but only if the card's protection fuses weren't set. Experts can bypass those fuses by various means but for beginner using standard tools it's not straightforward.

[toor]

Just noticed this post and have sold close to 500 of these all over the WWW.

Australia, Greece, Cyprus, Israel, UK, USA and NOT ONE has ever come back or received any reports that they have gone faulty or damaged any cards.

They work with cccam, newcs, mgcam etc etc never killed a card and cards dont even run hot. So not sure how you are finding all these faulty ones.

[mickcc]

Have bought this product from Sattronics pretty much the same as the one Gw1 has in this Thread but has a few extra components a U3 and a R32 have been added near the D2 diode
Tried to upload a pic but don`t know how to do that..
Mick

[gw1]

Tried to upload a pic but don`t know how to do that..

At top of is a sticky announcement .

I'm guessing the extra IC is probably either a regulator or an open collector buffer. If you can take a couple of pictures from different angles on each side, as close up as possible without blurring, that may be sufficient for us to figure out the circuit. If the new version fixes the problems I mentioned earlier I'll be glad to recommend it.

[mickcc]

This one shot of the TPS-3101 V1.3
Mick

Ooops

[mickcc]

The new TPS-3101 V1.3

Sorry best shot i could get

Mick

[gw1]

It seems they've added support for an optional voltage regulator (U3) but to save a couple of bucks they've omitted it, instead bypassing using a jumper link (R32).

Essentially it's the same circuit as earlier versions. It will work OK provided you take precautions:

1. You must remove power before inserting or removing smartcards. If you don't do this you risk damaging the 74HC00 IC.

2. If you instead use a plugpack power adapter it must be 5V DC regulated. Any higher voltage may damage the ICs and possibly the smartcard too.

3. If you use a plugpack power adapter you must take additional precaution of connecting RS232 cable before inserting power plug. Failure do to this risks damaging the SP232 IC and/or your PC's serial port. This precaution isn't required if using USB for power, therefore the USB power option is preferable.

4. Be gentle with the frequency slide switch, it's fragile.

[mickcc]

Gw1
I did get the USB and serial cables with the order
Just read that it not a Programmer ?

Sellers Discription is as follows

Phoenix Serial Programmer (3.57/6.0Mhz) UBS/5V DC with
USB and Serial cable

it does`t say interface.

Mick

[gw1]

Just read that it not a Programmer ?

That product is an interface - it interfaces (or connects) a smartard to an RS232 port.

It is also a programmer - it can be used to send key update messages to smartards, provided they've already been programmed with code.

Phoenix interfaces are not capable of programming blank smartcards though, and they're not capable of erasing/rewriting smartcard code. That's probably how you got confused.

In computer science and electronics 'interface' can mean different things but here it means an adapter or converter between two communication standards, for the purpose of enabling two devices or systems to work together. One example of an interface is a memory card adapter for camera photo cards that interfaces between PC USB port and CompactFlash or SecureDigital cards. Another example of an interface is the swipe card reader used in some places like Medicare that hooks onto a PC Keyboard and allows a PC to read a card's magnetic stripe.

A Phoenix interface is a connector between a standard ISO7816 smartcard and an RS232 serial port. The Phoenix protocol is the programming convention used by software to talk to smartcards via a Phoenix interface. The ISO7816 and Phoenix protocols together provide a uniform way for programs to talk to a variety of cards using equipment from a variety of sources and with different capabilities.

The ISO7816 standard covers physical dimensions, electrical characteristics, character-level communication and error handling, and standard message headers. Basically it provides the plumbing for communication, a bit like fax or SMS. It's up to the application or card vendor to decide what they want to say and how they'll establish trust between each other. Nobody is forced to use the standard, but the standard facilitates vendor interoperability, competition, consumer choice and economies of scale.

The ISO7816 standard covers messaging between a working card and its host. It doesn't cover the process of writing code into a blank card. There's no standard for that; it depends on what type of processor the card uses. A programmer which only supports Phoenix (and/or SmartMouse which is very similar to Phoenix) is unable to program blank cards. Those who only have a Phoenix interface can communicate with working cards, for example in a card server application or to hook their subscription card up to their Dreambox serial port, but they'll need to buy a different programmer if they want to program blank cards.

[mickcc]

Thanks Gw1
That certainly cleared that up bloody retails will sell flog anything on the market these days for a few buck can it be used as a logger?

here`s something i bought on Ebay it a SmartCard Adaptor with no chips that will go into Cam and most like read off the Cam...has a Female RS22 plug on the other end ...any ideas.
Mick

[gw1]

a SmartCard Adaptor with no chips that will go into Cam and most like read off the Cam...has a Female RS22 plug on the other end

That's a Jomac season interface. Seasons are most commonly used in conjunction with PCs running cardsharing client software. They have also been used in cardsharing client setups using rather than a PC.

Seasons can also be used in conjunction with PC-based card emulation software.

Developers use seasons when writing or analysing PC-based smartcard applications, eg for card sharing or emulation.

Season interfaces follow a convention for mapping from ISO7816 reset and data signals onto RS232, with appropriate voltage conversion. The receiver provides the supply voltage and clock, though in most cases the clock isn't used - communication relies on the PC being configured with the correct baud rate. Most season interfaces use a MAX232 transceiver for proper standards compliance. The Jomac season is a budget design that cuts a few corners technically but is sufficient for most users.

You can't use a basic season for logging though - for that you need a season logger.

Season loggers include a smartcard socket, not just an RS232 cable. The receiver provides power, reset, clock and data to the card socket, with reset and data being fed to the RS232 cable. The PCs can log (ie monitor) the communication to the card in the socket, or emulate (ie impersonate) a card if none is present in the socket.

Seasons are normally used in receivers that have embedded CAMs, such as Humax 5410, or in CAM modules fitted in CI receivers. Their use in network based cardsharing predates Dreamboxes which popularised the idea of software CAMs communicating directly to network via an ethernet interface, rather than via the ISO7816 -> RS232 -> PC -> network path which was clunky and cantankerous by comparison.