@xosef1234 and K2TSET: Correct
So here is the updated ECM info:
47 45 6F 10: TS header
00: Offset
81: Table ID
70 18: & 0x0FFF -> Section length
EE: Tag ECM_TAG_CW_DESCRIPTOR
16: Length
00 00 16 AB: Entitlement ID
A9 D4 0A 26 FE 79 CB AF: encrypted ODD CW
09 AC 49 F5 B3 42 B3 71: encrypted EVEN CW
AA 02: Checksum
So the next step is writing and posting an offline decrypter like JimBizkit has done it:
http://www.sat-universe.com/showthread.php?t=295123&page=2
It should be able to decrypt my example file.
After this is done we can continue with an other Tandberg recording I have.
We will see that the offline decrypter isn't able to decrypt it and we must enhance it a little bit so that the decryption works with both recordings.