Oscam 1813

Status
Not open for further replies.

T50

Donating Member
Messages
230
As you may know me and my team have been working on a new oscam to crack the new nagra card from NC+ 1813
This oscam works with 1813 because in 1-01-2020 Nc+ 0100 will be stopped


Code:
2019/06/21 20:50:49 4714F0D6 c (ecm) watchdogs (1813&000068/3DD2/64/997****************************): found (253 ms) by NC+ - TVN 24 HD


There is no NUID and CWEKEY, thanks to CMD02 they are not needed. OSCam has a data88 field, but no key60 / exp60, and this is because OSCam with streamd on cmd0e had rigidly entered 0x70 bytes data88 + provider 3411 HD +. Key60 and exp60 had to be counted on their own. Patch adds the functionality of NNRSA , thanks to which you just give data88 / 3588, and OSCam will download the first 0x18 bytes and create key60 / exp60 from them, while further 0x70 bytes will paste into CMD02. Same with ProvID CMD02, OSCam retrieves it from the card's response and uploads it to CMD02. Thanks to this it is more universal.
we're working on adding all the cak7 and cak6 to the patch to make it work with the other Nagra cards.

This is my test dump
key 88
Block Header: 0000016C
MAGIC Data:
IRD = 0x 61DBBFA2
IRD = 1641791394
key(2008) = F42E2655F418FBAF
key(3008) = 42A025CEA95B8ACA
key(3140) == (RSA) = B484A93AFCEC4A393E91158E17B1BE815BF752659CF9223784AE81F42458910AB1B9B861C0EFEF0ECDAAACDB3149477434044C497029BB22A8842EE1B6294A19
key(3310) = 96471DB30E875EBFBC5A2C22FECA3F8F
key(3460) = 98B7872D1871BE8E9659C3080E86E45D42ABAC8B44F4A99F82BDE790C8D8E7E2F37A1DE8DBEBB8ACC7B576B407A30E986BB4A2AF43A896C2D4B7B6B6BF4FDFACDB06A6626924065D1BE02AF444F93518273F2CC5F1C3B25A7C0C4478197F796B
key(3588) = D63D2585550DFC8C7DE85E93063E748CF22B76E9E805709AA2F1B6503142F24C15837ABD1C78CFF2842EA0B2AAE497B4588A2D8B66E4CDC8730138E584A56A42934A069C48806D4E4840DCA45ADDE7FBDB52649C0BFE060306E82D72D63C6EF22C19C54FDEA1EA6A16C51E0B45E40D4610415C12FD9D523DD4C3C7EBC8FA6CFF81741ADF7B2B48BE
key(D008) = 8926FDCC1B041DDE
key(E002) = 0003
key(D008) XOR key(3008) == (BoxKey) = *B86D802B25F9714


All the files are in the attachments


Ps: this is not for regular use that's why there is no ubuntu version, this is only for 1813 local card reading.




Credits: watchdogs&team
 

T50

Donating Member
Messages
230
Update:​


We have managed to make a new patch for this oscam:
I attached the final patch.

In general:

Code:
- Conax CWPK support - I introduced a correction for incorrectly showing the lack of permissions for a given channel as a CWPK key error / now it distinguishes
- Cameleon support in 1813 mode:
- ECM and EMM (need to set up dvbapi PMT mode => 6 - use CA PMT server)
- without the Nuid card entered, the card is initiated from CMD02, with the entered Nuid OSCAM sends CMD0E (You must have a NUID-cwekey0 park for channels with CW Overcrypt)

Other News:


Code:
- Reader_Camel moved to a separate reader next to Reader_Nagra_merlin (for correct operation, you must always compile both readers)
- Necessary parameters for Cameleon: data50, mod50, mod1, key3588, idird OPTIONAL nuid, cwekey0.
- HD+ 03/04 works now, the reader contains the function RSA_idea_expand, so there is no need to set key60 and exp60 (DATA88 paste into key3588 in total 0x88 bytes)
- Necessary parameters for HD+: data50, mod50, mod1, key3588, idird, nuid, cwekey0
- mode 1813 on / off switch - the card defaults to the Nagra mode, in order to switch into SECA mode, stop the reader (settings, uncheck "Init Cameleon in 1813 mode"), save, enable reader

Known errors:

Code:
- AU - I could not fix AU for PMT Mode other than 6 => OSCam does not detect EMMs for CaID 1813 at all

- incorrect Exponent_cak7 - I noticed on mips, in case of Incorrect calculation exp_cak7 (= 00 00 00 00 00 00 00 00 00 00 00 00 00 01) we use the mipsel_1.0.2 version.


 

nautilus7

VIP
Messages
607
Code:
- AU - I could not fix AU for PMT Mode other than 6 => OSCam does not detect EMMs for CaID 1813 at all

What does the pmt mode have to do with AU and EMM detection? I can't understand this.
pmt mode determines how oscam gets notified by the receiver about new channels. ECM and EMM filtering is done the same way for all pmt modes.
 
Last edited:

leandrotsampa

Registered
Messages
20
Hi, thanks for share.
Not will work with my card because is a DNASP142 RevG13, and this not support change rom to cak7 but thanks.
 

bp211

Registered
Messages
6
Hi, thanks for share.
Not will work with my card because is a DNASP142 RevG13, and this not support change rom to cak7 but thanks.
for old rom142 with chipset pairing you have public oscam code somwhere
this rom does no need new protocoll just 3des decryption after SK
G06 brings chipset pairing to aladin cards G13 perhaps more security
 

leandrotsampa

Registered
Messages
20
Yes I know, I'm new on this world and all info is very limited but I got it.

I'm trying study some codes to try decrypt cwpk or bypass this.
Thanks

for old rom142 with chipset pairing you have public oscam code somwhere
this rom does no need new protocoll just 3des decryption after SK
G06 brings chipset pairing to aladin cards G13 perhaps more security
 

k2jones

Registered
Messages
11
Code:
2019/06/21 20:50:49 4714F0D6 c (ecm) watchdogs (1813&000068/3DD2/64/997****************************): found (253 ms) by NC+ - TVN 24 HD


There is no NUID and CWEKEY, thanks to CMD02 they are not needed. OSCam has a data88 field, but no key60 / exp60, and this is because OSCam with streamd on cmd0e had rigidly entered 0x70 bytes data88 + provider 3411 HD +. Key60 and exp60 had to be counted on their own. Patch adds the functionality of NNRSA , thanks to which you just give data88 / 3588, and OSCam will download the first 0x18 bytes and create key60 / exp60 from them, while further 0x70 bytes will paste into CMD02. Same with ProvID CMD02, OSCam retrieves it from the card's response and uploads it to CMD02. Thanks to this it is more universal.
we're working on adding all the cak7 and cak6 to the patch to make it work with the other Nagra cards.




All the files are in the attachments


Ps: this is not for regular use that's why there is no ubuntu version, this is only for 1813 local card reading.




Credits: watchdogs&team
key(3588) = D63D2585550DFC8C7DE85E93063E748CF22B76E9E805709AA2F1B6503142 F24C15837ABD1C78CFF2842EA0B2AAE497B4588A2D8B66E4CDC8730138E5 84A56A42934A069C48806D4E4840DCA45ADDE7FBDB52649C0BFE060306E8 2D72D63C6EF22C19C54FDEA1EA6A16C51E0B45E40D4610415C12FD9D523D D4C3C7EBC8FA6CFF81741ADF7B2B48BE
 

T50

Donating Member
Messages
230
[OSCam] cwpk & nagra camel & nagra cayman all patched and should be working with these version
All you have to do is dump the box to get the DCWPK keys and it will work
Max Tv works with this oscam too.


[Not for begginers ] ;)


E.G:

Code:
ak7_mod1 = 9AB78201C1BA2786EEDBAB070FE498305AD6EF49CC5CFCD00352162DAC6E4DAB14B1A64ED76BD185D09468DB6CD1DEEFA6F4C8FD184FE97FF1C59514FF810DF7AE027B9B3B7C6BFD7A8BAF8CE1D2573AB575FFF6B3C69C6AD529EE8D9281BA2C6B2CEF7B8A8868D985F1685B533BB7D7
cak7_mod2 = E4C4CEFEAA0E49553FD4E1E3EA584EC8EDBB0C49154E22822C73804A31E4B77AB8EE61EA7B94A5C63F007CDFA877B9EE855433CD54E5897DDF1209340EA2725170C4295A8CDD056BDBD8E37C070C65C611536C25E164A0CF1169AB248FCCD275B3DC79496D168820487C68013F53BA79


DOWNLOAD LINK

HERE:)

 
Last edited:

benzinol

Banned
Messages
17
[OSCam] cwpk & nagra camel & nagra cayman all patched and should be working with these version
All you have to do is dump the box to get the DCWPK keys and it will work
Max Tv works with this oscam too.


[Not for begginers ] ;)


E.G:

Code:
ak7_mod1 = 9AB78201C1BA2786EEDBAB070FE498305AD6EF49CC5CFCD00352162DAC6E4DAB14B1A64ED76BD185D09468DB6CD1DEEFA6F4C8FD184FE97FF1C59514FF810DF7AE027B9B3B7C6BFD7A8BAF8CE1D2573AB575FFF6B3C69C6AD529EE8D9281BA2C6B2CEF7B8A8868D985F1685B533BB7D7
cak7_mod2 = E4C4CEFEAA0E49553FD4E1E3EA584EC8EDBB0C49154E22822C73804A31E4B77AB8EE61EA7B94A5C63F007CDFA877B9EE855433CD54E5897DDF1209340EA2725170C4295A8CDD056BDBD8E37C070C65C611536C25E164A0CF1169AB248FCCD275B3DC79496D168820487C68013F53BA79


DOWNLOAD LINK

HERE:)


and as bonus get the users where download you oscam backdoor :thum: - the oscam will be sended decrypted ecm + own cache to Chinese commercial servers and they will resell it afterwards
 

T50

Donating Member
Messages
230
and as bonus get the users where download you oscam backdoor :thum: - the oscam will be sended decrypted ecm + own cache to Chinese commercial servers and they will resell it afterwards

As far as I know that happens the other way round my friend :thum:

& what you said doesn't make any single sense.
 
Last edited:

oldgraf

Registered
Messages
39
There are zero connections from box to outside world with thi oscam. The cameleon work fine. I only need a patch for the latest version of Oscam, this one is old
 

benzinol

Banned
Messages
17
There are zero connections from box to outside world with thi oscam. The cameleon work fine. I only need a patch for the latest version of Oscam, this one is old


try run oscam watch tv and too watch UDP ports on output and you will be see small 16B packets every 13-15 secods.. .. the same shits as latest CCcam !
 

oldgraf

Registered
Messages
39
sudo tcpdump host 192.168.1.199 and udp -vvv
tcpdump: listening on enp1s0, link-type EN10MB (Ethernet), capture size 262144 b ytes
12:30:04.445746 IP (tos 0x0, ttl 64, id 58426, offset 0, flags [DF], proto UDP ( 17), length 261)
192.168.1.199.netbios-dgm > 192.168.1.255.netbios-dgm: [udp sum ok] UDP, len gth 233
12:30:04.445842 IP (tos 0x0, ttl 64, id 58427, offset 0, flags [DF], proto UDP ( 17), length 236)
192.168.1.199.netbios-dgm > 192.168.1.255.netbios-dgm: [udp sum ok] UDP, len gth 208
12:30:23.880265 IP (tos 0x0, ttl 255, id 23743, offset 0, flags [DF], proto UDP (17), length 167)
192.168.1.199.mdns > 224.0.0.251.mdns: [udp sum ok] 0*- [0q] 5/0/0 _sftp-ssh ._tcp.local. [1h15m] PTR vusolo2._sftp-ssh._tcp.local., vusolo2._sftp-ssh._tcp.l ocal. (Cache flush) [1h15m] TXT "", vusolo2._sftp-ssh._tcp.local. (Cache flush) [2m] SRV vusolo2.local.:22 0 0, vusolo2.local. (Cache flush) [2m] AAAA fe80::21d :ecff:fe08:dcae, vusolo2.local. (Cache flush) [2m] A 192.168.1.199 (139)
For 10 minutes only this, while watching HBO2
Is this OK? Tcpdump run of router, vusolo2 and patched oscam is with IP 192.168.1.199
In general, I'm suspicious, but I read the patch file from the front page and it's not bad.
Anything else to test?
 

aegis

Banned
Messages
47
and as bonus get the users where download you oscam backdoor :thum: - the oscam will be sended decrypted ecm + own cache to Chinese commercial servers and they will resell it afterwards
and after that mr. Vladimir Blasko would wakeup from his xanax and bajkodin dream

what you said doesn't make any single sense.
offcourse that doesnt makes any sense coz it has been said trought high on xanax pills
 

benzinol

Banned
Messages
17
and after that mr. Vladimir Blasko would wakeup from his xanax and bajkodin dream


offcourse that doesnt makes any sense coz it has been said trought high on xanax pills

hmm M.r. Lukasz Filip from Gordzow Polland is again in action..
i see you now not cryed about nagra.. maybe you get some present from torun because you share ships slowly dead.. or maybe TESCO no have on these day acton for low-cost wine :D
 
Status
Not open for further replies.
Top