checked the ECMs for NA muxes... looks to be DES not CSA for all the signals I randomly checked.
As far as EMM logging goes...
recorded 2 hours for 123 MB, then recorded same TP 7 minutes totaling 7 MB. Both files yield the same amount of unique EMMs... so 30-60 minutes should be sufficient for the headend type muxes. each EMM is yielding 2 or 3 crpyts (odd even balckout ect).
125W 4080H - 28229 unique crypts (7MB)
125W 3960H - 72891 unique crpyts (9MB)
assuming 70M keys/sec on the brute force... this equations yields the max number of hours to find the EMM key:
2^(59-log(#crypts)/log(2))/(70*10^6)/(60*60)=
50k = 49 hours
100k= 34 hours ... reasonable!
now to actually do the brute forcing on CUDA... we are stuck at the algorithm and sboxes...
anyone know the inner logic of the s-boxes for the EMM?