Not found c8 in hvec feeds

C

cayoenrique

Member
Messages
475
1rst I like to know if C0der can tell us what are we looking for? Do you have an Idea?

I do have some, but they are so weird, and I am not even sure if they will lead us to something good. You know deadend exit.

Usually I test things before I post. Some time I get conclusion from what I was told. Sometime then I get wrong.
Regards CSA RBT I repeat what I was told/teach. One of those is that for general B8hxFFh and B8hx00h need a payload size of 184 or they do not work. Is this correct?

If it is then why we can see in CSARBTOOL V1:
Code: 
Using payload size: 8
Using payload size: 16
Using payload size: 24
Using payload size: 32
Using payload size: 40
Using payload size: 48
Using payload size: 56
Using payload size: 64
Using payload size: 72
Using payload size: 80
Using payload size: 88
Using payload size: 96
Using payload size: 104
Using payload size: 112
Using payload size: 120
Using payload size: 128
Using payload size: 136
Using payload size: 144
Using payload size: 152
Using payload size: 160
Using payload size: 168
Using payload size: 176
PID: 134h B0h-Crypt8:98 06 84 83 BA 37 89 0B [E] Count:29
PID: 134h B0h-Crypt8:A3 60 9E FD 81 60 5D 91 [E] Count:29
PID: 134h B0h-Crypt8:7D F3 72 5F DB 7B FF E8 [E] Count:28
PID: 134h B0h-Crypt8:97 2F 40 84 6C AA 0F 66 [E] Count:28
PID: 134h B0h-Crypt8:04 E3 37 92 F5 CB 1E D7 [E] Count:27
PID: 134h B0h-Crypt8:53 B3 54 D4 18 5A 41 BA [E] Count:27
PID: 134h B0h-Crypt8:A3 8C BB CB E1 55 41 CD [E] Count:27
PID: 134h B0h-Crypt8:C9 4F 25 FC E8 B8 49 0F [E] Count:27

My comment before that there where no crypt8 was base in the requirement that we need 184 payload size.
 
C

C0der

Registered
Messages
269
We are looking for repeated patterns.

> B8hxFFh and B8hx00h need a payload size of 184 or they do not work. Is this correct?
Yes. 184 is B8 in hex.

Some more packets from capture 1, that might be interesting to decrypt with CW: 55 6F 13 D7 57 AA A1 A2:
 
M

moonbase

VIP
Donating Member
Messages
550
Possibly related to this topic of "No Crypt8 in HEVC" is the fact that the Chinese auto boxes have been known to get a CW and clear a picture when there has been no crypt8 in the feed.
Sure, this is not HEVC but it is a similar scenario where there is no Crypt8 in the H264 feed yet the Chinese boxes get a CW.

Is it a possibility that the Chinese have found an unknown flaw in biss that they are expoiting for their auto boxes?
Or do they just have a huge BF setup that can get a CW in around 15 minutes?
 
C

C0der

Registered
Messages
269
Flaw in biss seems unlikely.
Huge BF setup would cost like $30000. Worth it?

Last file for today. Again, decrypt with CW: 55 6F 13 D7 57 AA A1 A2:

Maybe we can also look at non HEVC too (with no C8). Any ts from encrypted feed + valid CW or decrypted ts? around 300MB.
 
dvlajkovic

dvlajkovic

Member
Messages
498
@juankrlos,
Tell me please:
  • What was the SR (Symbol Rate) on TP where you grabbed capture 1, 2, 3?
  • Was the SR of the same value each time you tried to find C8 in HEVC feed?
  • These HEVC feeds, were they SCPC (Single Channel Per Carrier) or MCPC (Multiple Channel Per Carrier)?
    Hint: if there was just one HEVC feed/channel on 1 TP frequency, it was a SCPC. If there was a multiplex aka mux (several feeds/channels on 1 TP frequency) and among them a HEVC feed, it was MCPC.
  • Do you find these HEVC feeds always on the same position or each time on a different Sat and Freq?
 
K

klickklack

Senior Member
Messages
1,102
C0der said:
We are looking for repeated patterns.

> B8hxFFh and B8hx00h need a payload size of 184 or they do not work. Is this correct?
Yes. 184 is B8 in hex.

Some more packets from capture 1, that might be interesting to decrypt with CW: 55 6F 13 D7 57 AA A1 A2:
Click to expand...
C0der said:
...and some from capture 2 to decrypt with CW: 55 6F 13 D7 57 AA A1 A2:
Click to expand...
C0der said:
Flaw in biss seems unlikely.
Huge BF setup would cost like $30000. Worth it?

Last file for today. Again, decrypt with CW: 55 6F 13 D7 57 AA A1 A2:

Maybe we can also look at non HEVC too (with no C8). Any ts from encrypted feed + valid CW or decrypted ts? around 300MB.
Click to expand...
mega.nz

File on MEGA

mega.nz mega.nz
mega.nz

File on MEGA

mega.nz mega.nz
mega.nz

File on MEGA

mega.nz mega.nz
 
Last edited:
S

sattechtips

Registered
Messages
426
I have recorded before year file, where was feed, but idk how was encrypted, when i analyze say "Scrambled PID without ECMs". Cannot see crypt info in the PMT (usually you would find eg CAID 0x2600 for BISS1 there).

In CSA show some cryp8 like real, but i cannot find key.

Here is file:

Google Drive - Virus scan warning

drive.google.com drive.google.com

if someone want to analyze and try find CW.
 
K

klickklack

Senior Member
Messages
1,102
sattechtips said:
I have recorded before year file, where was feed, but idk how was encrypted, when i analyze say "Scrambled PID without ECMs". Cannot see crypt info in the PMT (usually you would find eg CAID 0x2600 for BISS1 there).

In CSA show some cryp8 like real, but i cannot find key.

Here is file:

Google Drive - Virus scan warning

drive.google.com drive.google.com

if someone want to analyze and try find CW.
Click to expand...
this not BISS
dyfsdfsdfx.jpg
sdasdfsxc.jpg

valid C8 for this encryption are
FD C3 5F EE F0 BB 1E 9D #[E] PID:0064h

57 F6 3D 57 B2 3A 27 55 #[E] PID:00CEh

57 F6 3D 57 B2 3A 27 55 #[E] PID:00CFh
 
Last edited:
J

juankrlos

Registered
Messages
66
dvlajkovic said:
@juankrlos,
Tell me please:
  • What was the SR (Symbol Rate) on TP where you grabbed capture 1, 2, 3?
  • Was the SR of the same value each time you tried to find C8 in HEVC feed?
  • These HEVC feeds, were they SCPC (Single Channel Per Carrier) or MCPC (Multiple Channel Per Carrier)?
    Hint: if there was just one HEVC feed/channel on 1 TP frequency, it was a SCPC. If there was a multiplex aka mux (several feeds/channels on 1 TP frequency) and among them a HEVC feed, it was MCPC.
  • Do you find these HEVC feeds always on the same position or each time on a different Sat and Freq?
Click to expand...
Hi,

capture 1 and 2 ---> SR 6399
capture 3 ----> SR 3200

The provider uses the same CW throughout the day.
Some transmissions are sent in h264 and others in hevc, the transmissions in h264 can be found on the C8 easily, but not the transmissions in HEVC.
The provider only transmits one channel per carrier and reuses the same transponder per event
 
M

moonbase

VIP
Donating Member
Messages
550
juankrlos said:
Hi,

capture 1 and 2 ---> SR 6399
capture 3 ----> SR 3200

The provider uses the same CW throughout the day.
Some transmissions are sent in h264 and others in hevc, the transmissions in h264 can be found on the C8 easily, but not the transmissions in HEVC.
The provider only transmits one channel per carrier and reuses the same transponder per event
Click to expand...

@juankrlos

What satellite and frequencies are used for these feeds please?
It might make it easier if we know, then we can do captures ourselves if we are able to receive the satellite?
 
Last edited:
S

sattechtips

Registered
Messages
426
C0der said:
also @sattechtips: What satellite etc. and has it more there these days?
Click to expand...

No its was feed from 2021, was on 23.5E and was UHD feed, not know what event, but i never seen feed to be encrypted in powervu in europe, mostly to be tandberg or something other.
C0der said:
Flaw in biss seems unlikely.
Huge BF setup would cost like $30000. Worth it?

Last file for today. Again, decrypt with CW: 55 6F 13 D7 57 AA A1 A2:

Maybe we can also look at non HEVC too (with no C8). Any ts from encrypted feed + valid CW or decrypted ts? around 300MB.
Click to expand...

Here H264 with no c8 two files encrypted and decrypted:

Google Drive - Virus scan warning

drive.google.com drive.google.com

Google Drive - Virus scan warning

drive.google.com drive.google.com

and here bonus another no c8, but no key also, need brute force:

Google Drive - Virus scan warning

drive.google.com drive.google.com
 
You must log in or register to reply here.
Top