How to post a good C8 (instructions for the newbies)

M

mauricelugher

HOW TO post a good C8 because it is essential when trying to find the CW Key
remember these few simple rules.
1) analyze the recording.ts first

Code: 
Nome completo                           : C:\FTS-WIF_F1_11002_V_14400_20150607_1505_VPID_512.ts
Formato                                 : MPEG-TS
Dimensione                              : 39,5MiB
Durata                                  : 10s 399ms
Modo bitrate generale                   : Costante
Bitrate totale                          : 31,4 Mbps

Video
ID                                      : 512 (0x200)
ID menu                                 : 1 (0x1)
Formato                                 : AVC

Audio #1
ID                                      : 4112 (0x1010)
ID menu                                 : 1 (0x1)
Formato                                 : MPEG Audio

Audio #2
ID                                      : 4128 (0x1020)-1
ID menu                                 : 1 (0x1)
Formato                                 : Dolby E

Audio #3
ID                                      : 4128 (0x1020)-2
ID menu                                 : 1 (0x1)
Formato                                 : Dolby E

Audio #4
ID                                      : 4144 (0x1030)
ID menu                                 : 1 (0x1)
Formato                                 : MPEG Audio

Audio #5
ID                                      : 4160 (0x1040)
ID menu                                 : 1 (0x1)
Formato                                 : MPEG Audio

Now You can start searching the C8 of this and of all the other recordings.

3) payload size must be 8 or 184, nobody around here owns Tables of any other payload size.

4) Always indicate the correct stream's type of the C8's pid
Don't do the following error:
Code: 
.....
Mpeg 4
PID: 1020h  B8h-Crypt8:36 1C C5 53 A2 26 D9 37  [E] Count:525
...only because Video Stream is Mpeg4, all other C8's pids must be searched in the FFh Table


5) Post the whole log, do not exclude any part You consider insignificant, it may not be.
For example:

Code: 
Using payload size: 184
PID: 1020h  B8h-Crypt8:74 DA 3E 88 66 0C 5F F0  [E] Count:48
PID: 1020h  B8h-Crypt8:00 07 81 88 0F 3A A5 3D  [E] Count:48
You think they're fake, because You got a pair of top counts.
It may be a wrong conclusion, one of the two is a valid 00h C8

Code: 
Using payload size: 184
PID: 200h  B8h-Crypt8:26 1C C5 43 F2 26 D9 37  [E] Count:5250
PID: 200h  B8h-Crypt8:74 DA 3E 88 66 0C 5F F0  [E] Count:48
PID: 200h  B8h-Crypt8:00 07 81 88 0F 3A A5 3D  [E] Count:48
PID: 200h  B8h-Crypt8:17 AB 76 6D 87 6B 7E 79  [E] Count:48
PID: 200h  B8h-Crypt8:1A 08 79 05 BE 01 B4 9D  [E] Count:2
PID: 200h  B8h-Crypt8:81 C0 86 2C 46 3B 14 FA  [E] Count:2
PID: 200h  B8h-Crypt8:BA 0A CC 2B 4B DE 64 4D  [E] Count:2
At a first fast look it seems a clear FFh C8. You do the CW's search and You get nothing.
PID: 200h B8h-Crypt8:26 1C C5 43 F2 26 D9 37 [E] Count:5250 is a fake
One of the following is the real 03000 C8
PID: 200h B8h-Crypt8:74 DA 3E 88 66 0C 5F F0 [E] Count:48
PID: 200h B8h-Crypt8:00 07 81 88 0F 3A A5 3D [E] Count:48
PID: 200h B8h-Crypt8:17 AB 76 6D 87 6B 7E 79 [E] Count:48

Good search everybody !
:thum:
 
Last edited:
B

BeatrixKiddo

Registered
Messages
218
Thanx maurice!!

I have a question....when the c8 it's like this:
PID: 200h B8h-Crypt8:00 1D 74 B7 2D 44 2A F9 [E] Count:2
PID: 200h B8h-Crypt8:04 AD 58 4C 4B A5 9C E3 [E] Count:2
PID: 200h B8h-Crypt8:0B 46 64 A3 21 33 B9 61 [E] Count:2
PID: 200h B8h-Crypt8:14 83 9D 8A 40 92 6B 21 [E] Count:2
PID: 200h B8h-Crypt8:16 1E A1 35 CA 95 F0 07 [E] Count:2
PID: 200h B8h-Crypt8:1C 05 3A FF 64 9B 7D 63 [E] Count:2
PID: 200h B8h-Crypt8:1C A8 B7 7E 17 A4 DF DC [E] Count:2
PID: 200h B8h-Crypt8:22 71 BE 8B 27 CC 79 9E [E] Count:2

It's all fake?
Thanx!
 
M

mauricelugher

I Think yes.
It's an arithmetical pregression.
None outside it.
No top counts.
 
T

TheSamoyed

Donating Member
Messages
510
Am I right in thinking that if you get a c8 with 3 identical or very similar counts then it is likely to be a 03000?

Like below?

PID: 200h B8h-Crypt8:74 DA 3E 88 66 0C 5F F0 [E] Count:48
PID: 200h B8h-Crypt8:00 07 81 88 0F 3A A5 3D [E] Count:48
PID: 200h B8h-Crypt8:17 AB 76 6D 87 6B 7E 79 [E] Count:48
 
barney115

barney115

Donating Member
Staff member
Administrator
Messages
24,763
Many times Spainsh football feeds from 10E in Mpeg 2 have triplet high counts but keys are normally B8hx00h table .

i always search all tables to be sure anyhow .
but i dont always find the CW Key like the example mauricelugher has put above in post#1 i still didnt find a key on that Crypt8 but thats certainly not to say the C8 is a fake .
sometimes CW Key just might not be in your table
which is why its always nice i can rely on other feedhunters to help me out when im stuck ..which can obviously be a lot of times :D

cheers !
 
B

BeatrixKiddo

Registered
Messages
218
For avoid fake c8, it's better record many short file (20-30 sec) and test it all, or one long record (5-10 minutes) ? thanx
 
S

spinandspeed

Registered
Messages
128
With 20-30 sec records, you will find a c8 only very few times. Better go for records from 600 Mb - 1.6 GB. Mostly that is enough to find a good crypt8. You can recognize fake c8 quite easy but if you're unsure, do a second record of 600MB - 1.6 GB.
 
barney115

barney115

Donating Member
Staff member
Administrator
Messages
24,763
Very sound advice spinandspeed
after few months you'll soon figure which feeds give up Crypt8's Easy and fast , mostly GCUK ENC feeds require the Full 1.6GB around 12mins or more recording ,
and even then its 50/50 chance whether you get a fake Crypt8 or not ,lol's

cheers !
 
T

TheSamoyed

Donating Member
Messages
510
Any idea why it's so hard to get a good C8 for MLS and some other ATL Enc feeds.

I've recorded over 4gb on those feeds before and rarely does it give anything out.
 
M

mauricelugher

samoyed1976 said:
Any idea why it's so hard to get a good C8 for MLS and some other ATL Enc feeds.

I've recorded over 4gb on those feeds before and rarely does it give anything out.
Click to expand...

You have to catch the feed the erliest possible.
After a certain time, You cannot find the C8 anymore or it becomes so rare that's hard to find, like You said.
 
M

mauricelugher

I have a new example.
Code: 
TS file: C:\ISRUV_Tx01_7°E_10996_V_7200_20150608_1110_VPID_512.ts
Using all PIDs
Using file limit: 4096 MByte
File length: 324 MByte
UsingFileLen: 340613700 bytes
Reading file ...
Searching ...
Using payload size: 184
PID: 200h  B8h-Crypt8:CA 12 B9 03 A1 87 A2 9E  [E] Count:11
PID: 200h  B8h-Crypt8:74 FA EA D9 8B 3A BC 4C  [E] Count:10
PID: 200h  B8h-Crypt8:C9 53 02 43 47 38 2F 9F  [E] Count:7
PID: 200h  B8h-Crypt8:AD 8A 11 20 0D 17 BF 78  [E] Count:6
PID: 200h  B8h-Crypt8:1E 28 E0 52 86 20 DB 4C  [E] Count:3
PID: 200h  B8h-Crypt8:7D 34 0C EE AC 39 B0 E4  [E] Count:3
PID: 200h  B8h-Crypt8:C9 4F 8F 51 FD 0F 23 64  [E] Count:3
PID: 200h  B8h-Crypt8:32 77 23 13 BF D4 8F 12  [E] Count:2
...

PID:1030h  B8h-Crypt8:94 54 A0 2D 3A CA 63 77  [E] Count:4345
PID:1030h  B8h-Crypt8:B3 63 D7 40 09 26 6B 2D  [E] Count:4345
[B]PID:1030h  B8h-Crypt8:FF 2F 98 71 7C F3 2D AE  [E] Count:4345 <<-- Valid C8 B8x00h [/B]

I have checked them all.
One of the last triplet is good and gives the right CW
 
M

mauricelugher

A new example, TNA tonight

Code: 
Using payload size: 184
PID: 198h  B8h-Crypt8:A8 A5 10 89 E8 40 BC D1  [E] Count:128 <-- seems a good FFh
PID: 198h  B8h-Crypt8:8B EA 9B CA 25 55 CC 82  [E] Count:32    BUT ALL FAKES
PID: 198h  B8h-Crypt8:C9 93 64 8B C2 13 E7 75  [E] Count:32
PID: 198h  B8h-Crypt8:F9 1E F5 C2 2A FB 35 9F  [E] Count:32
PID: 198h  B8h-Crypt8:03 98 83 5C AD A0 2F A6  [E] Count:31
PID: 198h  B8h-Crypt8:18 C9 8C 73 E7 0E 04 38  [E] Count:31
PID: 198h  B8h-Crypt8:22 1E DE DD 0E B3 29 50  [E] Count:31
PID: 198h  B8h-Crypt8:4C 0E DD 88 46 4D 7F A7  [E] Count:31

Another try...

Code: 
Using payload size: 184
PID: 198h  B8h-Crypt8:A8 A5 10 89 E8 40 BC D1  [E] Count:38 <-- top count it's a fake
PID: 198h  B8h-Crypt8:20 2E 5A F1 CA C9 3D C9  [E] Count:24 <-- 000300h
PID: 198h  B8h-Crypt8:2A 51 12 21 C3 E5 22 7F  [E] Count:23 <-- 000003h
[B]PID: 198h  B8h-Crypt8:61 95 52 B2 E6 46 6D A7  [E] Count:23 <-- 030000h[/B]
PID: 198h  B8h-Crypt8:F9 1E F5 C2 2A FB 35 9F  [E] Count:22
PID: 198h  B8h-Crypt8:8B EA 9B CA 25 55 CC 82  [E] Count:21
PID: 198h  B8h-Crypt8:C9 93 64 8B C2 13 E7 75  [E] Count:19
PID: 198h  B8h-Crypt8:7F 18 E8 C1 C9 2B 35 71  [E] Count:18
 
AbuHaya

AbuHaya

Member
Messages
901
what about which table search
how know it is
08hx00h 08hx000300h 08hxFFh B8hx00h B8hx030000h B8hxFFh
 
B

bisshunter

Registered
Messages
51
Please Help..
Thaicom 5 (78.5'E)
MPEG 2 Stream Channel .
These Channel Not Show Scramble Sign. But Working before on and after with BISS Encryption.
I have recording round about 30 min .... getting on TS File size 315MB only.
Am I getting Wrong C8. Because Count no. are not satisfied.
Therefore i am doing another record TS file and Start to get Good C8. All Data C8 are getting not same. What problem might be. Please advise dear.
How can i get to good C8.

Search Crypt8 in TS Start
TS file: H:\[TS]2015-12-25.00.54.36-CH1-74\000.ts
Using PID: 231
Using payload size: 184
Using file limit: 4096 MByte
File length: 315 MByte
UsingFileLen: 331120640 bytes
Reading file ...
Searching ...
PID: E7h Crypt8:3F E1 AC CE A5 FD D2 0C [E] Count:169
PID: E7h Crypt8:8A F5 81 6B EB 15 97 42 [E] Count:162
PID: E7h Crypt8:57 F1 35 16 25 F5 91 E1 [E] Count:150
PID: E7h Crypt8:B7 6E 5F 21 99 FA EC A8 [E] Count:148
PID: E7h Crypt8:D9 EB 58 61 E3 57 25 57 [E] Count:148
PID: E7h Crypt8:E9 53 BD A3 DD A3 3E 11 [E] Count:142
PID: E7h Crypt8:3E 09 6D 0D C5 35 18 3E [E] Count:140
PID: E7h Crypt8:86 84 45 9B 06 EE A7 1B [E] Count:140
...

Time for searching Crypt8 = 1 sec.
 
D

Deviance

Registered
Messages
21
I have just downloaded Cobril's B8hxFFh table and can't add to rainbow table tool v2.05? I added using name button but doesn't work. Any help?
 
A

achilefu

Registered
Messages
57
how know it is
08hx00h 08hx000300h 08hxFFh B8hx00h B8hx030000h B8hxFFh after Searching ...
Using payload size: 184 . Pls help me! thanks
 
A

abra26

Registered
Messages
263
Hello. I have one question.
Is it alright to have RBT files on external HDD which is running under USB 3.0? Or is it better to have running RBT file on internal HDD for better speed? Thank you.
PS. The talk is about notebook.
 
G

gotya

Moderator
Messages
7,200
I have them both on external and internal but I advise you with internal

my V2 is on external HDD where my V1 is on internal HHD and SSD
 
Last edited:
You must log in or register to reply here.
Top