Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

JimBizkit

Registered
Messages
128
just select "File" and you can open a file

tsreader calls the service id "Progr."
 
Last edited:

ViaHussun

Donating Member
Messages
4,098
40.5 West

Ads_z.png


record
http://s5.dosya.tc/server2/cdcfnu/40.5W_3923_V_7000.rar.html

for thanks record otokoc :thum:
 

nicovil

Registered
Messages
14
Director != Tandberg

Director = Tandberg yes

I don't think so... I captured some Director channels and conditional access is detected as GENERAL INSTRUMENTS, instead of that, those channels with RAS are detected as Tandberg.

It would be nice to start a discussion about Director (GI) isn't it? What I saw is that there is no EMM stream, only ECM and Video/Audio.... perhaps someone has a dump of a receiver to take a look?
 

merkin

Registered
Messages
14
I don't think so... I captured some Director channels and conditional access is detected as GENERAL INSTRUMENTS, instead of that, those channels with RAS are detected as Tandberg.

It would be nice to start a discussion about Director (GI) isn't it? What I saw is that there is no EMM stream, only ECM and Video/Audio.... perhaps someone has a dump of a receiver to take a look?

GI = Digicipher
Descriptor: CA Descriptor
CA System ID: 18249 (0x4749) General Instrument
CA PID 4089 (0x0ff9)
 

gotya

Moderator
Messages
7,200
just now tested these 3 *.ts files
10.0E_11055_H_9874.ts
ts_0100_11141H_28500_prg3.ts
ts_0100_12689H_28499_prg19.ts

using Anubis_Ir poc1.2-win-bin and JimBizkit poc1.6 and were succeeded :thum:

Note: in poc1.6 I got more than EMM Keys included the curent active EMM Key

special thanks to Colibri.DVB

and thanks to Anubis_Ir for the *.mdl file and poc1.2-win-bin files

and thanks to JimBizkit for the updates of poc1.1 ===> poc1.6 :thum:

and thanks to all coders and all who share their knowledge and ideas to make it easier to all.
 

fiji

Member
Messages
1,095
poc 1.6

+ now printing active entitlement
+ now supporting raw emm logs (usage: poc emm.bin)
+ now caching unhandled E1 tags until ram keys are received
+ added more permission types


usage:
poc <raw emm stream file>
poc <ts input file> <srvid> <ts output file>


_https://mega.nz/#!UI5lWKhR!o5MGuxtx_ERc3UmMWLladhl5u6DtIHaMvBhDZZoVApE

Same Keys double repeat In This Version

New Option Is good printing active entitlement
 

kebien

Registered
Messages
1,329
I don't think so... I captured some Director channels and conditional access is detected as GENERAL INSTRUMENTS, instead of that, those channels with RAS are detected as Tandberg.

It would be nice to start a discussion about Director (GI) isn't it? What I saw is that there is no EMM stream, only ECM and Video/Audio.... perhaps someone has a dump of a receiver to take a look?

You know that the detection of the conditional access descriptor is all about what's written in the program or receiver you tuned this channels with,right?
I mean,if the CA list is not correct the descrition of the CA can be wrong.
The descriptor comes in the stream,the receiver reads and match it to a list in firmware,the list could be wrong.
Director = Tandberg
GI = Digicypher 1 and 2
 

C0der

Registered
Messages
270
Here are some Crypt8 for t@ndberg channels that dont send ECM-keys.
If someone could find the plain CWs, maybe we could brute the ECM-key.
Code:
SEE TEXT File attachment
 
M

mauricelugher

Here are some Crypt8 for t@ndberg channels that dont send ECM-keys.
If someone could find the plain CWs, maybe we could brute the ECM-key.
Code:
SEE TEXT File attachment

Even C8s are missing.
Good Luck.
PM sent :thum:
 

gotya

Moderator
Messages
7,200
Here are some Crypt8 for t@ndberg channels that dont send ECM-keys.
If someone could find the plain CWs, maybe we could brute the ECM-key.
Code:
SEE TEXT File attachment

All CWs were found and sent :thum:

What is the Sat and frequency info of these C8 ?
 

Liquor Twát

Registered
Messages
160
poc 1.6

+ now printing active entitlement
+ now supporting raw emm logs (usage: poc emm.bin)

usage:
poc <raw emm stream file>
poc <ts input file> <srvid> <ts output file>

What are tools for record raw EMM file to use with poc1.6, is it TSReader, Transedit or vplugs?
 

satfan_cn

Donating Member
Messages
86
Where is keys? What can I do? Thanks

my log file:
poc 1.6
raw EMM mode
[Emu] got EMM nano tag E0 (EMM_TAG_RECEIVER_ALLOCATION_DESCRIPTOR) for the first time
[Emu] got EMM nano tag E4 (EMM_TAG_SECURITY_TABLE_DESCRIPTOR) for the first time
[Emu] Keys found in EMM: new nano E4 ram keys 30 to 3F
[Emu] Keys found in EMM: new nano E4 ram keys 0 to F
[Emu] Keys found in EMM: new nano E4 ram keys 10 to 1F
[Emu] Keys found in EMM: new nano E4 ram keys 20 to 2F
 
Top