Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

X

xosef1234

Registered
Messages
107
drhans said:
The PIDs are on Lyngsat :)
But since it's T2-MI, the whole mux is contained in PID 1000, including the PMTs.
I think it's a little nice challenge for aspiring coders to write a simple stream-relay-type tool that will decrypt, demux and stream.
Click to expand...

If I understood correctly it should work already on enigma2 receivers with satdreamgr and astra-sm.
 
D

dale_para_bajo

Registered
Messages
646
Do not know about enigma.

But I recall reading some Colibri paper where he speak about similar encapsulation on sat 30W for Spain TV channels. I am not sure but I think that where he got the "03". Just forget about that. But I look and I can not find that paper.
 
D

dale_para_bajo

Registered
Messages
646
xosef1234 said:
If I understood correctly it should work already on enigma2 receivers with satdreamgr and astra-sm.
Click to expand...

You are my Today Hero! Nice info.

https://gitlab.com/berdyansk/astra-sm
In particular T-MI Encapsulator
https://github.com/newspaperman/t2-mi

This is a commandline T2-MI baseband frame extractor. It will read a MPEG TS containing a T2-MI data stream from STDIN and output the extracted MPEG TS to STDOUT

Usage: 1)Use a tool like szap-s2 to tune a transponder 2)Find out the Data PID that contains the T2-MI stream 3) Use dvbstream and pipe to t2-mi and pipe to your video-player

For example: dvbstream -o 4096 | ./t2-mi 4096 1 | vlc -- -
Click to expand...

Also search for Multistream and How to use T2-MI

So I guess we need to modify poc to decript pid 1000. Then some how insert in the previous pipe to do decrypting.

Or make a new Module using Anubis_ir Tanberg as base, thenn add previous T2-MI decapsulator.

We have all. Now I do not understand this "MultiStream" ready USB PCSAT requirement. Do we really need that?

Another day of good learning. Thanks drhans, kebien and xosef1234.
 
D

dale_para_bajo

Registered
Messages
646
Last edited:
K

kebien

Registered
Messages
1,329
drhans said:
The PIDs are on Lyngsat :)
But since it's T2-MI, the whole mux is contained in PID 1000, including the PMTs.
I think it's a little nice challenge for aspiring coders to write a simple stream-relay-type tool that will decrypt, demux and stream.
Click to expand...

The problem could be to sync the ecm decryption with the streaming,since ecm comes outside the piping.
It is true the CWs are changing at a more relaxed pace (about 6~8 seconds) and could be better for stream relay.
Maybe could be possible to build a plugin that will decapsulate the stream and delay CWs delivery if any blackout shows up.
Anyway,all good information about T2 here.
 
D

dale_para_bajo

Registered
Messages
646
kebien

It is true that the Real Transponder is encapsulated in T2MI. All inside PI 0x1000.

But be aware that the ECM ONLY affect the outside Pid 0x1000. It has nothing to do with the de-capsulation process. So no need for CW delays.

Now imagine again your Module Scenario.

The Main APP Scan the transponder and Assign a Channel to ServiceID = 800-T2MI_RCN. I do not have access to that transponder. So I will assume it show up as a Data Channel. ONLY 1 Channel show up in Main App. ( Ignoring the Secondary Empty Channel "ServiceID = 65534 - PDG Service"

I have limited experience to none in module creation. Well in fact I had failed all attempts. I think it has to do with DLL compatibility since I use GNU Compiler. So disregard that for now.

My best guess is that a Module or a MDAPI Plug will have no trouble to access the Data Channel. Module will have no trouble using Tandberg de-encryption method publish by Anubis_ir. The T-MI de-encapsulator at
https://github.com/newspaperman/t2-mi

work 100%.

So Module at the end can produce a TS Stream composed of the new Real Transponder.

!!!!!! Now the obstacle. How this New Hidden Trasponder can be Analize by the Main App ( for example DVBdream) to recreate the Hidden Channel list so you can Easily Tune as you normally Do.

My Best Guess is by Duplicating the Data Channel & Renaming it.
But How do we make sure that the OLD in the Clear TS Pids PAT.PMT etc do not create conflicts. How does the MAIN APP will behave when you force the Copy of the Channel and Change its Definition, from Data PID to VPID APID etc.

I do not see that coming easily. My best guess will be to Open a Stream output to VLC. And selecting the Channel inside the Module Menu!.

To be honest I been study the possibility all day. Here are my options on Win7.

*Do not Use MAin APP. Instead we stream direct from USB PCSAT CARD using crazycat StreamReaderEx. Well assuming you have a USB PC CARD compatible.

So a new small C++ app will be crated to use StreanReader.dll. It will Decrypt Tanberg and Unpack T2-MI. leaving open full hidden ransponder.

Now we could have MAin App to Read Stream or VLC thru the use of some special commands that can Select Audio and Pids to be reproduce.

It is true on a Linux Machine, Oscam/Osemu can in fact do all this. Well there are Cygwin versions od Oscam for Win7.
 
D

dale_para_bajo

Registered
Messages
646
Second.
Do all with separate instances of VLC! hard to do but not impossible I guess. Unix has attack this better as VLC has cvlc command line.

But You could us a vlc that has been disable its GUI. This will tune an stream to IP1_port1. Then our C++ App read IP1_port1 Decrypt/De-encapsulate create IP2_port2. Now we can again use Main APP like DVBdream to read the Clear Stream. Or use VLC.

See without having plugin experience Thats all I can come up.
 
D

dmr0x

Registered
Messages
290
those who figured out the tls spanish biss enc abertis mux's should be able to create a realtime solution.
 
K

kebien

Registered
Messages
1,329
dale_para_bajo said:
kebien

It is true that the Real Transponder is encapsulated in T2MI. All inside PI 0x1000.

But be aware that the ECM ONLY affect the outside Pid 0x1000. It has nothing to do with the de-capsulation process. So no need for CW delays.
Click to expand...
If you are going to decapsulate and streanrelay,there could be a sync problem to deliver the CWs to the CA device.
Exactly because it is outside,the emulator decrypts the Ecm as it comes,but not the video and audio since it takes a bit to decapsulate and stream.
Not saying blackouts will happen,but is possible.
In Enigma,the stream takes some seconds to reach VLC.
 
D

dale_para_bajo

Registered
Messages
646
Kebien

I am not trying to contradict you. As always I admire your knowledge & experience. But here is really simple situation that maybe you have not seen.

1rst. We are talking ONLY of this transponder as is the ONLY sample I had been given.

In this example ONLY Pid 0x1000 is encrypted with tanberg. The ECM is 0x387. ALL pids (0x1000 & 0x387) required for decryption are in plain view. So 1rst we do decryption of 0x1000. (No delays are involved here) Now you have Pid 0x1000 decrypted (FREE of any delay or encryption). Please notice this simple issue you seems have not understood. Except for internal tanberg decryiption. No CWs are involved.

So, second step you take TS binary file JUST with PID 0x1000 and decpasulate T2-MI. You end up with a NEW TS file. But since T2MI has been removed NEW TS contain now NEW Real FULL transponder with many Pids. See.

Click to enlarge

Here is where Selection of Channel to View come ups. We are inside Module and Main App does not Know what is inside decrypted/decasulated new FULL TS. In fact I suspect that if we returned to Main App All this new Pids a Huge conflict may apear as Main App will not know what to do as Is Only expecting a Vpid/Apid to show on screen.

So my limited ( almost 0%) expewrience in Modules allow me to think ONLY that Our New Module will have to Some how Select What Channel and return ONLY expected Vpid/Apid. And that this Vpid/Apid will have to be manually configured in our copied/transformed channel property I mention on previous post.

So all this confusion or not knowing how to implement got me to a simplier solution of not using Main APP and just Read directly from USB PCSAT, decrypt & decapsulate and stream new Channel to VLC. Just for Fun Learning.

Once a master in Modules here show us the proper implementation on a module then we could try to build a module. But once again ALL my past module for the most part failed. Well I have one exception a small Biss plugin I build for MDAPI. Base and translated from Delphi to C++/Mingw/wxwidgets.

Now I can really expect that master anubis_ir will do all this in a simple modules after a couple of minutes of work. As only the new t2-MI de-capsulation method is required and was given to us as free open source I already posted.

Now ON Linux if you read the read-me of open source T2-MI
is is only a simple PIPE command. author newspaperman suggest

Code: 
dvbstream -o 4096 | ./t2-mi 4096 1 | vlc -- -

And we only have to add our decryption routine inside that pipe line.
 
Last edited:
ViaHussun

ViaHussun

Donating Member
Messages
4,098
dale_para_bajo said:
Kebien

I am not trying to contradict you. As always I admire your knowledge & experience. But here is really simple situation that maybe you have not seen.

1rst. We are talking ONLY of this transponder as is the ONLY sample I had been given.

In this example ONLY Pid 0x1000 is encrypted with tanberg. The ECM is 0x387. ALL pids (0x1000 & 0x387) required for decryption are in plain view. So 1rst we do decryption of 0x1000. (No delays are involved here) Now you have Pid 0x1000 decrypted (FREE of any delay or encryption). Please notice this simple issue you seems have not understood. Except for internal tanberg decryiption. No CWs are involved.

So, second step you take TS binary file JUST with PID 0x1000 and decpasulate T2-MI. You end up with a NEW TS file. But since T2MI has been removed NEW TS contain now NEW Real FULL transponder with many Pids. See.

Click to enlarge

Here is where Selection of Channel to View come ups. We are inside Module and Main App does not Know what is inside decrypted/decasulated new FULL TS. In fact I suspect that if we returned to Main App All this new Pids a Huge conflict may apear as Main App will not know what to do as Is Only expecting a Vpid/Apid to show on screen.

So my limited ( almost 0%) expewrience in Modules allow me to think ONLY that Our New Module will have to Some how Select What Channel and return ONLY expected Vpid/Apid. And that this Vpid/Apid will have to be manually configured in our copied/transformed channel property I mention on previous post.

So all this confusion or not knowing how to implement got me to a simplier solution of not using Main APP and just Read directly from USB PCSAT, decrypt & decapsulate and stream new Channel to VLC. Just for Fun Learning.

Once a master in Modules here show us the proper implementation on a module then we could try to build a module. But once again ALL my past module for the most part failed. Well I have one exception a small Biss plugin I build for MDAPI. Base and translated from Delphi to C++/Mingw/wxwidgets.

Now I can really expect that master anubis_ir will do all this in a simple modules after a couple of minutes of work. As only the new t2-MI de-capsulation method is required and was given to us as free open source I already posted.

Now ON Linux if you read the read-me of open source T2-MI
is is only a simple PIPE command. author newspaperman suggest

Code: 
dvbstream -o 4096 | ./t2-mi 4096 1 | vlc -- -

And we only have to add our decryption routine inside that pipe line.
Click to expand...


Hi,
Firstly I wish you success in your work.
I know this is not the place here but a lot off users expect new work from you for 42 east tandberg channels.
If you do not want to do such a work, We will be very, very happy if you open a new topic about how ECM keys are found and make with picture narration

Thanks dale_para_bajo :thum:
 
U

uglylove

Registered
Messages
146
ViaHussun said:
Hi,
Firstly I wish you success in your work.
I know this is not the place here but a lot off users expect new work from you for 42 east tandberg channels.
If you do not want to do such a work, We will be very, very happy if you open a new topic about how ECM keys are found and make with picture narration

Thanks dale_para_bajo :thum:
Click to expand...

Don't make dreams my friend. No one won't help you for this. Even it was. That method will be outdated as fast as possible.
Possessed of packet gave allow to watch channel and people watched channels 2 months and more.
Remember! Keys were public in everywhere and keys had changed just two times. Last keys changing was like border. After that, a few keys are found by Xperson. Suddenly, those keys became very important and inhibited to share. Even inhibited to share didn't help not to keys down.
Long story short, Now, Possessed of packet don't allow. it's very simple.
 
Last edited:
D

dale_para_bajo

Registered
Messages
646
I do not understand uglylove comments. But it does not matters. I already express my personal concern about providers with high value content.

In particular 42E has shown us that is the source of Software Upgrades that in days propagates to all regions of the world. At the moment we where lucky that anubis_ir found a solution for last software upgrade. But that can be consider an exception as in the past we has seen how ECM developers improve their skills and new software upgrades become unbreakable. We have a few, just the latest like I-cable and MTN are good sample.

Now a key takes long time to be found. And as soon as it is release in PRIVATE, one of our high rank user will post key on other public forum. Then two days later key is change. Making all effort lost, including burning a GPU/PC for days, electric bill and not able to use the PC for days. And that is just for 1 key/channel.

Just my personal opinion. I know others may think different. Finally, the World is not making a coup against Turkey. I know you are good people. But it just happens 42E main foot print belongs to that country.
 
U

uglylove

Registered
Messages
146
dale_para_bajo said:
I do not understand uglylove comments. But it does not matters. I already express my personal concern about providers with high value content.

In particular 42E has shown us that is the source of Software Upgrades that in days propagates to all regions of the world. At the moment we where lucky that anubis_ir found a solution for last software upgrade. But that can be consider an exception as in the past we has seen how ECM developers improve their skills and new software upgrades become unbreakable. We have a few, just the latest like I-cable and MTN are good sample.

Now a key takes long time to be found. And as soon as it is release in PRIVATE, one of our high rank user will post key on other public forum. Then two days later key is change. Making all effort lost, including burning a GPU/PC for days, electric bill and not able to use the PC for days. And that is just for 1 key/channel.

Just my personal opinion. I know others may think different. Finally, the World is not making a coup against Turkey. I know you are good people. But it just happens 42E main foot print belongs to that country.
Click to expand...
Maybe contents are high value.Maybe!!!(For me they're mass of garbage)
Also, those channels are not most people watched channels.
If you can hack DigiTürk, It will be awesome. Specialy, Lig's channels.
Somewhere you're right. There is a lot effort to find keys. I appreciated always like this works and efforts. When i thought what happened, It was very strange for me. You got it.
This sentence is our proverb. "All world can be against Türk, One Türk is enough to all world."
I didn't think you or different people are against Türk.
 
Last edited:
K

kebien

Registered
Messages
1,329
Dale para abajo

I Understand you are saying the encryption is applied to pid 0x1000,and not to audio and video directly.

I was thinking that you would need to decapsulate first,then decrypt audio and video after you get their pids.
It surely works much more different than any other system where you need to build a channel in order to decrypt.
My bad,but have more questions.

This system requires to decrypt first the mux,in order to build the channel list,in a 2 phases channel scan process.
Are you sure this works this way?
This also imply that a DVB T2 receiver that has no conditional access (like a PC tuner card),would not be able to scan a build a channel list off this transponder.
How do you think the people that posted in Lyngsat their channel PID's knew where they were if PID 0x1000 is encrypted and cannot get to the PMT?
Such an enigma,huh?
 
S

sezgin 2

Registered
Messages
210
dale_para_bajo said:
I do not understand uglylove comments. But it does not matters. I already express my personal concern about providers with high value content.

In particular 42E has shown us that is the source of Software Upgrades that in days propagates to all regions of the world. At the moment we where lucky that anubis_ir found a solution for last software upgrade. But that can be consider an exception as in the past we has seen how ECM developers improve their skills and new software upgrades become unbreakable. We have a few, just the latest like I-cable and MTN are good sample.

Now a key takes long time to be found. And as soon as it is release in PRIVATE, one of our high rank user will post key on other public forum. Then two days later key is change. Making all effort lost, including burning a GPU/PC for days, electric bill and not able to use the PC for days. And that is just for 1 key/channel.

Just my personal opinion. I know others may think different. Finally, the World is not making a coup against Turkey. I know you are good people. But it just happens 42E main foot print belongs to that country.
Click to expand...

If it takes a long time to find the keys, share the documentation of how the keys should be found.It may not be your time.Those who have time, they find a key.Do not talk empty and do not be polemic.
 
Last edited:
You must log in or register to reply here.
Top