Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

[morgon]

Very thanks Anubis_Ir :thum:
no virus
Hello, poc1.6-win-bin format on how to write, please enlighten
REM POC debug.ts 1 out.ts
POC debug.ts 1 out.ts
Pause
THX

 

[satelitindonesia]

Update ECM

Nano
- type
- length

81 70 2A EC 28 00 00 00 84 FF E0 4F AA E0 BF DD E1 97 44 2D 33 4F E7 58 11 07 84 F9 37 B9 24 1B 78 FF 66 B6 7F 2A A3 43 8E 8A 93 1D B6

 

[nautilus7]

Yes, there are 2 new different ecm types (extracted from the 2 files uploaded recently):

81 702A EC 28 00000084 FF E0 1ACB9BC53C5232BC716A50B248DAD1CD7B9CF65E994873C4196FBBBFC0372B1817E3
81 702A EC 28 00000084 FF E0 6DDCC28B3123EFAD74B7C126AE24BFBCC3894059D9C730FB1BD22A43CA62BA5CED4C
81 702A EC 28 00000084 FF E0 94B27106D3F31C7BA5AE18B73C497E649D35AB57582F43E72B622FA6DEB182DD57E3
81 702A EC 28 00000084 FF E0 D44C5449166B63E3E75D8C90A19CD9035A5AE4FEB182D84534ABECA09CDAD83BFB63

81 702A EC 28 00000691 FF E9 0FED7CD8E2D75352EB0FEDFBFC9D501AF079F015362950DDDF40E9A8E5EC287DEC63
81 702A EC 28 00000691 FF E9 21D2F2F213973FC0E4DFD2647F976085CA4FC48EAA08FA3DBF3E27A23EE6AB83437C
81 702A EC 28 00000691 FF E9 786E34B9DFDE153022DDBC20C06331FD768E5E1F7A05713A3B42321C58F67FDDF5BA
81 702A EC 28 00000691 FF E9 096AAEC798DEA1367AEA71DFDB67B451290567852849E22F898A25331CD2A15357E3
81 702A EC 28 00000691 FF E9 BC2F1DD34E44F3C9807401A9A81A35C3A4D1CFCD1D07B3D0F1C7A045469213A54D70
81 702A EC 28 00000691 FF E9 0B2A343B13E310820CCAA1947B371B61042DE427EB1FDCE5D96DBFA35EAFFCCBD7E3
81 702A EC 28 00000691 FF E9 5380AC8D75E7D87982625024C5CC32E0BB2EE7F57AFA06FA92E3E8DD9F9F83972A63
81 702A EC 28 00000691 FF E9 367E0751691B124FE2B365CD1CA3939088BA6F3771D56FF00498E02A3BFF680D4963
81 702A EC 28 00000691 FF E9 05F9C8E5A06BF751C9E9B6C86C6ABBA45B7EF0416C63839AE9131051F3EA5AA18863

80 702A EC 28 00000084 FF E0 0CF6186F6BF65A83D99A54D565645814123AC85025647F87836F88CCF6209636F3AC
80 702A EC 28 00000084 FF E0 333659FE0CF32784EC04623EA1DDEED99541C086B6836170F025DAEE311D2D1EB48C
80 702A EC 28 00000084 FF E0 BAAEBD83900CC1FED1EAE38C4B05C6D3B5EE6693C6493EC1244328EB0F56E5995F7E
80 702A EC 28 00000084 FF E0 D1F98348103B2E35553C202AD761CAA1CC4713530ED2EB8D6F4CA14B153D24357B9C
80 702A EC 28 00000084 FF E0 D844BD31801E5A5F83727232BC08E224AF665ADEC6A38EBABD67B7BC9D3268E72E68
80 702A EC 28 00000084 FF E0 5601578A1592D862B9BA6E8BC5CB385C185F8F4DF74143D162392AEB382E20E76263

80 702A EC 28 00000691 FF E9 E100834952088EC6ED47D624CF32650F57DD056534F681CD0C6B6FA61B2219B062EE
80 702A EC 28 00000691 FF E9 E8B3DB08A453555847256EBA0AF0EB770B458909D3F1884736EA31CAA94CD279AFEE
80 702A EC 28 00000691 FF E9 E1BEC3B0F452D0AD054B79EF29F0391C0A339BD338792A2B6AD7AAD83A74C274B463
80 702A EC 28 00000691 FF E9 751E10EB67F2853D3AFA2793B3F739FFE0792D1A9B4863BC8120CA20315C39693152
80 702A EC 28 00000691 FF E9 BB3945ECC3BFBDA626169B2F4A73B0FDB56425D22996F95FF2ED63772DA84B2AE563
80 702A EC 28 00000691 FF E9 6851F11B6CBFB19BD511AFEF12C1CA9A6CFE1880B95B1D530F1550A4F3DDC98317E3
80 702A EC 28 00000691 FF E9 90598986F27351F235CFEF78E89558B8D4FDAA1B81805E9A753CE615F35A63C84864
80 702A EC 28 00000691 FF E9 3B8975A5B4097394DEAD69149F75E702DB3842D779D7E3DF54AB779851995EE49763

 

[nautilus7]

And 2 new emm types that look odd:

82 70B4 01 DE 1D 82 01 B825 71 02 08 00 20 349A F02C E0 2A FF 01 00000000000000000000000000010000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 9126 71 02 08 00 20 1F63 F02C E0 2A FF 01 00000000000000000000000000010000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 26D5 79 02 08 00 20 239C F02C E0 2A FF 01 00000000000000000000000000010000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 C328 89 02 08 00 20 D7E3 F02C E0 2A FF 01 00000000000000000000000000010000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 2675 97 02 08 00 20 6E36 F02C E0 2A FF 01 00000000000000000000000000010000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 902A 71 02 08 00 20 49C2 F02C E0 2A FF 01 00000000000000000000000000010000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 65 01 FAEA 0F 02 08 00 20 B2E0 F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 6937 71 02 08 00 20 70AA F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 5326 71 02 08 00 20 B608 F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 65 01 976A F4 00 08 00 20 17C6 F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 65 01 A399 F4 00 08 00 20 B24A F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 65 01 599F F4 00 08 00 20 FC8C F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 DDB9 97 02 08 00 20 E9D8 F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 393B DA 02 08 00 20 1363 F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 D1A2 D5 02 08 00 20 8C4E F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 5BDB D5 02 08 00 20 CA8C F02C E0 2A FF 01 00000000000020000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 8115 89 02 08 00 20 B37A F02C E0 2A FF 01 00001000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 2F0D 7F 02 08 00 20 0806 F02C E0 2A FF 01 00001000000000000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 41FD E3 01 08 00 30 AAB8 F02C E0 2A FF 01 00000000000000000000000000000020000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 D288 97 02 08 00 30 17E3 F02C E0 2A FF 01 00000000000000000000001000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 B399 97 02 08 00 30 52DA F02C E0 2A FF 01 00000000000000000000001000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 9D93 97 02 08 00 30 01B8 F02C E0 2A FF 01 00000000000000000000001000000000000000000000000000000000000000000000000000000000
        01 DE 1D 65 01 8425 79 01 08 00 30 4B8C F02C E0 2A FF 01 00000000000000400000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 6B8B 97 02 08 00 30 65E2 F02C E0 2A FF 01 00000000000000000000001000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 D945 71 02 08 00 30 256A F02C E0 2A FF 01 00000000000000000000004000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 2173 DC 01 08 00 30 D7E3 F02C E0 2A FF 01 00000000000000000000000000000000040000000000000000000000000000000000000000000000
        01 DE 1D 82 01 2D83 DC 01 08 00 30 17E3 F02C E0 2A FF 01 00000000000000000000000000000000040000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 8C59 00 03 08 00 30 D5B0 F02C E0 2A FF 01 00000000000000002000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 6861 DC 01 08 00 30 C2B8 F02C E0 2A FF 01 00000000000000000000000000000000040000000000000000000000000000000000000000000000
        01 DE 1D 82 01 7698 97 02 08 00 30 D7E3 F02C E0 2A FF 01 00000000000000000000000000000000040000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 E664 C2 02 08 00 30 4C04 F02C E0 2A FF 01 00000000040000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 D241 FB 02 08 00 30 D7E3 F02C E0 2A FF 01 00000000000000000800000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 0FAE 97 02 08 00 30 8A7E F02C E0 2A FF 01 00000000000000000000000000000000200000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 6600 92 02 08 00 30 1214 F02C E0 2A FF 01 00000000000000000000000000000020000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 9B50 92 02 08 00 30 D7E3 F02C E0 2A FF 01 00000000000000000000000000000020000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 B051 09 03 08 00 30 17E3 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 DF42 FB 02 08 00 30 F252 F02C E0 2A FF 01 00000000000000000008000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 65 01 3ABC 78 01 08 00 30 57E3 F02C E0 2A FF 01 00000000000000000000000010000000000000000000000000000000000000000000000000000000
        01 DE 1D 65 01 A26C 41 01 08 00 30 579E F02C E0 2A FF 01 00000000000000000000000010000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 65 01 6046 41 01 08 00 30 EEF8 F02C E0 2A FF 01 00000000000000000000000010000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 92CD D5 02 08 00 30 4663 F02C E0 2A FF 01 00000000000000000000020000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 23E2 D5 02 08 00 30 F8F4 F02C E0 2A FF 01 00000000000000000000020000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 659F D5 02 08 00 30 B9BA F02C E0 2A FF 01 00000000000000000000020000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 53B8 D5 02 08 00 30 5984 F02C E0 2A FF 01 00000000000000000000020000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 4B53 FB 02 08 00 30 F01E F02C E0 2A FF 01 00000000000000000000000010000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 E853 FB 02 08 00 30 9B63 F02C E0 2A FF 01 00000000000000000000000010000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 4848 FB 02 08 00 30 2363 F02C E0 2A FF 01 00000000000000000000000010000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 6559 FB 02 08 00 30 7ECC F02C E0 2A FF 01 00000000000000000000000010000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 4E3E 0C 02 08 00 31 9163 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 16E1 3D 02 08 00 31 E6A8 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 9E22 27 02 08 00 31 6E9E F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 CBDD FB 01 08 00 31 6E63 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 B08D 09 03 08 00 31 D326 F02C E0 2A FF 01 00000000000000000004000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 58F7 FB 01 08 00 31 6CA8 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 9DE6 FB 01 08 00 31 17E3 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 71ED FB 01 08 00 31 D7E3 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 A818 C2 02 08 00 31 D7E3 F02C E0 2A FF 01 00000002000000000000000000000000000000000000000000000000000000000000000000000000

82 70B4 01 DE 1D 82 01 52D6 FB 01 08 00 31 2CD6 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 6053 FB 02 08 00 31 6C60 F02C E0 2A FF 01 00001000000000000000000000000000000000000000000000000000000000000000000000000000
        01 DE 1D 82 01 10CA FB 01 08 00 31 8530 F02C E0 2A FF 01 00008000000000000000000000000000000000000000000000000000000000000000000000000000

83 700A 00 20 31EE F004 E7 02 FFFF
83 700A 00 21 6A63 F004 E7 02 FFFF
83 700A 00 30 111E F004 E7 02 FFFF

 

[dale_para_bajo]

Yes, there are 2 new different ecm types (extracted from the 2 files uploaded recently):

1-I seen only
http://www.sat-universe.com/redirec...T!ccCL61G5Nm4zSaLuqQVqgr5_IlrTsDx4Mvx2Sucqdpk

Where or witch is the other?

2-Also if some one has TestCard of IMG3 in the Clear/Not encrypted I will appreciate a small log.

3-Has some one try to mod poc. I guess simple test is shifting the NANO by the new two bytes. I been busy but I guess I will try that.

 

[nautilus7]

Here is the other one: http://www.sat-universe.com/showpost.php?p=2036807274&postcount=285

Just to add that among with the new emm types there are the old "82 7092", "83 7022" and "83 7048" aswell.

Maybe the new emm types are related to over-the-air firmware update? How knows.

 

[dale_para_bajo]

I did try mod poc with the simple of the ideas. Use the ECM key that pop up as is, but no luck it did not work.

Please if some one have a Clear Test Card

I will appreciate small log of video in the clear.

I guess logic tell us to wait for one of the masters to do the reverse engineer. I do have some crazy Ideas to test. But now I have to sleep some time.

 

[abra26]

Audio PIDs are still FTA. But I guess it's not what you need, right? If I will catch clear test card, I'll try to record 1min and post it. (Is 1min enough?)

 

[dog-man]

It's in biss at the moment.

 

[su1tz]

It IS a test card right now ( 15:32 GMT/UTC )

 

[dale_para_bajo]

Listen guys it may not seems important to you. You have good antennas or are in the foot print. So you tune any time you may like. And there it is your own private signal reaching your own place. NICE...

But sadly I am to far nor I have a good antenna. So to me logs is the ONLY info I may have. Now here we have 10 guys actively posting. Maybe 100 in the back ground. And ONLY 2 old post of logs has been submited. See my point. This is not a complaint but and ask to give a hand.

Now in the past I suspect Software Upgrade was reverse engineer and its logic dump into poc. Good people did that work. But for what ever reason they no longer post. So we can sit and wait for hope our leaders or champion or the two superman as they been called show up. By the way I do have that hope too.

Or we can have some fun and for SURE WASTE OUR TIME trying. But we can learn in the process.

Now as many other have posted, we suspect that the transponder is use by two different providers as one is Biss and the other Tanberg. Still as we do not know even the BISS record can be useful. As at the moment we no other info.

Now I ask a TEST CARD log in the clear. I do hope to received a Record of the TEST CARD when was decrypt by Tandberg with the previous key. But of this transponder any one.

A log in BISS will be also nice two have.

I may be out some time as I have a crazy Idea to program and test, hope it will be fast.

About Logs. Please DO NOT USE TSReader for loging. TSReader change things in the reacord. Minimum it does it signed the log with its name. For logs I do prefere if you turn all your Plugins off and use TSWriter2 and log the whole transponder. Lets say 30 seconds. If you submit a BISS encrypted and know the current key please let us know where to find it. Thanks.

 

[unimade]

40 seconds of FTA test card, recorded @ 12:09 CET


https://mega.nz/#!9XIAWaDA!HwpJihXdIbKc7Bu8zC1cos-8x4Zc6zGQBoFwfsZR8II

 

[Ragnarok]

I don't think they have really pushed the new software out yet.

There was talk of the new software being up a few weeks ago but we haven't seen any test cards with any warning of new software, upgrade to keep the service type messages.

I suspect until we see those messages it's just testing. they'll roll it out fully when they put the software up again with such warnings.

There is defiantly a mix of old and new EMM's in the emm stream currently.

 

[SKYSTAR.2]

Update poc v 1.6 UPLOAD PLEASE link TS version

 

[awww]

no tendbrga new is old tendbrga img3

 

[dale_para_bajo]

@unimade Many thanks for the logs. Test Card explains a lot what is going on in 1rst log posted here. Later I will look at the biss for comparison.

@Ragnarok Thanks for the details. I was assuming similar conclusion from what it has been posted. Still it is interesting to be able to watch then testing and adding countermeasuresment.

And to see then too just in August making changes, On pvu we had seen transponders changing to totally HD so they get higher FEC and Lowering power. Now we are waiting to the so call upgrades. Time will tell.

 

[fiji]

Anubis_Ir May be left the forum who can made new poc version
a long time see he is no here & no discuss with us about new tandberg encryption system ...

 

[vladan !!]

I don't think they have really pushed the new software out yet.

There was talk of the new software being up a few weeks ago but we haven't seen any test cards with any warning of new software, upgrade to keep the service type messages.

I suspect until we see those messages it's just testing. they'll roll it out fully when they put the software up again with such warnings.

There is defiantly a mix of old and new EMM's in the emm stream currently.

the most good think is how we can keep it to dont show the key ? how we can make it on sat univers to dont have the think thet they need to change software??
same time we need to look morre far then they .
:thum:

 

[nautilus7]

Hi, anyone with CSA rainbow tables how can help?

http://www.sat-universe.com/showpost.php?p=2036810644&postcount=33515

 

[fiji]

Hi, anyone with CSA rainbow tables how can help?

http://www.sat-universe.com/showpost.php?p=2036810644&postcount=33515

please upload ts file may be help u minimum 30 seconds recorded .