There are some technologies that instantly date you if you remember them.
If you started messing with TV gear in the early 2000s—or even in the late 1990s—or if you ever worked around broadcast installation, you probably know the term “Village-to-Village Radio and Television” better known as 村村通. By 2023, that system has long since been overtaken by 户户通, and the practical question of whether rural areas can watch television has mostly shifted into something more like: if there’s Wi-Fi, it hardly feels remote anymore.
Still, looking back at how this all evolved is unexpectedly interesting.
So before getting to the older “village-to-village” days, it makes sense to start with the system that replaced it: 户户通.
First, what exactly is 户户通?
Officially, 户户通 is short for “Household Satellite Live TV Service”, so in practice the name usually refers to the satellite television platform itself. The exact launch timeline is a little fuzzy, but people generally treat the launch of ChinaSat 9 at 92.2°E on June 9, 2008 as the beginning of what is now called 户户通. Strictly speaking there would have been testing and commissioning after launch, but if you only want the rough starting point, that’s the usual one.
The platform has now developed to the fourth generation. With that generation, a receiver can use BeiDou positioning to verify that the user is actually in a rural service area before activation is allowed.
But to understand why that matters, you have to look at how the platform changed over time.
The four generations of 户户通
Generation 1: open signals, cloned boxes everywhere
The first generation used left-hand circular polarization and broadcast in the clear. In other words, the data stream was not encrypted, and any compatible ABS-S receiver could open it and show the channels.
The original intention was good. The problem was what came next: a flood of unauthorized “clone” receivers.
When people talked about “clone 户户通,” what they usually meant was not some mysterious hacking breakthrough, but simply unapproved hardware from unofficial manufacturers—the kind of setup many people casually called the “small Zhongjiu dish.” Satellite TV has always been tightly regulated in China, and even a system like 户户通 was supposed to be installed only after official approval. In theory, the first-generation receivers were distributed free of charge to remote rural areas through state procurement rather than sold openly on the market.
Reality was different. Unofficial dishes spread everywhere, and for a few hundred yuan almost anyone could buy a set and install it.
That created two obvious headaches.
First, satellite reception outside the approved framework was getting out of hand.
Second, 户户通 was supposed to serve as a supplement in rural or isolated places where conventional TV service was difficult. But in practice, it was also competing directly with cable TV. If people could watch free channels, why keep paying monthly television fees?
Given those two issues, it was obvious the authorities would not just ignore the clone market.
If you lived through that era, you may remember what happened around 2010 or so. Clone receivers on the market suddenly started needing repeated manual “upgrades.” Without them, the symptoms became familiar: signal strength fluctuating, audio and video falling out of sync, picture without sound, sound without picture, total loss of channels, or even the box freezing during scans. A lot of the bad reputation attached to these devices probably dates from that period.
In urban-rural fringe areas and electronics markets, you could often see long lines of people waiting to have their boxes “updated.” Someone would plug in a serial cable, run an upgrade, and collect a “maintenance fee” along the way. Later on, even those upgrades stopped helping. Channels gradually disappeared until the receiver became useless.
Back then, the common explanation was simple: the satellite signal had been “encrypted,” so if you didn’t upgrade, you couldn’t watch.
Was it really encryption? Possibly in some cases. But looking back from today, it seems just as likely that the uplink and control platform was changing PID information—basically the identifiers for program streams, including separate IDs for audio and video—as well as frequency, symbol rate, polarization parameters, and similar transmission details. Those could be changed systematically, randomly, partially, or all at once. The platform was under centralized control, so it could be modified however its operators wanted.
After such changes, updated program tables could still be delivered by OTA to legitimate receivers, which would keep working. Clone boxes, however, often could not receive or process those updated tables—whether because their makers could not implement that support, did not bother, or cut corners on the hardware and firmware. So they continued using outdated tuning information and therefore decoded the wrong audio or video streams, or nothing useful at all.
Some reports even suggest that the platform could insert non-standard PID-coded services that genuine boxes could handle after OTA updates, while clone boxes would skip them or crash when trying to parse them. That would also explain why people used to recommend switching “from transponder 1 to transponder 2” and scanning again: the broadcast frequency itself may simply have changed.
Did this strategy seriously reduce the number of unauthorized boxes? Probably not that much. In many ways it just made life more troublesome for ordinary users while also giving manufacturers and repair shops a new business model: keep producing clone boxes, then charge for the next “upgrade,” “data fee,” “service fee,” or whatever name sounded convenient.
At one point, market reports even described sellers openly waiting for the next round of workarounds because upgrade services themselves had become profitable.
Then another odd category appeared: the so-called “dual-mode 户户通” receiver.
This was not the same thing as later satellite-plus-terrestrial or satellite-plus-cable combo models. At that time, “dual-mode” usually meant a box capable of receiving both ABS-S and DVB-S signals. By switching the receiver into DVB-S mode—sometimes directly, sometimes through a hidden menu—and removing the polarizer piece from the ChinaSat 9 LNB so that the circular-polarization head could operate as a linear-polarization unit, you could repoint the dish toward 138°E, blind scan or enter parameters manually, and suddenly you had built yourself a satellite receiver that could tune channels far outside the intended platform.
That little trick did not die because of 户户通 itself. It mostly died because other satellites moved on to DVB-S2, which old DVB-S receivers could no longer handle.
On February 16, 2017, the first-generation signals were completely shut down.
Generation 2: encryption arrives
The second generation of the ChinaSat 9 platform introduced actual encryption. According to available information, it used the NDS system, with decryption handled through an authorized CA smart card, the large card many people simply called the “big card.”
Clone manufacturers were not in a position to produce that card, and even if they had the technical ability, this was one of those cases where administrative control mattered more than engineering skill. Without the card, they could not watch the second-generation services.
For a while, officially authorized machines seemed to regain the upper hand. Only approved users could get the card, and on paper the whole system looked much tighter.
But there was an obvious loophole.
What if someone applied legally, got an authorized receiver, and then quietly carried it into the city? Or what if a rural business point activated many cards and then sold the working units into nearby urban areas?
The box might be legitimate, but the place where it was actually being used was not.
Generation 3: location checking by cellular base stations
That is where the third generation entered the picture.
The phrase “the end of technology is administration” fits here, but before you get to that endpoint, technology can still do a lot. The real problem with second-generation boxes was not that unauthorized use could never be stopped; it was that the system had no effective way to identify illegal deployment after activation. Once the machine and card left the original installation point, there was no practical feedback mechanism. Short of an in-person inspection, the platform had little idea what had happened after the box changed hands.
So around 2016 to 2017, second-generation units were phased out and third-generation receivers began appearing widely. For most people, this is the version they think of when they hear the name 户户通.
Its formal name was “Integrated Receiver Decoder for Direct Broadcast Satellite System (Encrypted SD Positioning Type)”. The key feature was right there in the name: positioning.
Instead of trusting that a box would stay where it was installed, the system required it to verify location through mobile base stations. During installation, a SIM card with data access—even GPRS was enough—had to be inserted so the receiver could send a request containing local positioning-related data to a server. One identified endpoint was:
tcp://114.251.156.67:4567
The remote server compared the base-station information, checked whether the receiver was within the approved service whitelist for its installation area, and only then sent back an unlock instruction. It may also have delivered keys or binding data so that the receiver and smart card became linked and could then decrypt the channels normally.
Once the installation was complete, the SIM card could actually be removed. The receiver would continue using base-station information for location checks, and if it later appeared to have been moved into an ineligible area—especially an urban one—it could be denied decryption.
There was also a “generation 3.5” model. From what is commonly said, the main difference was simply that 3.5 added HD channels and HDMI output. In most other behavioral respects, the two versions were basically the same.
At first glance, this looked like a nearly perfect solution.
But there is always a “but.”
Even now, if you search for non-positioning 户户通 units, you can still find plenty. As long as the third-generation signals from 92.2°E remained active, many of these modified receivers continued to work. The reason such devices existed at all usually came down to three broad paths:
- officially exempt non-positioning machines being over-issued or activated in violation of rules
- modified or cracked receivers that bypassed positioning
- “brute-force positioning”
Official non-positioning units
This category did have legitimate uses. A TV station’s headend might want a backup signal source and prefer the most stable possible arrangement. There were also clear edge cases such as nomadic populations, ships at sea, or places with no cellular base-station coverage at all. In such conditions, a location system that depends on mobile towers is not much help.
Because approval for these exempt units was much stricter, they leaked into the market less often. They exist, but they are not the main story.
Cracked non-positioning units
This became the mainstream route.
Early methods included plugging a module into the receiver’s rear serial port to bypass controls, although some required regular manual intervention to keep decoding active. Other methods involved soldering a small module onto the infrared receiver so that it could simulate a special sequence of remote-control key presses. Later methods became more direct, with modules soldered onto specific debug pads or test points on the board.
Those later modifications typically did one of two things: either they injected fake whitelist base-station data into the GSM module’s returned information, or they completely hijacked the GSM module so that the receiver always believed it was seeing a fixed, acceptable tower environment.
In essence, all of these approaches exploited receiver bugs or design weaknesses to remove the location requirement.
“Brute-force positioning”
This one is conceptually simple.
The basic logic of the receiver was that if it could still detect at least one base station that had been seen during the original activation, it was allowed to keep decrypting. The stock antenna used by a 户户通 receiver for mobile signal reception was just a short little rod with modest gain.
So the brute-force trick was to activate the receiver in a suburban or rural edge area, remove the original antenna during that initial process, and replace it with a high-gain antenna. That way the box could collect base-station signals from a much wider surrounding area and pass them all into the system during setup. Afterwards, the receiver could be taken into the city and might still barely pick up one or two of those originally approved towers from afar—just enough to keep functioning.
As always, every workaround invites a countermeasure.
The official response was fairly blunt: require manufacturers not to leave accessible debug interfaces, require ports to be sealed with glue, and impose inspection rules that hardware would have to pass before production approval. Again, when control is administrative, technical elegance is optional.
And yet cat-and-mouse games do not really end. Modified non-positioning units still surface on the market from time to time. Where exactly they come from, how they were made, and how long they remain watchable are questions that often have no clear answers.
Generation 4: BeiDou takes over
One thing strongly promoted in China over the years is BeiDou, and among its functions is satellite positioning. So the natural next step was obvious: what if this replaced mobile-base-station positioning altogether?
That is how the fourth-generation ChinaSat 9 receiver arrived.
The biggest change from the third generation is the positioning method itself: it moved from mobile base stations to BeiDou positioning. Just as important, the positioning capability was integrated much more deeply into the hardware. Instead of leaving room for an easy external module or obvious interception point, the design folded the location function into the core solution in a way that made the old style of modification much harder.
So far, at least on any large scale, there has not been a widespread wave of modified non-positioning fourth-generation boxes. The best most people can still do is work with modified generation 3.5 hardware.
Fourth-generation units also use a special LNB with a built-in BeiDou reception module. The positioning data is sent back to the receiver through the coaxial cable, so these boxes need that dedicated LNB. If you swap it for an ordinary circular-polarization LNB, the receiver loses positioning and stops working properly.
For now, at least, 户户通 seems to have the upper hand again.
Whether that remains true a few years from now is another question entirely.
Before 2008
And that brings us back to the earlier era—the one before 户户通 took shape in its current form, when “Village-to-Village” still defined the discussion.
That part belongs to the next installment.