EMM plastro V1.4 for Dreambox
EMM plastro V1.4
by hsmpt @ GEA/FISC
-------------------------------------------------------------------------
-------------------------------------------------------------------------
1. Application
-------------------------------------------------------------------------
EMMplastro is a software to log, decrypt and analyse N@agra2 EMMs sent by
TVc@bo and Digit@l+ providers in Hisp@sat.
This software comes in two versions: one uses a Dreambox and the other is
intended to be used with a PC-DVB card.
-------------------------------------------------------------------------
2. Requirements
-------------------------------------------------------------------------
Dreambox version
- PC with Windows XP
- Dreambox with dvbsnoop
- Net connection between the two
PC-DVB version
- PC with Windows XP
- PC-DVB card (Skystar 1, 2 or compatible)
- DVB application that accepts MD ou DVBCore compatible plugins (ProgDVB,
MyTheatre, etc)
In order to use this software you just need to have access to the data
stream that comes from the antenna. Therefore even without official card,
MOSC, Phoenix, keys or CardShare, it's always possible to use EMMplastro.
-------------------------------------------------------------------------
3. Installation
-------------------------------------------------------------------------
Dreambox version
Place in a folder all the files included in the zip, namely:
- EMMplastro.exe - application
- N2hsmpt.dll - N@gra2 EMMs decrypt library
- HIME.dll - Huge Integer Math and Encryption library
- EMMplastro.ini - configuration file
PC-DVB version
Place in the main folder of the DVB application all the files included in
the zip, namely:
- EMMplastro.dll - plugin
- N2hsmpt.dll - N@gra2 EMMs decrypt library
- HIME.dll - Huge Integer Math and Encryption library
- EMMplastro.ini - configuration file
-------------------------------------------------------------------------
4. Configuration
-------------------------------------------------------------------------
Before using the software we need to edit a couple of .ini configuration
files:
- EMMplastro.ini - with some of other system's characteristics.
- Keys.ini - with the keys to open the EMM-S/U sent to user's Cards
4.1 EMMplastro.ini
If you are planning to use a Dreambox with EMMplastro it is necessary to
define all the parameters to perform the telnet connection with it. This
is done in the following section:
[Dreambox]
host=192.168.1.10 ; Dreambox IP address
port=23 ; Telnet port (23 usually)
user=root ; username
pass=dreambox ; password
prompt=~ > ; Telnet prompt (image dependent!)
4.2 Keys.ini
One factor that made EMMplastro popular was the possibility of decryption
of the EMMs even without the knowledge of any keys since they are already
integrated on N2hsmpt.dll.
This is only true for EMMs sent to all cards (EMM-G). If we want also to
open the EMMs sent to a particular card (EMM-U) or set of cards (EMM-S),
it is necessary to include the respective keys in the Keys.ini.
In section [CAM] we begin to place the number of cards which EMMs we
intend to open followed by their CAM IDs (start by 23 on TVc@bo and by 1B
on Digit@l+). These values must be preceded by the tags ID_1=, ID_2=, ...
ID_N=:
[CAM]
N=2
ID_1=23111111
ID_2=1B111111
...
Next, the RSA and IDEA keys for each type of EMM (S or U) and provider,
are defined and grouped on a section titled with the proper CAM_ID:
[23111111]
S_RSAM_hi=1234..........5678 ; EMM-S RSA key (provider 4101 or 4901)
S_IKEY_hi=1234...5678 ; EMM-S IDEA key (provider 4101 or 4901)
S_RSAM_lo=1234..........5678 ; EMM-S RSA key (provider 4001 or 4801)
S_IKEY_lo=1234...5678 ; EMM-S IDEA key (provider 4001 or 4801)
U_RSAM_hi=1234..........5678 ; EMM-U RSA key
U_IKEY_hi=1234...5678 ; EMM-U IDEA key
[1B111111]
...
The ellipses in these samples are only to show the possibility of setting
the data for more then one card, so they should not be included in the
.ini.
I remind that RSAM keys have 192 digits (96 bytes) and the IKEY keys have
32 digits (16 bytes).
Even without any key it is possible to log the EMM-S/U but not decrypt
them. For those without a card, and still curious to decrypt the EMM-S,
the keys from an inactive TVc@bo card will be used (CAM_ID = 23D8741B) if
no keys are specified (N=0). Due to its inactive state, no EMM-U will be
logged.
To simplify the building of this .ini file there is a tab in the main
window called "Settings" where it is possible to extract automatically
these keys from the card's dump containing this information (DTs).
For doing that just load the card dump hitting the proper button (after
which the keys will be shown), and press the other button to update the
.ini file. This process can be repeated with other card's dumps.
-------------------------------------------------------------------------
5. Interface and usage
-------------------------------------------------------------------------
Besides the two different versions, the user interface is the same.
To Start/Stop the logging process we must click the Active Checkbox in
top right corner.
The default PID employed to log the EMMs is 0x76 for TVc@bo and 0x91 for
Digital+ since these are the most used by the providers. Nevertheless it
is possible to change the PID in the settings tab. This is particular
useful for Digital+ since the update revision EMMs are broadcasted with
PIDs 0xC5 and 0xC6.
All EMMs will be stored in the top list, where a set of parameters will
be presented (logging time, number of occurrences, type, provider, card's
revision and group, main command, etc).
If an EMM can not be decrypt some of this fields will be blanked, and
this fact will be signalized with the word "No" in the "Open" field.
Despite the log of all EMMs we can select which to visualise using a set
of ComboBoxes in the left bottom corner. It is, for instance, possible to
see only the EMMs of a certain type (EMM-G, EMM-S ou EMM_U), with a
particular command, etc. To stop filtering the EMMs visualization by a
certain criterion just select the "All" option. Click Button "All" to
show all EMMs again.
The bottom list is use to show the "parsing" of the opened EMM. In
certain cases, double-clicking a particular line of this list, will show
a window with a more detailed explanation of the command. For instance,
in the case of the Subscription EMM-S from TVc@bo a window showing the
active cards for a particular tier with the corresponding expiration
date is shown.
Some operations can be preformed in each list using the options in their
PopUp menus. It the particular case of the first list it is possible to
Load, Save or Copy the EMMs (eventually in the Phoenix Format), and even
copy all the informations present in the lists (to paste them for Excel
for instance).
-------------------------------------------------------------------------
6. Bugs and Feedback
-------------------------------------------------------------------------
This software is on a developing stage so it is natural if some buds show
up. I will be pleased if you could report them or any other suggestions
in order to improve it.
-------------------------------------------------------------------------
7. Usage Conditions
-------------------------------------------------------------------------
This software is released as freeware and can be distributed unmodified
by any user of FISC without further limitations. It is designed to be
used as a learning tool. The responsibility to ensure its legal use falls
fully upon the End User.
-------------------------------------------------------------------------
8. Acknowledgments
-------------------------------------------------------------------------
I would like to give a special thanks to JoshyFun by making free source
his "Poor Man's CAM 2" plugin code (http://joshyfun.peque.org/PMCAM2),
which allowed the development of EMMplastro plugin easier.
Many other users (specially within GEA/FISC group) gave me a lot of help
during the development of this software, by giving me suggestions,
reporting bugs during Beta tests, share of keys. To all my thanks.
-------------------------------------------------------------------------
Best Regards
hsmpt @ GEA/FISC
EMM plastro V1.4
by hsmpt @ GEA/FISC
-------------------------------------------------------------------------
-------------------------------------------------------------------------
1. Application
-------------------------------------------------------------------------
EMMplastro is a software to log, decrypt and analyse N@agra2 EMMs sent by
TVc@bo and Digit@l+ providers in Hisp@sat.
This software comes in two versions: one uses a Dreambox and the other is
intended to be used with a PC-DVB card.
-------------------------------------------------------------------------
2. Requirements
-------------------------------------------------------------------------
Dreambox version
- PC with Windows XP
- Dreambox with dvbsnoop
- Net connection between the two
PC-DVB version
- PC with Windows XP
- PC-DVB card (Skystar 1, 2 or compatible)
- DVB application that accepts MD ou DVBCore compatible plugins (ProgDVB,
MyTheatre, etc)
In order to use this software you just need to have access to the data
stream that comes from the antenna. Therefore even without official card,
MOSC, Phoenix, keys or CardShare, it's always possible to use EMMplastro.
-------------------------------------------------------------------------
3. Installation
-------------------------------------------------------------------------
Dreambox version
Place in a folder all the files included in the zip, namely:
- EMMplastro.exe - application
- N2hsmpt.dll - N@gra2 EMMs decrypt library
- HIME.dll - Huge Integer Math and Encryption library
- EMMplastro.ini - configuration file
PC-DVB version
Place in the main folder of the DVB application all the files included in
the zip, namely:
- EMMplastro.dll - plugin
- N2hsmpt.dll - N@gra2 EMMs decrypt library
- HIME.dll - Huge Integer Math and Encryption library
- EMMplastro.ini - configuration file
-------------------------------------------------------------------------
4. Configuration
-------------------------------------------------------------------------
Before using the software we need to edit a couple of .ini configuration
files:
- EMMplastro.ini - with some of other system's characteristics.
- Keys.ini - with the keys to open the EMM-S/U sent to user's Cards
4.1 EMMplastro.ini
If you are planning to use a Dreambox with EMMplastro it is necessary to
define all the parameters to perform the telnet connection with it. This
is done in the following section:
[Dreambox]
host=192.168.1.10 ; Dreambox IP address
port=23 ; Telnet port (23 usually)
user=root ; username
pass=dreambox ; password
prompt=~ > ; Telnet prompt (image dependent!)
4.2 Keys.ini
One factor that made EMMplastro popular was the possibility of decryption
of the EMMs even without the knowledge of any keys since they are already
integrated on N2hsmpt.dll.
This is only true for EMMs sent to all cards (EMM-G). If we want also to
open the EMMs sent to a particular card (EMM-U) or set of cards (EMM-S),
it is necessary to include the respective keys in the Keys.ini.
In section [CAM] we begin to place the number of cards which EMMs we
intend to open followed by their CAM IDs (start by 23 on TVc@bo and by 1B
on Digit@l+). These values must be preceded by the tags ID_1=, ID_2=, ...
ID_N=:
[CAM]
N=2
ID_1=23111111
ID_2=1B111111
...
Next, the RSA and IDEA keys for each type of EMM (S or U) and provider,
are defined and grouped on a section titled with the proper CAM_ID:
[23111111]
S_RSAM_hi=1234..........5678 ; EMM-S RSA key (provider 4101 or 4901)
S_IKEY_hi=1234...5678 ; EMM-S IDEA key (provider 4101 or 4901)
S_RSAM_lo=1234..........5678 ; EMM-S RSA key (provider 4001 or 4801)
S_IKEY_lo=1234...5678 ; EMM-S IDEA key (provider 4001 or 4801)
U_RSAM_hi=1234..........5678 ; EMM-U RSA key
U_IKEY_hi=1234...5678 ; EMM-U IDEA key
[1B111111]
...
The ellipses in these samples are only to show the possibility of setting
the data for more then one card, so they should not be included in the
.ini.
I remind that RSAM keys have 192 digits (96 bytes) and the IKEY keys have
32 digits (16 bytes).
Even without any key it is possible to log the EMM-S/U but not decrypt
them. For those without a card, and still curious to decrypt the EMM-S,
the keys from an inactive TVc@bo card will be used (CAM_ID = 23D8741B) if
no keys are specified (N=0). Due to its inactive state, no EMM-U will be
logged.
To simplify the building of this .ini file there is a tab in the main
window called "Settings" where it is possible to extract automatically
these keys from the card's dump containing this information (DTs).
For doing that just load the card dump hitting the proper button (after
which the keys will be shown), and press the other button to update the
.ini file. This process can be repeated with other card's dumps.
-------------------------------------------------------------------------
5. Interface and usage
-------------------------------------------------------------------------
Besides the two different versions, the user interface is the same.
To Start/Stop the logging process we must click the Active Checkbox in
top right corner.
The default PID employed to log the EMMs is 0x76 for TVc@bo and 0x91 for
Digital+ since these are the most used by the providers. Nevertheless it
is possible to change the PID in the settings tab. This is particular
useful for Digital+ since the update revision EMMs are broadcasted with
PIDs 0xC5 and 0xC6.
All EMMs will be stored in the top list, where a set of parameters will
be presented (logging time, number of occurrences, type, provider, card's
revision and group, main command, etc).
If an EMM can not be decrypt some of this fields will be blanked, and
this fact will be signalized with the word "No" in the "Open" field.
Despite the log of all EMMs we can select which to visualise using a set
of ComboBoxes in the left bottom corner. It is, for instance, possible to
see only the EMMs of a certain type (EMM-G, EMM-S ou EMM_U), with a
particular command, etc. To stop filtering the EMMs visualization by a
certain criterion just select the "All" option. Click Button "All" to
show all EMMs again.
The bottom list is use to show the "parsing" of the opened EMM. In
certain cases, double-clicking a particular line of this list, will show
a window with a more detailed explanation of the command. For instance,
in the case of the Subscription EMM-S from TVc@bo a window showing the
active cards for a particular tier with the corresponding expiration
date is shown.
Some operations can be preformed in each list using the options in their
PopUp menus. It the particular case of the first list it is possible to
Load, Save or Copy the EMMs (eventually in the Phoenix Format), and even
copy all the informations present in the lists (to paste them for Excel
for instance).
-------------------------------------------------------------------------
6. Bugs and Feedback
-------------------------------------------------------------------------
This software is on a developing stage so it is natural if some buds show
up. I will be pleased if you could report them or any other suggestions
in order to improve it.
-------------------------------------------------------------------------
7. Usage Conditions
-------------------------------------------------------------------------
This software is released as freeware and can be distributed unmodified
by any user of FISC without further limitations. It is designed to be
used as a learning tool. The responsibility to ensure its legal use falls
fully upon the End User.
-------------------------------------------------------------------------
8. Acknowledgments
-------------------------------------------------------------------------
I would like to give a special thanks to JoshyFun by making free source
his "Poor Man's CAM 2" plugin code (http://joshyfun.peque.org/PMCAM2),
which allowed the development of EMMplastro plugin easier.
Many other users (specially within GEA/FISC group) gave me a lot of help
during the development of this software, by giving me suggestions,
reporting bugs during Beta tests, share of keys. To all my thanks.
-------------------------------------------------------------------------
Best Regards
hsmpt @ GEA/FISC