Had some issues with the big dish.. namely, my 15 year old actuator arm seized up. I was able to put another used one I had laying around into service for the time being but I'm going to ultimately need to buy a new one.
Anyway, I got my box locked onto a Compel stream on G17 and it immediately said it was "not authorized." and gave me it's own style of "blue screen of death." This did not cripple my receiver or attempt to put it back under network control. I'll be pulling out the EEPROM and checking what, if anything, was changed for my notes.
There is still the potential of using what I put forth for malicious purposes, but that's only if Wegener has a bug in the firmware for the 68711 processor (I.E., a malformed piece of data inserted into the EEPROM causing an overflow allowing code execution. EVEN THEN, the decryption is done on a custom logic chip, that you'd need to read (but can't)) However, I feel that the information that I have figured out is by no means enough to do anything illegal.
Here's the jist of what is required, a full writeup is forthcoming. It's ridiculously simple. All you need to do is remove a socket-ed serial eeprom from the mainboard and blow away all the configuration information on it with the exception of the first ~10 bytes, which contain a unique ID, serial #, and checksum. The receiver can then rebuild any configuration information on it's own, or you can also write it to the eeprom yourself to save time pressing buttons on the front panel.
I'll provide a simple circuit that uses a PC serial port, 2 zener diodes, some resistors, and a power supply to read/write to most any serial eeprom. I will also give a what's-what listing as to where parameters are stored, and how to manipulate them to change settings.
If you have a locked down Unity 4000, don't throw it away...
I have a busy weekend ahead of me and hope to have this information neatly formatted on a website sometime next week. If you already have a serial eeprom reader or know how to make one, feel free to take yours out and dump the config, MAKE A BACKUP, and play around.