CI+ boxkey

Dump the EEprom AT45XXXX or you try to dump the SM-1601 (Core)

If you are not within Hardware hacking like Jtag and few more, please choose another hobby. This isnt a easy plug and play game. Rervering code and Jtag is for people that are one with electronics or programming. The glory days are over since 2006. A CAS System is now more complex then a old Betacrypt system in 1996. It needs skill to revers it. Like dumping memorys - but the last step all stuck in the moment. The Hardware-Pairing itself. A Keyladder System only can be broken by using very expensive tools like a focus ion beam or optical scanning the rom and decrypt it by gliching the key´s.

Anyway up to you... but better u choose another hobby dude.

I dont like silly privat Messages.

http://lmgtfy.com/?q=AT45DB161+dump

OpenOCD or something else to dump the AT45DB161.

Flash-sheet: http://www.atmel.com/Images/doc0807.pdf

Core Sheet: http://www.docin.com/p-634290673.html

Hardware u need: Buspirat or similar

jteeuw said:

Hi,

I have a CI + module with a paired card , CAID 1801 UPC NL, is it there a way to read the boxkey out?

Module Model : SmartCAM-3
Module Part number: CI0311UPC01

thanks.

Click to expand...

hey bro...,
please wait,
work in progress,
i think ,i have solution for u:thum:

Lol solution there for a long time....
Just dump the flash..

Both

devloper said:

hey bro...,
please wait,
work in progress,
i think ,i have solution for u:thum:

Click to expand...

Hello,

I have an UPC SmartCAM-3 with a 1801 paired card. Can you help me, how to extract the rsa and the boxkey?

i have irdeto 2 card and i need its dynamic key can some one help me to find rsa from its log

israr said:

i have irdeto 2 card and i need its dynamic key can some one help me to find rsa from its log

Click to expand...

this is a nagra topic , not irdeto!

Well i read that posting on http://dangerousprototypes.com/forum/viewtopic.php?t=6874&p=59974

BGA is not possible easly, u need to scratch the lines that u got pure chopper or u desolder the main core.

But there is another way desolder the flash, dump it and use the bga holes on the pcb and solder few cables to a soic8 AT45 and push your dump via spi to the new AT Flash.