B8hx030000h CSA-RBT v2 table

C

C0der

Registered
Messages
267
It cant know the correct C8.
For the case of 030000 there are allways 3 C8 with similar counts.
It just can tell which of the 3 is the best guess sometimes.
 
I

izik888

Registered
Messages
122
C0der

I use a very old version ProgDVB6.45.4Pro To record TS files In accordance with the recommendations I received in the past From two forum members TheHighLander / barney115 Because ProgDVB versions 6.50 or higher Working with them is uncomfortable These are heavy and slow versions
 
C

campag5242

Feed Hunter
Messages
2,585
kebien said:
If there were any way to know,the program would only show the correct one.
But you do not know which is the correct one before decrypting it with the correct key.
Is the egg and the chicken,which one came first.

By the way,think about the irony : if you know the valid C8 before hand,you would not need a C8 at all.(you'd know which key is valid for it before looking for a C8).
Click to expand...
For the triplets, it *is* possible to identify B8hx030000h/B8hx000300h/B8hx000003h & their shorter variants reliably *and* whilst in cyphertext: https://www.sat-universe.com/showpost.php?p=2036884936&postcount=2
Basically: find an AF, check the preceding packets for alternating pattern, then take AF length's modulo div 3 to tag each of the three types. Colibri's tool does manage this for some B8hx030000h, but not all. Method as described in my post is working 100% reliably here now.

Video B8hxFFh / B8hx00h can often be picked out reliably *without* keeping stats of repeat counts... exception is audio B8hx00h, usually demanding some counting to tag it.
 
C

campag5242

Feed Hunter
Messages
2,585
C0der said:
But that only works, if there are enough AF, right?
Click to expand...
AFs are plentiful, terminating every mpeg PES packet whose length is not a multiple of 184. But yes, on that rare occasion that the mpeg PES length is a multiple of 184, you'd have to look at the ts packets preceding a PUSI: it would still be possible to spot a crypt8 in cyphertext.

If that PES packet includes some 00/ff/triplet padding (*always* added at the end), then examining the ts packets preceding an AF can enable you to identify the crypt8:

1. If there's a sequence of *identical* packets, then it's a B8h, either FFh for H264/5, or 00h for H262/audio
2. If there's an alternating pattern of ABCABC... then it's a triplet

Testing the 5 prior ts packets for these patterns works reliably here.
 
K

kebien

Registered
Messages
1,329
I understand is possible,just in reality the program is delivering many candidates and this won't change.
At the same time,there will be always some exceptions in how the TS is layed out and will have different results as for nailing the exact C8.
I tend to think always that all prediction methods won't work 100%,being the only one to know the key already.
Good work,I never got to read your post until now.
 
C

campag5242

Feed Hunter
Messages
2,585
kebien said:
I understand is possible,just in reality the program is delivering many candidates and this won't change.
At the same time,there will be always some exceptions in how the TS is layed out and will have different results as for nailing the exact C8.
I tend to think always that all prediction methods won't work 100%,being the only one to know the key already.
Good work,I never got to read your post until now.
Click to expand...
No ifs, no buts, it works and very reliably. See this old log:
Code: 
[C8Finder] 2019-11-30 07:21:46 s_ref 1:0:1:1:4321:0:462B0D:0:0:0:
[C8Finder] B8h Vpid:0200 [E] BD D2 6B C6 5A 2C C0 C2 [X] 334 A
[C8Finder] B8h Vpid:0200 [E] C8 4C F9 73 8C 24 1B 91 [X] 331 A <= B8hx030000h
[C8Finder] RBT search result: 2D D5 AE B0 29 8B 75 29 @ link 0F25h 00:03
[C8Finder] B8h Vpid:0200 [E] 75 21 61 AB 92 A3 8F 9F [X] 322 A
[C8Finder] 08h Vpid:0200 [E] D4 8A E6 A3 B0 7B 82 88 [X] 6:1 r7 <= 08hx000300h
[C8Finder] 08h Vpid:0200 [E] 81 44 C8 BB F7 5E 8E DB [X] 2:1 r2 <= 08hx000003h
[C8Finder] 08h Vpid:0200 [E] C3 BC 78 4D 37 96 EA 1A [X] 2:2 <= 08hx030000h
[C8Finder] All 6 candidate crypt8s are listed.
[C8Finder] Stream duration 00:00:33 filtered thus far.
[C8Tagger] 00 00 03 00 00 00 00 <= triplet plain residue
[C8Tagger]         030000h                   000300h                   000003h
[C8Tagger] C3 BC 78 4D 37 96 EA 1A : D4 8A E6 A3 B0 7B 82 88 : 81 44 C8 BB F7 5E 8E DB <= 08h
[C8Tagger] AD 2B 16 43 00 2A 95 3E :                         : 21 E4 3F 42 C9 A1 56 15 <= 10h
[C8Tagger] CA 59 79 03 4C FC 1F 98 : B2 CF 3A A8 13 0B 20 6D : 8A 73 CB 9A D9 1A 50 C2 <= 18h
[C8Tagger] E8 81 A4 E6 CB 38 3F CC : FE 3C 0A 39 94 DB AF 6F : CF AE E9 F1 28 32 20 43 <= 20h
[C8Tagger] 60 D1 6F 43 88 50 70 48 :                         : 7E 40 27 41 2B D1 1E A3 <= 28h
[C8Tagger]                         : FE 49 CE 51 40 91 DA 84 : 80 EF 1B B4 36 0B AB 8E <= 30h
[C8Tagger] 6E 59 5A 81 DA 5E 18 B5 : 04 01 38 18 4A C9 F6 A6 :                         <= 38h
[C8Tagger] A5 F0 C9 8E 58 83 FC 47 : 1E BD 19 71 75 65 DF 1B : 04 65 FC 49 D0 C8 EF 9F <= 40h
[C8Tagger] 28 F2 1B 71 85 67 4D 15 : E3 14 ED 19 0E CE DD 71 : 0B 43 DA BA 46 D3 6C C6 <= 48h
[C8Tagger] C9 BB F4 1F BE C6 3C 37 : 70 07 79 0D F4 A5 11 F2 : A9 0A 6F B3 08 56 71 B7 <= 50h
[C8Tagger] 9E 33 8C C9 D3 72 2B AC :                         : 5E BB 90 11 16 4D 25 0B <= 58h
[C8Tagger] 15 F1 1C AA DF 3F 30 74 : 6D 87 52 72 22 C5 8D 89 : 3A D8 90 1E 0E A1 A5 ED <= 60h
[C8Tagger] D3 57 EF 2B A2 5C DE 32 : F1 15 B2 6F B7 B0 41 7F : 92 3D E7 5F B5 0B 74 98 <= 68h
[C8Tagger] 4E 46 8D F2 8C CE 82 19 :                         : 92 E7 3D 9A FD 4A F9 5D <= 70h
[C8Tagger] BB B9 61 27 5B C7 EB C7 : 60 0A 89 F1 B4 E5 EE 20 : F1 E1 48 9C 2B E4 0C F7 <= 78h
[C8Tagger] 42 2D E3 59 41 12 1B 97 : 21 76 71 54 48 51 12 D0 :                         <= 80h
[C8Tagger] 59 39 7B 5D 19 C7 0C 4E :                         : 62 C6 52 85 E3 88 D8 4C <= 88h
[C8Tagger] 8B 27 7D 7B BD 55 26 DB : 6C 87 6B B8 96 8E 08 A7 : 7D 11 39 00 5D 75 4F 1A <= 90h
[C8Tagger] AB 4C 56 52 35 6C 17 75 : 0E 09 CC 03 58 36 D4 65 : 87 28 0C 08 66 02 42 ED <= 98h
[C8Tagger] 1B 7C 38 F8 7A 93 30 6E :                         : E4 DF AE 08 C9 0F C4 3F <= A0h
[C8Tagger]                         : 22 5A 5B 13 0F C8 B5 2E : DC 8B F0 E8 BC 60 89 26 <= A8h
[C8Tagger] 37 09 92 38 3C 2E 52 73 : 59 C8 A0 3B 1D 13 49 52 :                         <= B0h
[C8Tagger] C8 4C F9 73 8C 24 1B 91 : BD D2 6B C6 5A 2C C0 C2 : 75 21 61 AB 92 A3 8F 9F <= B8h
 
momi133

momi133

Senior Member
Messages
2,389
C8Tagger Algorithm

campag5242 said:
For the triplets, it *is* possible to identify B8hx030000h/B8hx000300h/B8hx000003h & their shorter variants reliably *and* whilst in cyphertext: https://www.sat-universe.com/showpost.php?p=2036884936&postcount=2
Basically: find an AF, check the preceding packets for alternating pattern, then take AF length's modulo div 3 to tag each of the three types. Colibri's tool does manage this for some B8hx030000h, but not all. Method as described in my post is working 100% reliably here now.

Video B8hxFFh / B8hx00h can often be picked out reliably *without* keeping stats of repeat counts... exception is audio B8hx00h, usually demanding some counting to tag it.
Click to expand...

Hi @campag5242

thanks a lot for sharing these great infos.

I wrote a python script according to your algorithm and test with Five ts files with Triple C8. Colibri's tool done tagging only for 2 of 5 files but by your algorithm, C8 tagging done for all files.

Search Crypt8 by Colibri's tool
Code: 
Search Crypt8 in TS Start
TS file: E:\record\B8hx030000h-WSHTENC57.ts
Using all PIDs
Using file limit: 4096 MByte
File length: 488 MByte
UsingFileLen: 512211264 bytes
Reading file ...
Searching ...
Using payload size: 184
PID: 200h  B8h-Crypt8:B5 A0 A0 FF 2E 48 72 E0  [E] Count:13485
PID: 200h  B8h-Crypt8:36 CC AD 0D B8 3E DF 06  [E] Count:13466
PID: 200h  B8h-Crypt8:EA 3A AC 6B AA 49 BF 41  [E] Count:13457
PID: 200h  B8h-Crypt8:EF 22 F9 1E BE 8A B6 36  [E] Count:10
PID: 200h  B8h-Crypt8:D4 27 8B 28 45 E6 41 57  [E] Count:3
PID: 200h  B8h-Crypt8:03 6A 67 A4 9B 4E 4F 7A  [E] Count:2

Search Crypt8 by your Algorithm
Code: 
D:\getC8>py getC8dicIII.py
E:/record/B8hx030000h-WSHTENC57.ts
PID = 512
FileSize : 488
Limit Size : MB = 500
Analysed MBytes : 488
Using payload size: 184

PID:200h(512) B8h-Crypt8: B5 A0 A0 FF 2E 48 72 E0 [E] Count:13485 Tag: B8hx000003h
PID:200h(512) B8h-Crypt8: 36 CC AD 0D B8 3E DF 06 [E] Count:13466 Tag: |<><B8hx030000h><>|
PID:200h(512) B8h-Crypt8: EA 3A AC 6B AA 49 BF 41 [E] Count:13457 Tag: B8hx000300h
PID:200h(512) B8h-Crypt8: EF 22 F9 1E BE 8A B6 36 [E] Count:10 
PID:200h(512) B8h-Crypt8: D4 27 8B 28 45 E6 41 57 [E] Count:3


But for this file, C8 tagging is not successful by two method: http://www.mediafire.com/file/g4xzqq357goe484/B8hx030000h-Eutelsat10A11305V.ts
this recorded file has two main VPID(301 & 401) with Triple c8.

PID:401 Crypt8-B8hx030000h: 43 06 D4 2A C6 55 5A BF
PID:301 Crypt8-B8hx030000h: 90 C0 6B 82 55 B6 E6 E2

Code: 
D:\getC8>py getC8dicIII.py
[B][COLOR="Blue"]PID = 301[/COLOR][/B]
E:/record/B8hx030000h-Eutelsat10A11305V.ts
FileSize : 99
Limit Size : MB = 100
Analysed MBytes : 99
Using payload size: 184

PID:12Dh(301) B8h-Crypt8: A4 FE CE 36 CD 2E 28 98 [E] Count:5425 Tag: B8hx000300h
PID:12Dh(301) B8h-Crypt8: 87 91 D2 B5 C2 05 26 AF [E] Count:5094 Tag: B8hx000003h
PID:12Dh(301) B8h-Crypt8: 90 C0 6B 82 55 B6 E6 E2 [E] Count:5028 Tag: B8hx000003h
PID:12Dh(301) B8h-Crypt8: EB 82 60 1B 5A 53 EF 64 [E] Count:861 
PID:12Dh(301) B8h-Crypt8: 27 92 9C 9A 8B DE 6A 42 [E] Count:861


Code: 
D:\getC8>py getC8dicIII.py
[B][COLOR="blue"]PID = 401[/COLOR][/B]
E:/record/B8hx030000h-Eutelsat10A11305V.ts
FileSize : 99
Limit Size : MB = 100
Analysed MBytes : 99
Using payload size: 184

PID:191h(401) B8h-Crypt8: 20 20 9F 33 6D 3A 57 76 [E] Count:5425 Tag: B8hx000300h
PID:191h(401) B8h-Crypt8: 11 D8 21 B2 47 0E FD 03 [E] Count:5094 Tag: B8hx000003h
PID:191h(401) B8h-Crypt8: 43 06 D4 2A C6 55 5A BF [E] Count:5028 Tag:
PID:191h(401) B8h-Crypt8: 5E 00 B3 08 FA 5F 68 19 [E] Count:861 
PID:191h(401) B8h-Crypt8: AB F0 2F 65 1C 9F 19 A6 [E] Count:861


this recorded file is related to this feed: https://www.sat-universe.com/showpost.php?p=2037093363&postcount=8561


Also in a post, You talked about an exception: https://www.sat-universe.com/showpost.php?p=2036884936&postcount=2
One exception to this was a following AF of length 79h where the payload was something other than 00 00 03 padding. Ignore those! Perhaps there are other exceptions, as I've only studied one encoder.
Click to expand...

Please:
1- Analyze this file and explain about tagging for this file.

2- Post [C8Tagger] log for this file like previous post.
 
Last edited:
C

campag5242

Feed Hunter
Messages
2,585
That exception you quote must've been a bug in my original implementation. I've since re-written that code, and it tags without fault ever since.

Unfortunately my offline tool failed to work on your recording, I suspect there is no PMT in the .ts as it didn't report any audio or video pids found:
Code: 
root@sf4008:/hdd/movie# ./c8tagger B8hx030000h-Eutelsat10A11305V.ts
[C8Finder] 200725@172514 Channel change detected: stats are reset.

[C8Finder] 2020-07-25 17:25:25 s_ref B8hx030000h-Eutelsat10A11305V.ts
[C8Finder] All 0 candidate crypt8s are listed.
[C8Finder] Stream duration 00:00:11 filtered thus far.
 
Last edited:
momi133

momi133

Senior Member
Messages
2,389
1- Do you have ts file for this log?


campag5242 said:
No ifs, no buts, it works and very reliably. See this old log:
Code: 
[C8Finder] 2019-11-30 07:21:46 s_ref 1:0:1:1:4321:0:462B0D:0:0:0:
[C8Finder] B8h Vpid:0200 [E] BD D2 6B C6 5A 2C C0 C2 [X] 334 A
[C8Finder] B8h Vpid:0200 [E] C8 4C F9 73 8C 24 1B 91 [X] 331 A <= B8hx030000h
[C8Finder] RBT search result: 2D D5 AE B0 29 8B 75 29 @ link 0F25h 00:03
[C8Finder] B8h Vpid:0200 [E] 75 21 61 AB 92 A3 8F 9F [X] 322 A
[C8Finder] 08h Vpid:0200 [E] D4 8A E6 A3 B0 7B 82 88 [X] 6:1 r7 <= 08hx000300h
[C8Finder] 08h Vpid:0200 [E] 81 44 C8 BB F7 5E 8E DB [X] 2:1 r2 <= 08hx000003h
[C8Finder] 08h Vpid:0200 [E] C3 BC 78 4D 37 96 EA 1A [X] 2:2 <= 08hx030000h
[C8Finder] All 6 candidate crypt8s are listed.
[C8Finder] Stream duration 00:00:33 filtered thus far.
[C8Tagger] 00 00 03 00 00 00 00 <= triplet plain residue
[C8Tagger]         030000h                   000300h                   000003h
[C8Tagger] C3 BC 78 4D 37 96 EA 1A : D4 8A E6 A3 B0 7B 82 88 : 81 44 C8 BB F7 5E 8E DB <= 08h
[C8Tagger] AD 2B 16 43 00 2A 95 3E :                         : 21 E4 3F 42 C9 A1 56 15 <= 10h
[C8Tagger] CA 59 79 03 4C FC 1F 98 : B2 CF 3A A8 13 0B 20 6D : 8A 73 CB 9A D9 1A 50 C2 <= 18h
[C8Tagger] E8 81 A4 E6 CB 38 3F CC : FE 3C 0A 39 94 DB AF 6F : CF AE E9 F1 28 32 20 43 <= 20h
[C8Tagger] 60 D1 6F 43 88 50 70 48 :                         : 7E 40 27 41 2B D1 1E A3 <= 28h
[C8Tagger]                         : FE 49 CE 51 40 91 DA 84 : 80 EF 1B B4 36 0B AB 8E <= 30h
[C8Tagger] 6E 59 5A 81 DA 5E 18 B5 : 04 01 38 18 4A C9 F6 A6 :                         <= 38h
[C8Tagger] A5 F0 C9 8E 58 83 FC 47 : 1E BD 19 71 75 65 DF 1B : 04 65 FC 49 D0 C8 EF 9F <= 40h
[C8Tagger] 28 F2 1B 71 85 67 4D 15 : E3 14 ED 19 0E CE DD 71 : 0B 43 DA BA 46 D3 6C C6 <= 48h
[C8Tagger] C9 BB F4 1F BE C6 3C 37 : 70 07 79 0D F4 A5 11 F2 : A9 0A 6F B3 08 56 71 B7 <= 50h
[C8Tagger] 9E 33 8C C9 D3 72 2B AC :                         : 5E BB 90 11 16 4D 25 0B <= 58h
[C8Tagger] 15 F1 1C AA DF 3F 30 74 : 6D 87 52 72 22 C5 8D 89 : 3A D8 90 1E 0E A1 A5 ED <= 60h
[C8Tagger] D3 57 EF 2B A2 5C DE 32 : F1 15 B2 6F B7 B0 41 7F : 92 3D E7 5F B5 0B 74 98 <= 68h
[C8Tagger] 4E 46 8D F2 8C CE 82 19 :                         : 92 E7 3D 9A FD 4A F9 5D <= 70h
[C8Tagger] BB B9 61 27 5B C7 EB C7 : 60 0A 89 F1 B4 E5 EE 20 : F1 E1 48 9C 2B E4 0C F7 <= 78h
[C8Tagger] 42 2D E3 59 41 12 1B 97 : 21 76 71 54 48 51 12 D0 :                         <= 80h
[C8Tagger] 59 39 7B 5D 19 C7 0C 4E :                         : 62 C6 52 85 E3 88 D8 4C <= 88h
[C8Tagger] 8B 27 7D 7B BD 55 26 DB : 6C 87 6B B8 96 8E 08 A7 : 7D 11 39 00 5D 75 4F 1A <= 90h
[C8Tagger] AB 4C 56 52 35 6C 17 75 : 0E 09 CC 03 58 36 D4 65 : 87 28 0C 08 66 02 42 ED <= 98h
[C8Tagger] 1B 7C 38 F8 7A 93 30 6E :                         : E4 DF AE 08 C9 0F C4 3F <= A0h
[C8Tagger]                         : 22 5A 5B 13 0F C8 B5 2E : DC 8B F0 E8 BC 60 89 26 <= A8h
[C8Tagger] 37 09 92 38 3C 2E 52 73 : 59 C8 A0 3B 1D 13 49 52 :                         <= B0h
[C8Tagger] C8 4C F9 73 8C 24 1B 91 : BD D2 6B C6 5A 2C C0 C2 : 75 21 61 AB 92 A3 8F 9F <= B8h
Click to expand...

1-Please send log for this feed:


7.0E Eutelsat 7A/7B
Football: Portuguese Liga NOS

11021 H 9875 (7.8dB*)
Ident: CHEVC4
Provider: EBUER
HD H264 420
 
C

campag5242

Feed Hunter
Messages
2,585
No, sorry, I do live stream analysis, no recording was made.

Match on 7E is in play now... I'm waiting for padding to arrive on that Liga NOS feed.

Turns out the match has not started yet, but padding took a while to come, not like when it first came up:

Code: 
[RBT Search] Cached Search: /home/wini7/rbt/D2AB12C600BF6EDB.B8hx030000h, count 0, lenAF 76h %3=1
[RBT Search] Result: XX XX XX XX XX XX XX XX @ link 0258h 00:25
[Emu] warning: user closed connection
[Emu] stream client 0 disconnected
[C8Finder] 2020-07-25 19:39:05 s_ref 1:0:1:1:4321:EB:462B0D:0:0:0:
[C8Finder] B8h Vpid:0200 [E] DA 8E 7F 1F F2 54 60 C9 [X] 20 A
[C8Finder] B8h Vpid:0200 [E] 1A F2 73 91 DC A9 C6 34 [X] 15 A
[C8Finder] B8h Vpid:0200 [E] D2 AB 12 C6 00 BF 6E DB [X] 11 A <= B8hx030000h
[C8Finder] RBT search result: XX XX XX XX XX XX XX XX @ link 0258h 00:25
[C8Finder] 08h Vpid:0200 [E] 25 6A EC CD 70 05 8F 2D [X] 16:1 r3
[C8Finder] 08h Vpid:0200 [E] 29 30 15 78 88 A2 31 1C [X] 12:1 r3
[C8Finder] 08h Vpid:0200 [E] 2D EE C0 5A BD 01 A6 71 [X] 9:1 r3
[C8Finder] 08h Vpid:0200 [E] F1 54 BF C2 32 6E 5B 12 [X] 8:1 r3
[C8Finder] 08h Vpid:0200 [E] EF 97 68 FE 33 05 F5 4F [X] 8:1 r3
[C8Finder] 08h Vpid:0200 [E] 86 5D 8C AF F2 24 07 C3 [X] 4:1 r3
[C8Finder] 08h Vpid:0200 [E] 37 BB AB 07 ED FD 6F 3E [X] 4:1 r3
[C8Finder] 08h Vpid:0200 [E] D2 8B A6 12 85 2E 5C BD [X] 4:1 r3
[C8Finder] 08h Vpid:0200 [E] F0 91 F4 F6 F2 72 08 84 [X] 4:1 r3
[C8Finder] 08h Vpid:0200 [E] 2E 4F 6D BE 64 BF C4 B8 [X] 4:1 r1
[C8Finder] 08h Vpid:0200 [E] 2B 9F 73 72 F1 30 3B 7F [X] 4:1 r3
[C8Finder] 08h Vpid:0200 [E] 4E 48 00 9D A5 E8 B8 7E [X] 3:1 r3
[C8Finder] 08h Vpid:0200 [E] EF C8 44 5A F9 5A 56 F9 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 26 2F DA BA ED FD 23 37 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 71 A0 92 4D 6D A2 8F 5D [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] F8 1B 53 DD 6F 4C AE 3D [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 04 C7 0D 54 29 6F 35 B7 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 64 15 11 77 4C C1 9F D0 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 93 B6 AC DE B6 D3 B9 E5 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 75 47 8E 06 B2 16 8C D2 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] FB D0 90 F5 AF 47 25 C5 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 56 D7 74 B1 52 FA CF A7 [X] 2:1 r3
[C8Finder] 08h Vpid:0200 [E] 27 D8 2C 44 7A A3 1C 26 [X] 2:1 r3
[C8Finder] All 26 candidate crypt8s are listed.
[C8Finder] Stream duration 00:09:01 filtered thus far.
[C8Tagger]         030000h                   000300h                   000003h
[C8Tagger] D2 AB 12 C6 00 BF 6E DB : 1A F2 73 91 DC A9 C6 34 : DA 8E 7F 1F F2 54 60 C9 <= B8h
 
Last edited:
You must log in or register to reply here.
Top