Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

djris2

djris2

Registered
Messages
320
Anubis_Ir said:
It doesn't matter for the DVB-App. It uses the same steps for live streams or recorded streams. Essentially there is no difference in here.
Click to expand...

so if i understand correctly we just need to find faster ways for keys decryption and we broke it :)
 
D

drhans

Registered
Messages
116
Colibri.DVB said:
I have never seen a Tandberg ECM key that is using the full key space 2^56.
Compare all the 8 ECM keys we have so far and you will see something.
So what is the key space that Tandberg is practically using?
Click to expand...

well the last byte of the 3 ecm keys I see here is always 00
 
X

xosef1234

Registered
Messages
107
drhans said:
well the last byte of the 3 ecm keys I see here is always 00
Click to expand...

in the 1st ts-file from Colibri with only one program and one EMM-key there are "only" 8 ECM-keys repeating:
Code: 
d0 6e 9b 24 xx xx xx 00
31 fb 58 9e xx xx xx 00
7b 4b d5 9b xx xx xx 00
7f 86 af 91 xx xx xx 00
e8 c8 d0 ea xx xx xx 00
df a0 ec ca xx xx xx 00
63 25 f3 df xx xx xx 00
f5 d6 e9 12 xx xx xx 00
Maybe someone can check the longer streams as well as the other freq?

Edit: Just seen Colibris post, it seems that we have only those 8
 
Last edited:
C

Colibri.DVB

VIP
Messages
44
drhans said:
well the last byte of the 3 ecm keys I see here is always 00
Click to expand...
Yes, every of the 8 DES bytes contains 7 bit (and 1 parity bit).
The 7 bits in the last byte are always 0 (for all 8 ECM keys I have seen).
So it looks like they use only a 2^49 key space for the ECM keys.
May be someone has a recorded Tandberg stream (CAID 1010 and EMM tab ID 82 *AND* 83) from an non olympic event. So we can see if the key space is only 2^49 for olympic events or generally.
 
M

merkin

Registered
Messages
14
Colibri.DVB said:
Yes, every of the 8 DES bytes contains 7 bit (and 1 parity bit).
The 7 bits in the last byte are always 0 (for all 8 ECM keys I have seen).
So it looks like they use only a 2^49 key space for the ECM keys.
May be someone has a recorded Tandberg stream (CAID 1010 and EMM tab ID 82 *AND* 83) from an non olympic event. So we can see if the key space is only 2^49 for olympic events or generally.
Click to expand...

how long of a recording do you think will be sufficient? ill get on it asap.
 
C

Colibri.DVB

VIP
Messages
44
We have 16 entitlements 8 in the first and 8 in the second file:
00 00 16 A9
00 00 16 AA
00 00 16 AB
00 00 16 AC
00 00 16 AD
00 00 16 AE
00 00 16 AF
00 00 16 B0
00 00 17 71
00 00 17 72
00 00 17 73
00 00 17 74
00 00 17 75
00 00 17 76
00 00 17 77
00 00 17 78
I checked only the ECM keys of the active channels (4 from the first and 4 from the second).
16A9 / prg 1
16AA / prg 2
16AB / prg 3
16AC / prg 4
1771 / prg 17
1772 / prg 18
1773 / prg 19
1774 / prg 20
 
C

Colibri.DVB

VIP
Messages
44
Now I have check also the following 8 inactive entitlements:
16AD
16AE
16AF
16B0
1775
1776
1777
1778
So we have 16 ECM keys with only a key space of 2^49.
 
ViaHussun

ViaHussun

Donating Member
Messages
4,098
control please
vplug + Tandberg

very good work Anubis_Ir :thum:
plugin for Anubis_Ir thanks :thum:


test video file
video for Colibri.DVB thanks :thum:
- https://mega.nz/#!1ApzARrR!Oq0Mf9VDdJlcwyJidB5jRJ-8QTWLlP7G5FqnmJxx2vc

- https://mega.nz/#!wIpGjZBK!4J0DWbUsOuzkVFeOViEViwHEtshB0lLFPgIX11OVg9k


-------------- 11141 select sid=3 --------------------------------- 12689 select sid=19
11141.png
12689.png
 
Last edited:
O

ooOO_SORGOS_OOoo

Active frequences and sats with tandberg encrypted channels?? How to test it '

We need details for sat, frequences??
 
You must log in or register to reply here.
Top