Go Back   Sat Universe > Cams > Cam chat

Note: Visitors from certain countries might see in-text advertising(underlind words in posts) or pop-under ads.
It is only shown to unregistered visitors or members that haven't made any posts. So you can easily get rid of it.

World-Of-Satellite

Smartdtv Cam

Cam chat

Reply
  #1  
Old 23-10-2018, 16:01  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
pipino pipino is offline
Senior Member
 
Join Date: Sep 2007
Posts: 32
Thanks: 27
Thanked 19 Times in 13 Posts
Country: Country Flag
Default Smartdtv Cam

Hello,

doing some experiment with Smartdtv Cam anyway of extracting the RSA key?

the cam is nagra based



cheers
Reply With Quote
  #2  
Old 04-11-2018, 22:21  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
^[email protected]@in^ ^G@w@in^ is offline
Senior Member
 
Join Date: Nov 2008
Posts: 220
Thanks: 279
Thanked 297 Times in 98 Posts
Country: Country Flag
Default

Good to see you back
Reply With Quote
The Following User Says Thank You to ^[email protected]@in^ For This Useful Post:
pipino (05-11-2018)
  #3  
Old 05-11-2018, 12:27  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
pipino pipino is offline
Senior Member
 
Join Date: Sep 2007
Posts: 32
Thanks: 27
Thanked 19 Times in 13 Posts
Country: Country Flag
Default

cheers mate ..health kept me away for a while
Reply With Quote
The Following User Says Thank You to pipino For This Useful Post:
  #4  
Old 11-12-2018, 17:18  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
K2TSET K2TSET is offline
Senior Member
 
Join Date: Jan 2016
Posts: 94
Thanks: 9
Thanked 187 Times in 67 Posts
Country: Country Flag
Default

I was looking for the same on a NEOTRON Viaccess cam, used here for DVB-T

I know the firmware are transmitted as update in the ts as a SSU

I the NIT I do see a 0x09 "System Software Update" service
OUI: 0x237C => Neotion
Sector lenght: 0x22
Sector_bytes: 08000001123456780..............

This kind of data are send as a carousel and I never found a way to capture the firmware, and if it was possible I guess it's encrypted and then hard to find the RSA.

Another way could be to open the cam and unsolder the flash are read it and hope the FW are non encrypted.

I was expecting to place a legal card in a OSCAM server and the let different receivers share that card.

But that does not work since the ECM in the ts does have the RSA key flagged so I expect the RSA are needed.

I did a complete record of the ts and at the same time I had logging running between the card and the cam on 2 the different TV's

Both log on card / cam are exact the same during eg a timeslot on 1 min where the cw changed like every 10 sec.

Since I did record the whole TS on a USB tuner at the same time I could now extract the same program and do a BF on the CW and have a clear picture...but the CW are not shown in plain in the return from the card /cam log so I'm a bit surprised on what part the RSA actually are used in the CI

Any way I like to know how to get RSA as well
Reply With Quote
The Following 2 Users Say Thank You to K2TSET For This Useful Post:
pipino (12-12-2018), VladoFogo (22-12-2018)
  #5  
Old 11-12-2018, 17:52  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
pelcmichal pelcmichal is offline
Banned
Member
 
Join Date: Jul 2018
Location: Prabuty
Posts: 18
Thanks: 0
Thanked 4 Times in 4 Posts
Country: Country Flag
Default

in smartdtv cam you have more as one RSa.. all is visible in flashdump..
Too for decrypt blocks is used more as one round
Reply With Quote
The Following User Says Thank You to pelcmichal For This Useful Post:
pipino (12-12-2018)
  #6  
Old 20-12-2018, 19:18  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
K2TSET K2TSET is offline
Senior Member
 
Join Date: Jan 2016
Posts: 94
Thanks: 9
Thanked 187 Times in 67 Posts
Country: Country Flag
Default

Quote:
Originally Posted by K2TSET View Post
I was looking for the same on a NEOTRON Viaccess cam, used here for DVB-T

Another way could be to open the cam and unsolder the flash arn read it and hope the FW are non encrypted.
Ok got the BGA flash un-soldered and wired up and dumped, then uncompressed the 4MB bin image and now I have some file

Under "ciplus" folder I have:

Code:
01-01-1970  01:00             1.056 brand.der.aes
01-01-1970  01:00                16 clk.aes
01-01-1970  01:00             1.088 device.der.aes
01-01-1970  01:00               256 dh_g.aes
01-01-1970  01:00               256 dh_p.aes
01-01-1970  01:00                32 dh_q.aes
01-01-1970  01:00             1.200 private.der.aes
01-01-1970  01:00                16 random.aes
01-01-1970  01:00             1.024 root.der.aes
01-01-1970  01:00                16 siv.aes
01-01-1970  01:00                16 slk.aes
01-01-1970  01:00                16 usk.aes
The ECM D2 nano for "overencrypt" are D2 02 0D 00
Indicating key 0

I have tried the different 16bytes AES files in Oscam under aeskeys for the reader

Quote:
multiple 16 bytes AES keys for Viaccess SCs (the used postprocessing AES key is specified through the D2 nano of the ECM)
None have cleared yet.

Any hint on which AES file are the right one to use in respect to D2 nano and over encrypt?
Reply With Quote
The Following User Says Thank You to K2TSET For This Useful Post:
VladoFogo (22-12-2018)
  #7  
Old 21-12-2018, 19:55  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
K2TSET K2TSET is offline
Senior Member
 
Join Date: Jan 2016
Posts: 94
Thanks: 9
Thanked 187 Times in 67 Posts
Country: Country Flag
Default

Just found ci-plus documentation where the different keys are explained and a lot of other interesting information.
http://www.ci-plus.com/data/ci-plus_...ation_v1.3.pdf
Reply With Quote
The Following User Says Thank You to K2TSET For This Useful Post:
VladoFogo (22-12-2018)
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 02:28.


Powered by vBulletin
Copyright ©2006-2019 - Sat Universe