Spanish Abertis DTT Sat @ Hispasat 30W - Chat & How to guides

xosef1234 · Nov 19, 2022

Have a look at the last 4 bytes of the 160h payload where the c8 is found. I found 2 different 4-byte blocks:
bf 77 58 cb
bf 30 48 cb

If you now follow the rule which applies for stream cipher
crypt1 xor crypt2 = plain1 xor plain2
and assuming that plain2=00 00 00 00
you see the following:
(bf 77 58 cb) xor (bf 30 48 cb) = 00 47 10 00

Without having the key, you see that one header of the plaintext is 47 10 00 xx.
Knowing that T2-MI streams usually are within pid 0x1000 (4096) we can assume that this stream most probably is a T2-MI stream

Adam792 · Nov 20, 2022

xosef1234 said:
Have a look at the last 4 bytes of the 160h payload where the c8 is found. I found 2 different 4-byte blocks:
bf 77 58 cb
bf 30 48 cb

If you now follow the rule which applies for stream cipher
crypt1 xor crypt2 = plain1 xor plain2
and assuming that plain2=00 00 00 00
you see the following:
(bf 77 58 cb) xor (bf 30 48 cb) = 00 47 10 00

Without having the key, you see that one header of the plaintext is 47 10 00 xx.
Knowing that T2-MI streams usually are within pid 0x1000 (4096) we can assume that this stream most probably is a T2-MI stream

Very interesting find! So it looks like it could be encapsulated T2 (T2-MI) that’s then encapsulated again and encrypted in the regular Abertis/HSA TLS format?

Two extra layers of encapsulation seems crazy.

pipino · Nov 20, 2022

another interesting observation! the weight of the contents is much bigger than what we normally see (34MB/s instead of 21MB/s)

pipino · Nov 20, 2022

Infos Taken from another forum

It has a DTT mux structure and pid 802 uses one of the known DTT keys but when decrypting the mux it only contains a PAT, a PMT (pid 256) and a second pid (4096) with a bitrate of 33.1Mbit/s and in clear ....
I can only speculate that this pid contains a transport frame to inject into the DTT transmitters, but I have no way of seeing it at the moment without creating an application and therefore I doubt that any standard decoder can process it.
Greetings.

EDIT: Well, yes, it is the RTVE mux, looking in ASCII in the dump I find this text "TVE UHD Channel in testingTVE UHD Channel in testing" which must be part of an SDT table.

For firmware or application developers the process is:
Decrypt pid 802 with biss key

Get the payload of pid 802

Inject the payload to the input of the demultiplexer as if it were a standard TS

cirio · Nov 20, 2022

pipino said:
Infos Taken from another forum

it only contains a PAT, a PMT (pid 256) and a second pid (4096) with a bitrate of 33.1Mbit/s and in clear

At this point it's clearly T2-MI (pid 4096): we just need to understand how this can be fed to our E2 receivers.
Unfortunately my dish is stuck at 9E for a few days and i can't try anything

dvlajkovic · Nov 20, 2022

pipino said:
Infos Taken from another forum

Umm... @pipino from what PID(s) is that known CW that is also good for PID 802?

pipino · Nov 20, 2022

@dvlajkovic

That what i was wondring too

dvlajkovic · Nov 20, 2022

PID 802
There are two UHD channels:

TVE UHD Canal en pruebas
UHD Spain en SDR

Both are 4K resolution, 10bit, HDR, Dolby Atmos, 50 fps.

It is true: you need to decapsulate T2-MI and decrypt BISS, then to decapsulate T2-MI one more time.

Here is my recording of .TS file decapsulated, decrypted and decapsulated once again > link to download.
You can play .ts with VLC or MPC-HC players.

Thanks to @pipino for gettting the correct CW somewhere on the Net.

pipino · Nov 20, 2022

Well done amigo

mouadhada · Nov 20, 2022

Excellent job @dvlajkovic.
Do you think that we will see it soon on enigma 2 receivers ?

pipino · Nov 20, 2022

Its clear that this transmission is temporary for Terrestrial Transmiters only , no way Televes ZAS box could manage this

mouadhada · Nov 20, 2022

We have some transmissions for dtt that we can catch by enigma2 receivers, like France on 5W or italy also !

pipino · Nov 20, 2022

mouadhada said:
We have some transmissions for dtt that we can catch by enigma2 receivers, like France on 5W or italy also !

Its not the same !

dvlajkovic · Nov 20, 2022

mouadhada said:
Excellent job @dvlajkovic.
Do you think that we will see it soon on enigma 2 receivers ?

I guess it depends on the great Sat Dream Gr team, the one that first brought Abertis to many E2 receivers.

EnoSat · Nov 21, 2022

dvlajkovic said:
I guess it depends on the great Sat Dream Gr team, the one that first brought Abertis to many E2 receivers.

thanks for your efforts

xosef1234 · Nov 21, 2022

Both decap-methods exist already, you just have to combine them ....

Code:

make_channel({
  name = "Abertis PID 802",
  input = {
    "http://localhost:8001/1:0:1:70A:EA7E:0:CE42AAA:0:0:0:",
  },
  transform = {{
    format = "pipe",
      command = "/etc/astra/scripts/abertis 802",
  }},
  output = {
    "http://0.0.0.0:9999/abertis/pid802",
  },
})

f10992abertis0 = make_t2mi_decap({
        name = "Abertis PID 802",
        input = "http://0.0.0.0:9999/abertis/pid802",
        plp = 0,
        pnr = 0,
        pid = 4096,
})

make_channel({                                                         
  name = "10992plp0",
  input = {
    "t2mi://f10992abertis0",
  },
  output = {
    "http://0.0.0.0:9999/abertis/pid802plp0",
  },             
})

Stevenvc19 · Nov 21, 2022

xosef1234 said:

Both decap-methods exist already, you just have to combine them ....

Code:

make_channel({
  name = "Abertis PID 802",
  input = {
    "http://localhost:8001/1:0:1:70A:EA7E:0:CE42AAA:0:0:0:",
  },
  transform = {{
    format = "pipe",
      command = "/etc/astra/scripts/abertis 802",
  }},
  output = {
    "http://0.0.0.0:9999/abertis/pid802",
  },
})

f10992abertis0 = make_t2mi_decap({
        name = "Abertis PID 802",
        input = "http://0.0.0.0:9999/abertis/pid802",
        plp = 0,
        pnr = 0,
        pid = 4096,
})

make_channel({                                                       
  name = "10992plp0",
  input = {
    "t2mi://f10992abertis0",
  },
  output = {
    "http://0.0.0.0:9999/abertis/pid802plp0",
  },           
})

I will try it this evening.
Which channel do you need to put in the channel list in order to get the data from?

Stevenvc19 · Nov 21, 2022

pipino said:
Its clear that this transmission is temporary for Terrestrial Transmiters only , no way Televes ZAS box could manage this

The transmission is indeed for Terrestrial Transmitters only.
It's hower not "temporary". The transmission contains two UHD channels as you can see. Only TVE UHD will be renamed to UHD-1 after the World Cup of Qatar. The Feed hower should stay on air.

pipino · Nov 21, 2022

Stevenvc19 said:
The transmission is indeed for Terrestrial Transmitters only.
It's hower not "temporary". The transmission contains two UHD channels as you can see. Only TVE UHD will be renamed to UHD-1 after the World Cup of Qatar. The Feed hower should stay on air.

we shall see

Adam792 · Nov 21, 2022

Trying to get this decoding using TVHeadend, which should work in the same way by running via OSCam and the Abertis script, then using astra-sm.

The key (as I think hinted to further up), doesn't in fact seem to be any of the ones already in use after all, unless I've got some of the configuration wrong elsewhere... So until I manage to find that out, I can't get to the astra-sm step.

Edit: seems from elsewhere, that 'already known' means 'one that used to be used'.

Spanish Abertis DTT Sat @ Hispasat 30W - Chat & How to guides

xosef1234

Registered

Adam792

Registered

pipino

Registered

pipino

Registered

cirio

dvlajkovic

Member

pipino

Registered

dvlajkovic

Member

pipino

Registered

mouadhada

Registered

pipino

Registered

mouadhada

Registered

pipino

Registered

dvlajkovic

Member

EnoSat

Senior Member

xosef1234

Registered

Stevenvc19

Stevenvc19

pipino

Registered

Adam792

Registered