How found ECM key Tandberg?

[dmr0x]

i got far more satifaction using cudabiss to find a key than someone just giving me it every time a key changed.

guess the masses prefare to sit on there hands and wait for you to hook them up with TD keys

 

[gotya]

@dmr0x & MaRwAn26:
just take care, I guess your DES encrypted cw is wrong; it should be DB xx xx xx xx xx xx 20
I cannot verify the decrypted cw

anyway, still not clear what you are looking for? everything is explained in the main thread ....

you are right xosef1234, my mistake I just followed the starting of the DES encrypted cw that was posted by dmr0x, I guess he missed it too.

it's yes and should be like this according to the file uploaded by dmr0x

47 47 DA 1E 00 80 70 18 EE 16 00 00 0A 26 DB FE 27 33 72 CE 77 20 E9 2C 95 14 7F 23 17 72 A5 63
47 47 DA 11 00 81 70 18 EE 16 00 00 0A 26 DB FE 27 33 72 CE 77 20 D4 18 35 35 1D D3 10 2C 4D 12

so the decrypted cw from this C8

[B]PID: 19Ah  B8h-Crypt8:61 8D 32 2E 56 8F B3 4B  [[B][COLOR="Red"]O[/COLOR][/B]] Count:211[/B]

which was found from the ts file {odd pid } uploaded by dmr0x is attached :thum:

now we have the encrypted ECM key ==> { DES encrypted key } and we have the decrypted cw what should we do next ?

How to BF and find the working ECM key when we have both encrypted ECM key and decrypted cw ?

 

[dale_para_bajo]

@dmr0x and others. I would stay active as a member as long as I feel comfortable. But it is hard to received nice and sweet PMs and see same members been rough in public. At the moment, If I get a key I will share. That is all I can offer. I will move on as soon as I feel none comfortable. I will not try to defend my self anymore.

MaRwAn26 is right on track.

A) CSA CW
*Started from complete Small TS of 1 channel ( In general 12 seconds ).
*He uses CSA RBT to get crypt8 request cw.

[B]PID: 19Ah  B8h-Crypt8:61 8D 32 2E 56 8F B3 4B  [[B][COLOR="Red"]O[/COLOR][/B]] Count:211[/B]

*Some one responded with cw. I guess in this case himself. See attached decrypted CW.txt.

So up to here what he got?
He has a piece of TS that is Complete ( Video, Audio,ECM, etc).
And now he knows the Current IN USED CW.

Is this an ECM, DES, Key, Clear, Encrypted, bla bla bla?
None of the above. In terms of CSA he only has the Current IN USED CW. At most you have a CSA Key as CSA is in fact an encryption protocol and the CW it is Key.

B) ECM.
Now before you continue you need to find out what is a ECM? What it is use? It is always the same info? Or even the same Structure? How many ECM you can have? Are they encrypted? Yes sure no one of you will find that out.

By the way can you explain me how is a BISS ECM?

Thanks to colibri we know tandbers ECM structure. Read on it.

MaRwAn26 is right on track again.

47 47 DA 1E 00 80 70 18 EE 16 00 00 0A 26 DB FE 27 33 72 CE 77 20 E9 2C 95 14 7F 23 17 72 A5 63
47 47 DA 11 00 81 70 18 EE 16 00 00 0A 26 DB FE 27 33 72 CE 77 20 D4 18 35 35 1D D3 10 2C 4D 12

But clearly to understand all those numbers you need to read colibri definition.

Now here is where MaRwAn26 is not so correct. Maybe a type error on in a hurry up mistake. Or maybe just hes own way of describing. I myself make many mistakes like that. As kebien time after time remind me to correct.

***
now we have the encrypted ECM key ==> { DES encrypted key } and we have the decrypted cw what should we do next ?

How to BF and find the working ECM key when we have both encrypted ECM key and decrypted cw ?

The encryption CAS is Tandberg but it uses DES as its core engine. Yes you read that in colibri info right.

The Tandberg ECM payload is encrypted.
What is the usual payload of a ECM? Well there are other CAS like NAGRA that instead carry the rolling key protocol.
So the Tandberg ECM payload is encrypted ins what?

Those are not ment to be sarcastic. But the remind you what you are doing. Find out.


Up to here you should have been notice that all this DVB-S system is on encrypted protocol inside another encrypted but different one and there are more. So what it is a plaintex for one protocol is used later as a key for another protocol or an ecrypted part of another protocol. Very confusing.

So here we have 2 ecm with encrypted payload. Each payload had 16 bytes or 2-8 byte long. The important thing here is that 1 of those 8 byte correspond to a Encrypted CW been in Used. Now YOu need to forget about CW. Concentrate in the fact that is an 8 byte Block DES Encrypted. That you happens to have its 8 byte B/ock DES in Clear. The one you found by CSA RBT.

So you in fact you have a pair of DES Clear/Crypted Block. This means you can then start the Brute Force Attack of your choice.

 

[xosef1234]

@MaRwAn26:

now you have to start coding something like this:

for i=0000000000000000h to FFFFFFFFFFFFFFFFh do
{
DES-Encrypted-Test-Key = DES-Encrypt(decrypted-cw with key i)
if DES-Encrypted-Test-Key = DES-Encrypted-Key then ECM-Key found!! (ECM-Key=i)
}

Of course, this is very simplified, e.g.
-the last byte of the index i can always be set to 00h
-you will need more decrypted-cw/DES-encrypted keys to test
-take care of cw checksum bytes
...

Maybe it is even easier to decrypt instead of encrypting...

Finally, you need to do this with CUDA, FPGA....
If not, it will take around 10.000years to complete

 

[dmr0x]

i guess dale_para_bajo has access to some powerfull hardware then.

 

[gotya]

@xosef1234

thanks very much for clearing out

your words were very simple,clear and direct to the point

as I understood that this BF needs either CUDA or FPGA therefore I have CUDA my graphic card is GTX 680 which has 1536 Cores which is a good thing

also a good point you mentioned about the cw checksum bytes

now I know this BF needs something which is beyond my limits.

thanks again :thum:

 

[ooOO_SORGOS_OOoo]

i saved nat.geo. 42E tandberg ,emm bin 200 kb and i did try poc.exe v1.6

i dont find key
what is problem?

poc 1.6
TS mode
[Emu] info: FFDecsa parallel mode = 32
[Emu] stream found pmt pid: 20
[Emu] stream found pcr_pid: B91
[Emu] stream found ecm_pid: AC9
[Emu] stream found video pid: B91
[Emu] stream found audio pid: BF5
[Emu] stream found emm_pid: 1F4
[Emu] active entitlement: CA
[Emu] got EMM nano tag E0 (EMM_TAG_RECEIVER_ALLOCATION_DESCRIPTOR) for the first time
[Emu] got EMM nano tag E4 (EMM_TAG_SECURITY_TABLE_DESCRIPTOR) for the first time
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F
[Emu] Keys found in EMM: new nano E4 ram keys 0 to F
[Emu] Keys found in EMM: new nano E4 ram keys 10 to 1F
[Emu] Keys found in EMM: new nano E4 ram keys 20 to 2F
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F
poc 1.6
poc 1.6
poc 1.6
TS mode
[Emu] info: FFDecsa parallel mode = 32
poc 1.6
raw EMM mode
[Emu] got EMM nano tag E0 (EMM_TAG_RECEIVER_ALLOCATION_DESCRIPTOR) for the first time
[Emu] got EMM nano tag E4 (EMM_TAG_SECURITY_TABLE_DESCRIPTOR) for the first time
[Emu] Keys found in EMM: new nano E4 ram keys 0 to F
[Emu] Keys found in EMM: new nano E4 ram keys 10 to 1F
[Emu] Keys found in EMM: new nano E4 ram keys 20 to 2F
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F
poc 1.6
TS mode
[Emu] info: FFDecsa parallel mode = 32
poc 1.6
raw EMM mode
[Emu] got EMM nano tag E0 (EMM_TAG_RECEIVER_ALLOCATION_DESCRIPTOR) for the first time
[Emu] got EMM nano tag E4 (EMM_TAG_SECURITY_TABLE_DESCRIPTOR) for the first time
[Emu] Keys found in EMM: new nano E4 ram keys 0 to F
[Emu] Keys found in EMM: new nano E4 ram keys 10 to 1F
[Emu] Keys found in EMM: new nano E4 ram keys 20 to 2F
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F
poc 1.6
TS mode
[Emu] info: FFDecsa parallel mode = 32
poc 1.6
raw EMM mode
[Emu] got EMM nano tag E0 (EMM_TAG_RECEIVER_ALLOCATION_DESCRIPTOR) for the first time
[Emu] got EMM nano tag E4 (EMM_TAG_SECURITY_TABLE_DESCRIPTOR) for the first time
[Emu] Keys found in EMM: new nano E4 ram keys 0 to F
[Emu] Keys found in EMM: new nano E4 ram keys 10 to 1F
[Emu] Keys found in EMM: new nano E4 ram keys 20 to 2F
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F
poc 1.6
TS mode
[Emu] info: FFDecsa parallel mode = 32
poc 1.6
raw EMM mode
[Emu] got EMM nano tag E0 (EMM_TAG_RECEIVER_ALLOCATION_DESCRIPTOR) for the first time
[Emu] got EMM nano tag E4 (EMM_TAG_SECURITY_TABLE_DESCRIPTOR) for the first time
[Emu] Keys found in EMM: new nano E4 ram keys 0 to F
[Emu] Keys found in EMM: new nano E4 ram keys 10 to 1F
[Emu] Keys found in EMM: new nano E4 ram keys 20 to 2F
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F

 

[dale_para_bajo]

ooOO_SORGOS_OOoo You are a nice guys you are always trying to help others thanks.

poc.exe will ONLY work if the stream has ALL INFORMATION its requires. But we all know that right? You can Log, log and log for days or weeks in the hope the missing info shows up. Some has done it. But clearly to little productive as you card will be stock at logging all the time.

 

[crack]

DEAR ooOO_SORGOS_OOoo & ALL EXPARTS

PLEASE GIVE ME POC.EXE SOFTWARE LINK

THANKS

 

[ooOO_SORGOS_OOoo]

Crack hello
Close caps lock button
http://www.sat-universe.com/showthread.php?t=296073

 

[gotya]

i saved nat.geo. 42E tandberg ,emm bin 200 kb and i did try poc.exe v1.6

i dont find key
what is problem?

encrypted Tandberg channels are different from encrypted Tandberg feeds

so far in feeds we noticed that the stream table 0x83 was carrying always the ECM key and with the use of *.poc tool by JimBizkit and Anubis_Ir were solved and found the active working ECM Keys.

while in encrypted Tandberg channels are different so the stream table 0x83 was not carrying the ECM key therefore NO ECM Key is found.

sometimes in encrypted Tandberg channels you need to record the EMM pids for couple of days continues incase you might be lucky the stream table 0x83 will send the ECM Keys.

that's why dmr0x gave an example of two *.ts files here and we were trying to understand and find something

1st you need to record on the channel and find the Crypt8 then record the EMM pid of the channel or just use TransEdit.exe and create a new recorded EMM pid *.ts file by selecting only the EMM pid from your previous record.

2nd after finding the Crypt8 you have now to search for the CW by using CSA Rainbow Table Tool

3rd you need to analyze the recorded EMM pid *.ts file and find the encrypted ECM Keys odd and even by using Hex Workshop.exe or any other tool.

4th now you have decrypted odd cw acting in behaf of the encrypted DES odd ECM.

5th you need then to follow what xosef1234 said which I can't do at the moment

now you have to start coding something like this:

for i=0000000000000000h to FFFFFFFFFFFFFFFFh do
{
DES-Encrypted-Test-Key = DES-Encrypt(decrypted-cw with key i)
if DES-Encrypted-Test-Key = DES-Encrypted-Key then ECM-Key found!! (ECM-Key=i)
}

Of course, this is very simplified, e.g.
-the last byte of the index i can always be set to 00h
-you will need more decrypted-cw/DES-encrypted keys to test
-take care of cw checksum bytes
...

Maybe it is even easier to decrypt instead of encrypting...

Finally, you need to do this with CUDA, FPGA....
If not, it will take around 10.000years to complete

I know these informations were not described clearly so far in details but this is the best I could do at the moment and please just ignore these voices here that trying to mix everything up to show things impossible to get after they got the tool from the victim.

 

[strong5000]

Hi, All friend

i tried recored 12 hours EMM file of CNBC channel for 166E, but still can't find ECM and EMM key by POC tool. any person can help me ?

http://www.fileconvoy.com/dfl.php?id=gf334e22d69ee844699986250021f72c24d9ada13e

Log and EMM file

 

[dmr0x]

i can run a full cudabiss brute force 0-f in 120 hours. An FPGA in a 10th of that. How long to bruteforce tandberg ecm with the same hardware ?

 

[K2TSET]

i can run a full cudabiss brute force 0-f in 120 hours. An FPGA in a 10th of that. How long to bruteforce tandberg ecm with the same hardware ?

Depends what you search for:

DES does have 56 bit (64bit with parity) in the key so worst search are 2^56 keys

I know many claiming that 7 bit always are 0 so this would leave 49 bit 2^49. (I'm not sure the 1 byte always will be 0,but wecan hope)

To compare with the CSA do have 48bit 2^48 possible keys

I can do a full search for CSA in 12 Hours in 1 FPGA using 32 core
which can fit in the chip.
(2^48)/32/200.000.000/60/60 = 12,2 hours

The DES take about 1/3 footprint compared to CSA in the FPGA so the can be around 90 cores in the same FPGA

Each core will test a key on every clock cycle @ 200 Mhz

So I would guess the time for 2^49 DES would be about

(2^49)/90/200.000.000/60/60 = 8,6 hours

for 2^56 DES
(2^56)/90/200.000.000/60/60/24 = 46,3 days

Sure it might be optimised but it will not differ much

Another approach could be to look for some RBT hack for DES

 

[C0der]

But RBT only works for a fixed plain or ciphertext. Here we don't have either. Right?

 

[K2TSET]

But RBT only works for a fixed plain or ciphertext. Here we don't have either. Right?

Hm... guess you are right

 

[DEPORTIVO]

In my case:
07.E
12556-H-7200

I didn`t get what I need (prefix)
I found key but I have only two numbers (83) of four.
How put (83) in xxxx
T xxxx 01 4DB**9D99C4**D00

poc 1.6
raw EMM mode
[Emu] got EMM nano tag E1 (EMM_TAG_EVENT_ENTITLEMENT_DESCRIPTOR) for the first time
[Emu] error: GetEMMKey: ram key 11 not yet available
[Emu] got EMM nano tag E2 (EMM_TAG_EVENT_DEENTITLEMENT_DESCRIPTOR) for the first time
[Emu] got EMM nano tag E0 (EMM_TAG_RECEIVER_ALLOCATION_DESCRIPTOR) for the first time
[Emu] error: GetEMMKey: ram key 11 not yet available
[Emu] got EMM nano tag E4 (EMM_TAG_SECURITY_TABLE_DESCRIPTOR) for the first time
[Emu] Keys found in EMM: new nano E4 ram keys 10 to 1F
[Emu] Key *maybe* found in EMM: T 84 01 EDB30CBA1EFB0500
[Emu] Key *maybe* found in [COLOR="Red"]EMM: T 83 01 4DB**9D99C4**D00[/COLOR]
[Emu] Keys found in EMM: new nano E4 ram keys 20 to 2F
[Emu] Key found in EMM: T 84 01 EDB30CBA1EFB0500
[Emu] Key found in EMM: [COLOR="Red"]T 83 01 4DB**9D99C4**D00[/COLOR]
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F

- And in vplug I have red circle and message: T 83 Key01 is missing...
Help me

 

[nautilus7]

The rest are zeros. 0083 is the same as 83.

Cheers!

 

[DEPORTIVO]

The rest are zeros. 0083 is the same as 83.Cheers!

Meaning always:
If I have two or tree numbers, always add front of "0" ?
Cheers! m8

 

[nautilus7]

Yes, exactly.

I don't have vplug to tell you if you need to put the zeros in front, but in oscam-emu you don't need to. It works without zeros, (just "83" in your example) as well as with leading zeros filled ("0083").