Can someone tell me what smart card theese are?

veso266

Registered
Messages
30
Hi there

I was looking on ebay for some atmel smart cards and found 2

I think this one is Funcard7: https://www.ebay.de/itm/333461189718?hash=item4da3d5f456:g:4uEAAOSwhYNeC09H

Because logo is the same as on Pulsesat one: https://www.pulsat.com/products/Funcard7-Wafer-Card.html

But what about this one: https://www.ebay.de/itm/234749268634?hash=item36a825929a:g:8jkAAOSwqyFfgsZ6

What atmel is inside and what eeprom

I would like to write apps for it

I am getting 2 of theese in a bundle and the seller has no idea what cards are theese

So does anyone maybe know by just looking at the logo?
 

barney115

Donating Member
Staff member
Administrator
Messages
24,681
They are all Antique's now yes i know exactly what those Fun cards are i have used those many years ago there is several variations still around from collectors [ i still have many myself ] .:cool:
They were old Fun cards used to hack old Nagravision Kudelski Group package channels that no longer exist
anymore such as D+ , Tvcabo , Premier Direkt and even some Irdeto 1 package channels that are long since gone .
it was possible to program using Cas3 Programmer or Dynamite and Cas Studio software ,
but things have moved on this is going back 15+ Years so i have no idea what you wish or hoping to achieve ?
i have those same Fun cards but today they are only useful to sit on a shelf or drawer collecting dust ,
back then it was possible to buy those for under £3 or mostly 5 for a fiver :eek:

it was also possible to MOSC -> (Modified) Original Smart Card to extend original Subscription Cards
almost indefinitely but those days are long gone .

You can read everything about these exact Fun Cards Here => https://www.weethet.nl/english/smartcards_types.php#

again its not smart to buy this unless you wish to start a collection of Antique Satellite equipment .
 

veso266

Registered
Messages
30
They are all Antique's now yes i know exactly what those Fun cards are i have used those many years ago there is several variations still around from collectors [ i still have many myself ] .:cool:
They were old Fun cards used to hack old Nagravision Kudelski Group package channels that no longer exist
anymore such as D+ , Tvcabo , Premier Direkt and even some Irdeto 1 package channels that are long since gone .
it was possible to program using Cas3 Programmer or Dynamite and Cas Studio software ,
but things have moved on this is going back 15+ Years so i have no idea what you wish or hoping to achieve ?
i have those same Fun cards but today they are only useful to sit on a shelf or drawer collecting dust ,
back then it was possible to buy those for under £3 or mostly 5 for a fiver :eek:

it was also possible to MOSC -> (Modified) Original Smart Card to extend original Subscription Cards
almost indefinitely but those days are long gone .

You can read everything about these exact Fun Cards Here => https://www.weethet.nl/english/smartcards_types.php#

again its not smart to buy this unless you wish to start a collection of Antique Satellite equipment .
Thanks for the link

I think its a funcard but sadly this with red dot is not listed on website

This has a computer inside, I would like to program this cards with my own software, this has nothing to do with current sat tv channels

But dont know what micro controller is powering them and how much eeprom they have?
 
Last edited:

campag5242

Feed Hunter
Messages
2,582
Those funcards, based on Atmel AT90S8515 plus I2C EEPROM of varying size (and similar eg ATMega163) were the last "computer" I felt I had near total mastery of at the hardware level. Everything else since then has become massively complex. Writing in avrasm assembler and all. I had the fastest funcard RSA decrypt around (by way much improved primitive multitasking, rather than any fancy maths tricks)... hope I still have the sources.
 

veso266

Registered
Messages
30
Those funcards, based on Atmel AT90S8515 plus I2C EEPROM of varying size (and similar eg ATMega163) were the last "computer" I felt I had near total mastery of at the hardware level. Everything else since then has become massively complex. Writing in avrasm assembler and all. I had the fastest funcard RSA decrypt around (by way much improved primitive multitasking, rather than any fancy maths tricks)... hope I still have the sources.
How did you program them?

Did u use AVRStudio?

How did debugging worked?

I wanted to try to make one into a Javacard and hook it up to the phone and maybe have a full size simcard hooked via pcsc reader
 

campag5242

Feed Hunter
Messages
2,582
There were a variety of software tools, plus all manner of hardware interfaces for programming. Hardware was anything from home-made parallel port device plus avrdude, through to Duolabs CAS2/3 and its bundled software. The latter is probably your preferred solution on modern PC only offering USB ports.

No IDE for me, just my favourite text editor plus command line assembler. Debugging for me was crude... a PCB version of the funcard exposing extra i/o for LEDs to show status plus serial tx line for printf() debugging. AVRStudio most likely offers an emulator, though I cannot recall using it.
 

campag5242

Feed Hunter
Messages
2,582
Around 20 years ago the new digital conditional access systems were at their first revision... at one time a single funcard could open the majority of DTH broadcasts. As years went by, smartcard security got hardened, and algorithms / encryption became more sophisticated eg RSA was employed instead of / as well as DES etc The humble funcard / 8515 no longer had the raw processing power to deal with the revised/strengthened CAS's ECMs at the required rate (crypto period still around 10s, but workload excessive), even where the new smart cards had been compromised. At this point emulation moved onto more powerful smartcards (usually commercial hacks), and then back on to PC based emulators, so completing the circle from the original Windecrypt SECA/Irdeto emulator from Paul Arnold.

There may be a tiny number of uninteresting channels still employing ancient & compromised security these days.
 

music4keep

Registered
Messages
8
How the hacks went and evolved/devolved depends on where you look. We had a hack where we could open a box with the service menu then... the secret... then program an original card, i.e. Viaccess, Eurocrypt and with some modifications Irdeto, MediaGuard and VideoCrypt. You then inserted an original card of the system, put the box on a package using that system and see the CAID being added to the card and after a while see it clear. It required around 2-3 cards for each system to cover it all except Eurocrypt that could be programmed on a Viaccess card (and vice versa).
However, to the Fun cards. You might find a reader/writer. Just see to that you get the software that came with it or you may sit with hardware that is completely worthless.
 

veso266

Registered
Messages
30
Here is my setup: I found CAS3+ Studio here: http://www.duolabs.tv/download/CIS987.zip
After loading this into CAS3+ it detected it as Funcard2

So I guess this is what I have: https://www.pulsat.com/products/Funcard2-Wafer-Card.html
but mine has a different picture

Now for the full detection it wants me to erase the card, which I don't want to do, would first like to make a backup, not sure how

BTW: is it possible to force this Duolabs CAS3+ into PS/SC smart card mode
a lot of software I have only want PS/SC readers, and I can only do Phoenix interface using Duolabs CAS3+

BTW2: how do I write and compile a helloworld on this card? (I know I have no IO, but there has to be something to tell me my program works (I would like to run java on here, so I could install some java applets on the card, not sure if its possible, my ultimate goal is to do this:
(I would like to essentialy emulate a sim card (this phone: https://en.wikipedia.org/wiki/Motorola_StarTAC does accept full size smart cards so physical size is not a problem)

And yes, I wanted duolabs CAS3+ instead of generic PS/SC reader, because it has season interface built in as well as Season logger (if I read this right)

@campag5242 do you have some schematics for your debugging setup?
 

campag5242

Feed Hunter
Messages
2,582
Hi - I will make every effort to help you. It'll be kind of nice to revisit where I started off. All my funcard projects were ISO7816 (ie smartcard) emulators for Nagravision 1. I have no idea about java: I only truly know/use C these days... I'm very rusty on atmega assembler.

I wouldn't worry about erasing the card, that's pretty standard when programming. Likely the card will be blank anyway, or contain some useless (these days) emu.

Is phoenix not the same as PC/SC? In my mind they have the same functionality: talk to an ISO7816 smartcard.

Schematics lol - everything was written on the back of an envelope. I'm even having to google the funcard wiring. There'll be a single i/o line which was used for ISO7816 comms, and maybe one or two more, used for programming (MISO/MOSI?). If your application is not pure ISO7816 then you could repurpose those programming lines for debug data perhaps. My development "funcard" was a PCB version which had a 2nd serial exposed to hook up to PC. But only ever crude printf() debugging.
 

veso266

Registered
Messages
30
Hi - I will make every effort to help you. It'll be kind of nice to revisit where I started off. All my funcard projects were ISO7816 (ie smartcard) emulators for Nagravision 1. I have no idea about java: I only truly know/use C these days... I'm very rusty on atmega assembler.

I wouldn't worry about erasing the card, that's pretty standard when programming. Likely the card will be blank anyway, or contain some useless (these days) emu.

Is phoenix not the same as PC/SC? In my mind they have the same functionality: talk to an ISO7816 smartcard.

Schematics lol - everything was written on the back of an envelope. I'm even having to google the funcard wiring. There'll be a single i/o line which was used for ISO7816 comms, and maybe one or two more, used for programming (MISO/MOSI?). If your application is not pure ISO7816 then you could repurpose those programming lines for debug data perhaps. My development "funcard" was a PCB version which had a 2nd serial exposed to hook up to PC. But only ever crude printf() debugging.
Thanks

Thats how I understand the smart card flow
Layer1: Smart card (piece of plastic with a μC inside Atmel 8515 in this case as well as 24LC1024 Eeprom for data storage I presume

Layer2: Program written for Atmel 8515 it can blink a LED (if you hook a led to the card pins) or what it usualy does is eather run Java (incase of a SIM card) or some properority program that eather stores your bank certificate or in this case manages ViaAcsess, or Nagravision, or Videocrypt, or whatever encryption method people invented)

Layer3: Phone (incase of SIM card) or TV (incase of SAT) or PCSC Card reader
Layer4: User program usualy runs on a phone or on a computer and can comunicate with card reader (like Layer3 specifies

Layer3 comunicates with Layer2 using APDU commands

OK so, PCSC readers (or serial(Phoenix) readers, but PCSC are better because with them you can use industry standard smart card programs like your bank card program, your health card program or your windows (to use your smart card to login to windows, etc)

PCSC readers can comunicate only with Layer3 (you can not program your card with Layer3, because usualy program cannot rewrite itself (only if you cause buffer overflow, or glitch the card and somehow manage to implant your own code that rewrites it (some guy did just that to dump a card)

And some of my programs like SIM Aliance loader or Smart Card Toolset Pro or APDUscanner only work with PCSC readers

I see no reason why Duolabs CAS3+ could not support PC/SC (as it seams it has full speed USB bus, completly in software control), but for some reason I cannot find this option anywhere (even on the internet nothing is written anywhere about this)

it seams so stupid that you have a full features smart card reader, and then you have to buy another one just because your full features one doesn't support PC/SC

I even written to duolabs asking about this (maybe they don't know english, and I should have written in Italian, but sadly I don't know Italian), but received no response sadly (oh how I hate when company stops supporting a product, and never gives source code or schematics away after that (its like, f*** you, we don't care, any you also will not use it, because we say so)


BTW: do you maybe have some scripts or compiler, left somewhere (what u used) (I was thinking of using Atmel Studio as an IDE, but not sure if smart card is realy smart enought for that)
not sure how a hello world on a card could look like, I mean it seams all the pins are connected with a reader so, the card can send data to reader

Like, how would a basic hello world on a smart card even look like (it seams blinking a led is not a smart card thing), like is there any response I can send from a card, telling a reader that the firmware works? (like Hello card here, I work)

I do have an Atmel development board based around Atmel SAM 9260 so if I need to debug something more complex I have hardware to do that (althought its different Atmel CPU, so not sure how compatible things are in Atmel world)
 
Last edited:

campag5242

Feed Hunter
Messages
2,582
I still have my old PC which should have all my build environment for Atmel (maybe even AVR Studio) and sources both public and private. Hopefully it will still boot.

One thing you may have noticed from the plastic funcard's schematics (ie credit-card sized smartcard with embedded 8515) is that the ISO-7816 i/o line is *not* connected to an 8515 pin with hardware serial interface. Serial comms were bit-banged! That is one a feature I re-wrote from scratch to gain a better understanding, even though similar was available in the public sources.

"Hello World" for smartcard would be to send ATR (answer to reset) message at the default baud rate. The ATR includes details of what baud rate to use for subsequent messages. Stuntguy's Nagravision hacking FAQ is a brilliant starter read and the section on ATR should get you on your way (as it did for me 20 or so years ago): https://dokumen.tips/documents/nagra-faq-sg-dec2000.html?page=1

In Stuntguy's document, IRD = decoder/receiver/your card reader, cam = smartcard.
 

veso266

Registered
Messages
30
I still have my old PC which should have all my build environment for Atmel (maybe even AVR Studio) and sources both public and private. Hopefully it will still boot.

One thing you may have noticed from the plastic funcard's schematics (ie credit-card sized smartcard with embedded 8515) is that the ISO-7816 i/o line is *not* connected to an 8515 pin with hardware serial interface. Serial comms were bit-banged! That is one a feature I re-wrote from scratch to gain a better understanding, even though similar was available in the public sources.

"Hello World" for smartcard would be to send ATR (answer to reset) message at the default baud rate. The ATR includes details of what baud rate to use for subsequent messages. Stuntguy's Nagravision hacking FAQ is a brilliant starter read and the section on ATR should get you on your way (as it did for me 20 or so years ago): https://dokumen.tips/documents/nagra-faq-sg-dec2000.html?page=1

In Stuntguy's document, IRD = decoder/receiver/your card reader, cam = smartcard.
Hi there, did u manage to make ur pc boot?
 
Top