Hacking CA system challenge *Tandberg [ NO Keys Allowed in Chat Section/s ]*

A

Anubis_Ir

Registered
Messages
370
ViaHussun said:
these files


there is problem?
Click to expand...

Open the `run.bat` file with the notepad. it's a normal .txt file.
Then change the file names (according to your files) or add new entries.
also this `3` here
poc ts_0100_11141H_28500_prg3.ts 3 out.ts
is important. for prg3 use 3, for prg19 use 19.



If the key doesn't work anymore, record a full .ts and use poc.exe to find the new ecm-key.
 
A

Anubis_Ir

Registered
Messages
370
I can play the posted .ts files (using TSReader's transport stream file loop source)
 
Last edited:
D

drhans

Registered
Messages
116
007.4 said:
I've extracted the RAM EMM keys from two consecutive packets on 39°E, encrypted with different ROM EMM keys. Although the encrypted payload is obviously different the decrypted payloads (RAM keys block index 1x) are identical. So perhaps they do not change too often.

Code: 
82 70 8A 00  51  17 E3 F0 84 E4 82 FF FD  92 B6 D3..... 
                                                                                                            
82 70 8A 00  52  C5 DE F0 84 E4 82 FF FD  FA F2 0E.....

The question remains. Where are the encrypted ECM keys (normally located in EMM 83 70 40....) to be found?
They are not in the EMM stream nor in the ECM stream. I also checked the Bulcrypt (simulcrypted) EMM stream and they were not their either - although I didn't think they would be!

Has anyone any idea about this?
Click to expand...

I logged 12+ hours but no table 83. Maybe they don't send ECM key at all. The only way to get it might be brute force - we know the decrypted CWs (thanks to Bulcrypt simulcrypt) and we know the encrypted Tandberg CWs from the ECM stream. So it should be possible to crack the DES ECM key. I know DES is considered broken but it still might take pretty long time to bruteforce the key. I'm not sure how much time would it take, maybe not so much on a fast CUDA GPU.
 
K

K2TSET

Registered
Messages
125
drhans said:
I logged 12+ hours but no table 83. Maybe they don't send ECM key at all. The only way to get it might be brute force - we know the decrypted CWs (thanks to Bulcrypt simulcrypt) and we know the encrypted Tandberg CWs from the ECM stream. So it should be possible to crack the DES ECM key. I know DES is considered broken but it still might take pretty long time to bruteforce the key. I'm not sure how much time would it take, maybe not so much on a fast CUDA GPU.
Click to expand...

Sure it's possible :)

Think "Hashcat" can do it using CUDA but never tried, DES key are "only" 56bit but the DES are not so many rounds. but still 2^56 is a big number to test

Also it might be possible to make a FPGA for that but it will sure take some time to design such a BF engine, I know there are some open FPGA cores for DES around.
 
M

merkin

Registered
Messages
14
also can anyone help me with structure of OTA firmware download?
i recorded a pid labeled "Software Download".
_https://mega.nz/#!y5cFnB5T
 
A

Anubis_Ir

Registered
Messages
370
ViaHussun said:
Anubis_Ir thanks :)
But, dvb player down :(
I am smartdvb test
sorry :(
Click to expand...

It works fine. You should select the correct sid/program number:



for ts_0100_12689H_28499_prg19.ts, select sid=19
File menu -> Play transport stream DVB file -> Select SID=19
 
Last edited:
ViaHussun

ViaHussun

Donating Member
Messages
4,098
Anubis_Ir said:
It works fine. You should select the correct sid/program number:



for ts_0100_12689H_28499_prg19.ts, select sid=19
File menu -> Play transport stream DVB file -> Select SID=19
Click to expand...



yes add key D0... ;) working :)
perfect ;)
very thanks Anubis_Ir :)


 
C

Colibri.DVB

VIP
Messages
44
K2TSET said:
Sure it's possible :)

Think "Hashcat" can do it using CUDA but never tried, DES key are "only" 56bit but the DES are not so many rounds. but still 2^56 is a big number to test

Also it might be possible to make a FPGA for that but it will sure take some time to design such a BF engine, I know there are some open FPGA cores for DES around.
Click to expand...

I have never seen a Tandberg ECM key that is using the full key space 2^56.
Compare all the 8 ECM keys we have so far and you will see something.
So what is the key space that Tandberg is practically using?
 
djris2

djris2

Registered
Messages
320
Im asking Becouse Last Year wimbledon on 7E had been using Tandberg for one of Main Internal feeds, And i think OBS for Sochi Olympics too. I hope for The bestt from you guys :)
 
You must log in or register to reply here.
Top