Here is a trick using a 1.2 GHz (23 cm) FM modulated amateur radio TV transmitter, an old C-band satellite receiver (with video invert option) and a TV with a baseband video input to descramble pay-per-view, or other premium cable channels. This method has only been tested on an analog AOL/Time Warner cable system - and does work. It helps if you can find a security system monitor to display the video signal, as these often have external controls for adjusting horizontal and vertical syncronization. This will help in tweaking the final results.
It works by taking the scrambled, baseband video signal and transmitting it via a frequency modulated (FM) transmitter with too much deviation. This allows a scrambled video signal with sync-suppression and video inversion to be received on a standard C-band satellite receiver via its 950-1450 MHz input. The over-deviating part allows the suppressed sync signals to actually be "brought up" in strength, and along with enabling VIDEO INVERT on the satellite receiver, a clear picture can then be seen - minus the color. There is no way to restore the color component using this method.
The TV transmitter and the satellite receiver need to be placed next to each other, if you are using simple wire antennas. Avoid connecting the transmitter directly to the receiver or you'll burn out the receiver's input RF stage.
Schematics and construction details of the GBPPR 1.2 GHz (23 cm) ATV Video Transmitter are available here:
Monitoring Spice Channel Audio on AOL/Time Warner Cable
Along with the usual video sync suppression - the Spice channel, as carried on AOL/Time Warner cable, "jams" the supplied audio carrier to frustrate any attempts on audio eavesdropping. On a normal NTSC video signal, the FM modulated audio carrier is offset 4.5 MHz from the video carrier. Example: if the center video carrier you want to receive (channel 77) is at 541.25 MHz then the audio carrier will be at 545.75 MHz (541.25 + 4.5).
On the good channels, such as Spice, the commie bastards at AOL/Time Warner actually transmit a random "noise" signal at the standard 4.5 MHz offset. The true, unencrypted audio signal is actually transmitted at a non-standard offset of 4.75 MHz, 250 kHz higher (541.25 + 4.75 = 546 MHz). If you where to directly monitor your cable TV signal, through about 20 dB of attenuation, on a communications receiver tuned to 546 MHz (wideband FM) the audio would be crystal clear.
The following schematic is a simple converter you can add to a Radio Shack scanner (Radio Shack scanners have frequencies between 520-800 MHz blocked) to downconvert a 520+ MHz audio carrier down to a lower frequency, 50 MHz lower in this case. Example: input frequency is 546 MHz, it's mixed with 50 MHz to produce a new Intermediate Frequency (IF) at 496 MHz, a frequency the scanner can receive.
If you didn't understand any of that, ask the guys from thebroken.org to explain it for you.