How to decrypt Biss & Powervu

[WilburSmith]

Hello everyone,

I have come across several threads where others request specific keys, such as those for Biss or PowerVu. Typically, someone will respond by asking the requester to record a few seconds of a broadcast and send it to them. I have a few questions regarding this process:

1. Recording the Broadcast: What program do you use to make such a recording?
2. Viewing the Recording: Once you have this recording, how do you open and view it? What exactly are you looking for in the recording?
3. Decrypting the Key: What program is needed to decrypt the key, for example, a BISS or PowerVu key?

Additionally, I am curious to know if this decryption process can be performed using an everyday PC. I find this subject fascinating and am eager to learn more. If anyone could provide some guidance, it would be greatly appreciated.

Thank you in advance for your assistance.

 

[EnoSat]

You can start reading

PowerVu Chat [only chat, don‘t post keys here]

progress with powervu maybe? http://colibri.bplaced.net/PowerVu_management_keys_hacked.pdf

www.sat-universe.com

PowerVU config

Open Source Cam Emulator. Contribute to oscam-emu/oscam-patched development by creating an account on GitHub.

github.com

BISS1 and BISS2 mode 1 config

Open Source Cam Emulator. Contribute to oscam-emu/oscam-patched development by creating an account on GitHub.

github.com

Blindscan multistream. Now what?

Yeah. More and more blindscans are showing multistream here in the US. Spotty information of what to do next, for real. I add them to my satellite.xml for the sat that they turned up on. Manual scans for channels show nothing found. Encrypted or not it would be nice to get a tutorial covering...

www.sat-universe.com

 

[WilburSmith]

EnoSat this is a great start. Thanks! I was just recently asking about how the key is broken into its parts, e.g. :

F <sid><pid> 00000000 <key>

And now I found my answer!

This will be a good read for this week. Thanks for sharing!

 

[EnoSat]

a value of 2 will show you more details (GROUP,HASH,F) in the LiveLog that are entered into softcam.key

OSCam/en/Config/oscam.conf – Streamboard Wiki

wiki.streamboard.tv

 

[WilburSmith]

OMG I got lost now. I tried finding terms like group, hash, F on the page you noted with an association to '2' and found nothing.

I got lost and don't know exactly what you mean.

 

[EnoSat]

e.g.

 

[cayoenrique]

@WilburSmith

I seen EnoSat giving you a good hand with the correct answers. Now those answers are more for a satellite enthusiast that that have an enigma2 box and some what experience.

Looking at you, I see you been here for less than a year. And looking at your 1rs post it some what suggest you are still a newbie.
Here is my simplest of answers if you are in fact a newbie. Your 1rst post is perfect. Now if you are really looking to quickly get answers, then you need to be more simplistic.

My 1rst post would had been:
" I am a newbie I need help?" I have o experience" <== 1rst tell us about you.
"My receiver is ABC001 Enigma box" <== What is what you use for watching, or any tool you have

Then instead of 3 question I post 1rst only the 1rst one.
"Recording the Broadcast: What program do you use to make such a recording?"

See, now I could had responded.

Since you have an Enigma Box, you can always use "dvbsnoop".
You can read more at:
_https://dvbsnoop.sourceforge.net/manpage/dvbsnoop.man.shtml

Simple sample of use
Record 1000 packets of a full transponder. Not always possible in most boxes
dvbsnoop -b -n 1000 -s ts -tsraw > ts_Full_transponder.bin

Now I have written many tutorials. If you are a windows type of guy, I published a bunch of windows version of the Linux tools I used. see
GPGPU using Opencl

Yes most file will be gone, as today's file hosters will delete them in a few months. You can always ask me to re-post any if you are interested or any one else.

enrique

 

[EnoSat]

Enigma2 box's not support tsraw

root@osmio4kplus:~# dvbsnoop -b -n 1000 -s ts -tsraw > ts_Full_transponder.bin
Error(22): DMX_SET_PES_FILTER failed: : Invalid argument
root@osmio4kplus:~#

It is possible to save only one PID - Video stream /BISS/ or EMM stream /PowerVu/

root@osmio4kplus:~# dvbsnoop -n 20 -s ts -b 0x00 > ts-stream_pid0x00.ts
root@osmio4kplus:~#

Or use dvbsnoop+dvbstream to create fullTS (but dvbstream does not accept PID-0)

root@osmio4kplus:~# dvbsnoop -s pidscan
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
PID found:    0 (0x0000)  [SECTION: Program Association Table (PAT)]
PID found:    1 (0x0001)  [SECTION: Conditional Access Table (CAT)]
PID found:    2 (0x0002)  [SECTION: Transport Stream Description Table (TSDT)]
PID found:   16 (0x0010)  [SECTION: Network Information Table (NIT) - actual network]
PID found:   17 (0x0011)  [SECTION: Service Description Table (SDT) - actual transport stream]
PID found:   18 (0x0012)  [SECTION: Event Information Table (EIT) - actual transport stream, present/following]
PID found:   20 (0x0014)  [SECTION: Time Date Table (TDT)]
PID found:  100 (0x0064)  [SECTION: Program Map Table (PMT)]
PID found:  101 (0x0065)  [PS/PES: ISO/IEC 13818-3 or ISO/IEC 11172-3 audio stream]
PID found:  200 (0x00c8)  [SECTION: Program Map Table (PMT)]
PID found:  201 (0x00c9)  [PS/PES: ISO/IEC 13818-3 or ISO/IEC 11172-3 audio stream]
root@osmio4kplus:~#

root@osmio4kplus:~# dvbstream `dvbsnoop -s pidscan| awk '/PID found/ { print $3 }' | xargs` -o>test.ts
dvbstream v0.5 - (C) Dave Chapman 2001-2004
Released under the GPL.
Latest version available from http://www.linuxstb.org/
Setting filter for PID 1
Setting filter for PID 2
Setting filter for PID 16
Setting filter for PID 17
Setting filter for PID 18
Setting filter for PID 20
Setting filter for PID 100
Setting filter for PID 101
Setting filter for PID 200
Setting filter for PID 201
Output to stdout
Streaming 10 streams

The complete TS /fullTS/ should look like this

 

[cayoenrique]

@EnoSat

Waoo. That is what I call a really good answer. It is complete.
Now assuming he is really a complete newbie, he most not know about the program you use that produce those nice pictures. Yes the program is Transedit and is part of DVBViewer. A most have program to visualize transponders if you are using windows. Well I use it under Linux with wine.

@WilburSmith
See my point. 1 simple question has made EnoSat to produce a very clean answer. Now maybe your next question will be, where you get dvbsnoop, dvbstream & Transedit? If you understood. Then you post your nest simple question.

@EnoSat
I do not have an enigma2 box yet. So I will ask for my self knowledge next:

I do not see where you tune to transponder? or where you pass that info to any of the programs.
I then ask you, Please tell me if I am correct, You set the E2 box to a channel 1rst in that transponder. ( I guess this is the tuning) then you perform your

dvbstream `dvbsnoop -s pidscan| awk '/PID found/ { print $3 }' | xargs` -o>test.ts

 

[EnoSat]

TransEdit in this thread is only for visualizing the results obtained in the e2 box (otherwise not needed).
For dvbsnoop/dvbstream, it is enough for the box to LOCK the transponder signal (e.g. satfinder plugin in box), no tuning is necessary (some channel from channel list).

 

[cayoenrique]

I know the original poster has not show up.
But I want to used the space to thank you for your nice job at SU. You are always around and ready to help others. Thank you.

 

[yogofogo11]

Hi EnoSat,
I'm trying dvbsnoop pidscan cmd on my HW, but it doesn't work like it does on your HW
It was tuned to an FTA (SES UHD) channel.
Image: openpli 8.3 py2.7

This is the output on terminal:
root@vuduo4kse:~# dvbsnoop -s pidscan
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~#

May I ask why it doesn't work on this HW?

 

[WilburSmith]

EnoSat, Nice post. Let me have time to review.

 

[EnoSat]

yogofogo11, try running dvbsnoop also with the device defined according to the manual on the dvbsnoop page

 

[yogofogo11]

Hi,
Which device do you mean (dbox2 or Dreambox)?
I don't have such kind of hw.

I thought Enigma2 box is enough to run dvbsnoop successfully.

Spoiler: dvbsnoop Usage

Dvbsnoop provides an online and offline input and different snoop/decoding modes (see below).

Using dvbsnoop 'online' requires dvb-api compliant devices to grab live
stream information from e.g. satellite or cable tv or data streams. You will also need DVB compliant
hardware (e.g. DVB-S pci card or a linux based setop box like dbox2 or Dreambox) to receive DVB data
streams. To tune into a transponder or frequency, please use a program like 'szap', 'dvbtune' or a
DVB-GUI like 'Enigma', 'Neutrino', 'MythTV', 'VDR', etc..

The 'offline' mode enables you to analyze binary stream files (e.g. transport stream files or PES
files).

But actually only some cmd's are working on my hw.
f.e.
Do PID scan of a tuned transponder (different display levels):

root@vuduo4kse:~# dvbsnoop -s pidscan -pd 1
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop 
root@vuduo4kse:~# dvbsnoop -s pidscan -pd 6
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop 

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~# dvbsnoop -s pidscan -pd 9
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop 
   DEMUX : /dev/dvb/adapter0/demux0
   DVR   : /dev/dvb/adapter0/dvr0
   FRONTEND: /dev/dvb/adapter0/frontend0

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
scanning pid   0x0000 to 0x00fe  (got 255 dmx filters) 
scanning pid   0x00ff to 0x01fd  (got 255 dmx filters) 
scanning pid   0x01fe to 0x02fc  (got 255 dmx filters) 
scanning pid   0x02fd to 0x03fb  (got 255 dmx filters) 
scanning pid   0x03fc to 0x04fa  (got 255 dmx filters) 
scanning pid   0x04fb to 0x05f9  (got 255 dmx filters) 
scanning pid   0x05fa to 0x06f8  (got 255 dmx filters) 
scanning pid   0x06f9 to 0x07f7  (got 255 dmx filters) 
scanning pid   0x07f8 to 0x08f6  (got 255 dmx filters) 
scanning pid   0x08f7 to 0x09f5  (got 255 dmx filters) 
scanning pid   0x09f6 to 0x0af4  (got 255 dmx filters) 
scanning pid   0x0af5 to 0x0bf3  (got 255 dmx filters) 
scanning pid   0x0bf4 to 0x0cf2  (got 255 dmx filters) 
scanning pid   0x0cf3 to 0x0df1  (got 255 dmx filters) 
scanning pid   0x0df2 to 0x0ef0  (got 255 dmx filters) 
scanning pid   0x0ef1 to 0x0fef  (got 255 dmx filters) 
scanning pid   0x0ff0 to 0x10ee  (got 255 dmx filters) 
scanning pid   0x10ef to 0x11ed  (got 255 dmx filters) 
scanning pid   0x11ee to 0x12ec  (got 255 dmx filters) 
scanning pid   0x12ed to 0x13eb  (got 255 dmx filters) 
scanning pid   0x13ec to 0x14ea  (got 255 dmx filters) 
scanning pid   0x14eb to 0x15e9  (got 255 dmx filters) 
scanning pid   0x15ea to 0x16e8  (got 255 dmx filters) 
scanning pid   0x16e9 to 0x17e7  (got 255 dmx filters) 
scanning pid   0x17e8 to 0x18e6  (got 255 dmx filters) 
scanning pid   0x18e7 to 0x19e5  (got 255 dmx filters) 
scanning pid   0x19e6 to 0x1ae4  (got 255 dmx filters) 
scanning pid   0x1ae5 to 0x1be3  (got 255 dmx filters) 
scanning pid   0x1be4 to 0x1ce2  (got 255 dmx filters) 
scanning pid   0x1ce3 to 0x1de1  (got 255 dmx filters) 
scanning pid   0x1de2 to 0x1ee0  (got 255 dmx filters) 
scanning pid   0x1ee1 to 0x1fdf  (got 255 dmx filters) 
scanning pid   0x1fe0 to 0x1fff  (got 32 dmx filters) 
root@vuduo4kse:~#

Could it be related to the FBC tuners DVB-S NIM(45308X FBC) (DVB-S2X) or their drivers?
Thanks,

 

[EnoSat]

Hi,
Which device do you mean (dbox2 or Dreambox)?
I don't have such kind of hw.

DEMUX : /dev/dvb/adapter0/demux0
DVR : /dev/dvb/adapter0/dvr0
FRONTEND: /dev/dvb/adapter0/frontend0

which demux (device) is your device using?

root@osmio4kplus:/dev/dvb/adapter0# ls

 

[yogofogo11]

Was this helpful?

root@vuduo4kse:/dev/dvb/adapter0# ls
audio0      ca15        ca7         demux16     demux8      dvr17       dvr9        frontend4   net13       net5
audio1      ca16        ca8         demux17     demux9      dvr18       frontend0   frontend5   net14       net6
audio2      ca17        ca9         demux18     dvr0        dvr19       frontend1   frontend6   net15       net7
audio3      ca18        demux0      demux19     dvr1        dvr2        frontend10  frontend7   net16       net8
ca0         ca19        demux1      demux2      dvr10       dvr20       frontend11  frontend8   net17       net9
ca1         ca2         demux10     demux20     dvr11       dvr3        frontend12  frontend9   net18       video0
ca10        ca20        demux11     demux3      dvr12       dvr4        frontend13  net0        net19       video1
ca11        ca3         demux12     demux4      dvr13       dvr5        frontend14  net1        net2        video2
ca12        ca4         demux13     demux5      dvr14       dvr6        frontend15  net10       net20       video3
ca13        ca5         demux14     demux6      dvr15       dvr7        frontend2   net11       net3
ca14        ca6         demux15     demux7      dvr16       dvr8        frontend3   net12       net4
root@vuduo4kse:/dev/dvb/adapter0#

 

[cayoenrique]

@yogofogo11

Wao what a list! One adapter 0, show 20 items per device....
I am only costume to see :
DEMUX : /dev/dvb/adapter0/demux0
DVR : /dev/dvb/adapter0/dvr0
FRONTEND: /dev/dvb/adapter0/frontend0

What is model of that Enigma2?

I will open my mouth without having the experience. I bet you since your adapter is so crowded you will have to specify devices. Like adding the following to each command

-demux /dev/dvb/adapter0/demux0 -dvr /dev/dvb/adapter0/dvr0 -frontend /dev/dvb/adapter0/frontend0

 

[yogofogo11]

Hi,
@cayoenrique
I would upload the about screen, but I can't upload local images, so I'm testing remotely.

I've tried specifying the device with cmd, but it doesn't show any results. Which device should I choose?
Is there a way to identify the right device?

root@vuduo4kse:~# dvbsnoop -s pidscan -demux /dev/dvb/adapter0/demux0 -dvr /dev/dvb/adapter0/dvr0 -frontend /dev/dvb/adapter0/frontend0
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~# dvbsnoop -s pidscan -demux /dev/dvb/adapter0/demux1 -dvr /dev/dvb/adapter0/dvr1 -frontend /dev/dvb/adapter0/frontend1
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~# dvbsnoop -s pidscan -demux /dev/dvb/adapter0/demux1 -dvr /dev/dvb/adapter0/dvr1 -frontend /dev/dvb/adapter0/frontend0
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~# dvbsnoop -s pidscan -demux /dev/dvb/adapter0/demux20 -dvr /dev/dvb/adapter0/dvr1 -frontend /dev/dvb/adapter0/frontend0
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~# dvbsnoop -s pidscan -demux /dev/dvb/adapter0/demux10 -dvr /dev/dvb/adapter0/dvr0 -frontend /dev/dvb/adapter0/frontend0
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~# dvbsnoop -s pidscan -demux /dev/dvb/adapter0/demux3 -dvr /dev/dvb/adapter0/dvr3 -frontend /dev/dvb/adapter0/frontend3
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
root@vuduo4kse:~#

This cmd's bellow selects the device automatically.

root@vuduo4kse:~# dvbsnoop -s pidscan -pd 9
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop
   DEMUX : /dev/dvb/adapter0/demux0
   DVR   : /dev/dvb/adapter0/dvr0
   FRONTEND: /dev/dvb/adapter0/frontend0

---------------------------------------------------------
Transponder PID-Scan...
---------------------------------------------------------
scanning pid   0x0000 to 0x00e4  (got 229 dmx filters)
scanning pid   0x00e5 to 0x01c9  (got 229 dmx filters)
scanning pid   0x01ca to 0x02ae  (got 229 dmx filters)
scanning pid   0x02af to 0x0393  (got 229 dmx filters)
scanning pid   0x0394 to 0x0478  (got 229 dmx filters)
scanning pid   0x0479 to 0x055d  (got 229 dmx filters)
scanning pid   0x055e to 0x0642  (got 229 dmx filters)
scanning pid   0x0643 to 0x0727  (got 229 dmx filters)
scanning pid   0x0728 to 0x080c  (got 229 dmx filters)
scanning pid   0x080d to 0x08f1  (got 229 dmx filters)
scanning pid   0x08f2 to 0x09d6  (got 229 dmx filters)
scanning pid   0x09d7 to 0x0abb  (got 229 dmx filters)
scanning pid   0x0abc to 0x0ba0  (got 229 dmx filters)
scanning pid   0x0ba1 to 0x0c85  (got 229 dmx filters)
scanning pid   0x0c86 to 0x0d6a  (got 229 dmx filters)
scanning pid   0x0d6b to 0x0e4f  (got 229 dmx filters)
scanning pid   0x0e50 to 0x0f34  (got 229 dmx filters)
scanning pid   0x0f35 to 0x1019  (got 229 dmx filters)
scanning pid   0x101a to 0x10fe  (got 229 dmx filters)
scanning pid   0x10ff to 0x11e3  (got 229 dmx filters)
scanning pid   0x11e4 to 0x12c8  (got 229 dmx filters)
scanning pid   0x12c9 to 0x13ad  (got 229 dmx filters)
scanning pid   0x13ae to 0x1492  (got 229 dmx filters)
scanning pid   0x1493 to 0x1577  (got 229 dmx filters)
scanning pid   0x1578 to 0x165c  (got 229 dmx filters)
scanning pid   0x165d to 0x1741  (got 229 dmx filters)
scanning pid   0x1742 to 0x1826  (got 229 dmx filters)
scanning pid   0x1827 to 0x190b  (got 229 dmx filters)
scanning pid   0x190c to 0x19f0  (got 229 dmx filters)
scanning pid   0x19f1 to 0x1ad5  (got 229 dmx filters)
scanning pid   0x1ad6 to 0x1bba  (got 229 dmx filters)
scanning pid   0x1bbb to 0x1c9f  (got 229 dmx filters)
scanning pid   0x1ca0 to 0x1d84  (got 229 dmx filters)
scanning pid   0x1d85 to 0x1e69  (got 229 dmx filters)
scanning pid   0x1e6a to 0x1f4e  (got 229 dmx filters)
scanning pid   0x1f4f to 0x1fff  (got 177 dmx filters)
root@vuduo4kse:~#

root@vuduo4kse:~# dvbsnoop -s feinfo
dvbsnoop V1.4.56 -- https://github.com/OpenVisionE2/dvbsnoop

---------------------------------------------------------
FrontEnd Info...
---------------------------------------------------------

Device: /dev/dvb/adapter0/frontend0

Basic capabilities:
    Name: "Vuplus FE"
    Frontend-type:       QPSK (DVB-S)
    Frequency (min):     950.000 MHz
    Frequency (max):     2150.000 MHz
    Frequency stepsiz:   1.011 MHz
    Frequency tolerance: 29.500 MHz
    Symbol rate (min):     1.000000 MSym/s
    Symbol rate (max):     45.000000 MSym/s
    Symbol rate tolerance: 0 ppm
    Notifier delay: 0 ms
    Frontend capabilities:
        auto inversion
        FEC 1/2
        FEC 2/3
        FEC 3/4
        FEC 5/6
        FEC 7/8
        FEC AUTO
        QPSK
        FE_CAN_RECOVER

Current parameters:
    Frequency:  1243.792 MHz
    Inversion:  OFF
    Symbol rate:  22.000000 MSym/s
    FEC:  FEC 5/6

root@vuduo4kse:~#

But the frequency in the dvbsnoop output and in the picture is a bit different on the same transponder, why?
Edit: it seems to be a converter issue.

Thanks,

 

[cayoenrique]

I am no expert, In fact I have 0% experience with E2.

In general, manufactures tent to exaggerate when advertising their product. And they may simulate or fabricate none functional features. What I did said is my own impression, and have nothing to do with a particular vendor.

Now Interesting picture you show. you seems to own a RCVr with 2 Real Physical Tuners. But manufacturer seems ti imply that each physical tuner act as it has many Virtual tuners!!
Tuner #1 , suggest it has A->H, about 8 virtual
Tuner #2 , suggest it has I->P, about 8 virtual
I have no clear answer for why? I can only susgest that you could have a 16 PIP!!! HEHEHE.
Now on reality this is all fake, as 1 Physical tuner could in fact produce the output of ALL the channels in one transponder . Pids are tranmsited serially and mix. Again this is me doing BLA,BLA,BLA.

Now I can ONLY GUESS that what you have is :

Adapter0
DEMUX : /dev/dvb/adapter0/demux0
DVR : /dev/dvb/adapter0/dvr0
FRONTEND: /dev/dvb/adapter0/frontend0

and if you have the other tuner with a cable and signal you could have
Adapter1
DEMUX : /dev/dvb/adapter1/demux0
DVR : /dev/dvb/adapter1/dvr0
FRONTEND: /dev/dvb/adapter1/frontend0

This is all speculation, you need to read on the suggest for your receiver capacity.