I found this challenge while ago where they do BF the ECM to calculate the right Key to get CW so ts starts with 0x00 0x00 0x01, just like BF CSA.
http://mitega.github.io/write-ups/32C3_CTF/carder/index_en.html
They do use a Fun card and the CAID 0b00 (Conax), but I expect the algo on the Fun...