Why don't we program a tool that helps us understand Irdeto or Viaccess systemBecause other cas decrpt tools not available
example_biss.ts
example_irdeto.ts
example_powervu.ts
example_tandberg_ED.ts
example_tandberg_EE.ts
SoftCam.Key
https://workupload.com/file/eWcsyR6CdVR
https://workupload.com/file/skQmxGfTLLv
Korisnik@AZDAHA ~/oetsdec_011
$ make
CC cscrypt/aes.c
CC cscrypt/des.c
CC ffdecsa/ffdecsa.c
subs_from_oscam.c: In function ‘i2b_buf’:
subs_from_oscam.c:169:14: warning: this statement may fall through [-Wimplicit-fallthrough=]
169 | b[2] = (i ) & 0xff;
| ~~~~~^~~~~~~~~~~~~~~~
subs_from_oscam.c:170:5: note: here
170 | case 4:
| ^~~~
CC subs_from_oscam.c
module-emulator-streamserver.c: In function ‘DescrambleTsPacketsPowervu’:
module-emulator-streamserver.c:886:50: warning: comparison of integer expressions of different signedness: ‘uint32_t’ {aka ‘unsigned int’} and ‘int32_t’ {aka ‘int’} [-Wsign-compare]
886 | while (j >= cluster_size)
| ^~
module-emulator-streamserver.c: In function ‘ParseEcmData’:
module-emulator-streamserver.c:578:7: warning: array subscript ‘struct s_reader[0]’ is partly outside array bounds of ‘unsigned char[8]’ [-Warray-bounds]
578 | rdr->emu_datecodedenabled = 0;
| ^~
module-emulator-streamserver.c:577:8: note: referencing an object of size 8 allocated by ‘malloc’
577 | rdr=malloc(sizeof(struct s_reader *));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CC module-emulator-streamserver.c
module-emulator-osemu.c: In function ‘emu_process_emm’:
module-emulator-osemu.c:974:41: warning: unused parameter ‘rdr’ [-Wunused-parameter]
974 | int8_t emu_process_emm(struct s_reader *rdr, uint16_t caid, const uint8_t *emm, uint32_t *keysAdded)
| ~~~~~~~~~~~~~~~~~^~~
CC module-emulator-osemu.c
CC module-emulator-powervu.c
CC module-emulator-director.c
module-emulator-irdeto.c: In function ‘calculate_hash’:
module-emulator-irdeto.c:24:45: warning: array subscript 8 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 8 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:45: warning: array subscript 9 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 9 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:45: warning: array subscript 10 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 10 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:45: warning: array subscript 11 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 11 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:45: warning: array subscript 12 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 12 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:45: warning: array subscript 13 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 13 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:45: warning: array subscript 14 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 14 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:45: warning: array subscript 15 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~^~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
module-emulator-irdeto.c:24:41: warning: array subscript 15 is outside array bounds of ‘uint8_t[8]’ {aka ‘unsigned char[8]’} [-Warray-bounds]
24 | data[i] = v1[i] ^ v2[i];
| ~~~~~~~~^~~~~~~~~~~~~~~
module-emulator-irdeto.c:120:17: note: while referencing ‘cbuff’
120 | uint8_t cbuff[8];
| ^~~~~
CC module-emulator-irdeto.c
CC module-emulator-biss.c
CC config.c
oetsdec.c: In function ‘main’:
oetsdec.c:33:7: warning: array subscript ‘struct s_reader[0]’ is partly outside array bounds of ‘unsigned char[8]’ [-Warray-bounds]
33 | rdr->emu_datecodedenabled = 0;
| ^~
oetsdec.c:32:8: note: referencing an object of size 8 allocated by ‘malloc’
32 | rdr=malloc(sizeof(struct s_reader *));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from oetsdec.c:1:
subs_from_oscam.h:247:81: warning: ‘%s’ directive argument is null [-Wformat-overflow=]
247 | #define cs_log(fmt, params...) cs_log_txt_to_file("log.txt", fmt, ##params)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
oetsdec.c:61:12: note: in expansion of macro ‘cs_log’
61 | cs_log("\nUps! Error: Fail to allocate memory for %s size=%d",stream_buf,EMU_DVB_BUFFER_SIZE); //++Enrique
| ^~~~~~
oetsdec.c:61:62: note: format string is defined here
61 | cs_log("\nUps! Error: Fail to allocate memory for %s size=%d",stream_buf,EMU_DVB_BUFFER_SIZE); //++Enrique
| ^~
CC oetsdec.c
touch SoftCam.Key
strip oetsdec
SU had issues with the host. Admins managed to restore the board and its messages, but lost the attached files altogether.The I see you asking for all the stuff I posted in the past that are gone!
Long time ago I posted at least 2 tools for you guys to decrypt most of know algorithms (T2MI_decap & oetsdec ).
#> cat log.txt
enrique@live:$ cat log.txt
[Emu] sofcamkey: ./SoftCam.Key
Ups! Error: Can not open example_powervu.ts!!
enrique@live:$
sudo apt-get update
sudo apt-get -y install openssl
Code:sudo apt-get update sudo apt-get -y install openssl
sudo apt-get install libssl-dev
Remember my program is a wraper for OSCAM files. Yes Oscam can in fact decrypt by CAS emulation for many of today CAS.finally oetsdec break down almost all encryption system Biss, Irdeto,PowerVU ...
Well you need the KEYs. Most of them are not public.What is missing now?
Usually satellite transponders contain many channels ( normally called program ). And each channel contains a few pids( Video + various Audio + text + other ) When we log a transponder we either log the FULL Transponder or we record a program. In either case the "Program-specific information" ( PAT, CAT, PNT and NIT ) may contain information from all the original channels. For the most part you can not watch all the channels at same time nor decrypt them. This is why you need to provide the channel number. So ONLY one channel is decrypted.why you put the Number 10 after example_powervu.ts 10 and 16 after itdeto ...what does it mean these Numbers
sudo apt install ffmpeg
ffprobe -i "example_powervu.ts" -show_streams
enrique@live:$ ffprobe -i "example_powervu.ts" -show_streams 2>&1 | grep -i -e "Program 10 " -A 7
Program 10
Metadata:
service_name : Space
service_provider:
Stream #0:0[0x3f2]: Video: mpeg2video ([2][0][0][0] / 0x0002), none(tv), 90k tbr, 90k tbn, 90k tbc
Stream #0:1[0x3e8]: Audio: mp3 ([4][0][0][0] / 0x0004), 0 channels, fltp
Stream #0:2[0x3ea]: Audio: mp3 ([4][0][0][0] / 0x0004), 0 channels, fltp
Program 18
enrique@live:$
Stream #0:0[0x3f2]: Video: mpeg2video ([2][0][0][0] / 0x0002), none(tv), 90k tbr, 90k tbn, 90k tbc
Stream #0:1[0x3e8]: Audio: mp3 ([4][0][0][0] / 0x0004), 0 channels, fltp
Stream #0:2[0x3ea]: Audio: mp3 ([4][0][0][0] / 0x0004), 0 channels, fltp
Lets see what the first 24 lines of the log.txt show. log.txt is generated and found inside "oetsdec_011" folderwhere is the ECM ?
enrique@live:$ head -n24 log.txt
[Emu] sofcamkey: ./SoftCam.Key
[Emu] input ts: ../example_powervu.ts
[Emu] output ts: out.ts
Stream client 0 found pmt pid: 0x1392 (5010)
Stream client 0 found pcr pid: 0x03F2 (1010)
Stream client 0 found ecm pid: 0x177A (6010)
Stream client 0 found video pid: 0x03F2 (1010)
Stream client 0 found audio pid: 0x03E8 (1000)
Stream client 0 found audio pid: 0x03EA (1002)
[Emu] Initial analisys of PAT & PMT data for service id: 00A (010)
[Emu] stream found pmt pid: 0x1392 (5010)
[Emu] stream found pat pid: 0x0000 (0000)
[Emu] stream found ecm pid: 0x177A (6010)
[Emu] stream found video pid: 0x03F2 (1010)
[Emu] stream found Audio pid count: 0x0002
[Emu] stream found Audio pid: 0x03E8 (1000)
[Emu] stream found Audio pid: 0x03EA (1002)
[Emu] stream found caid: 0x0E00 (3584)
[Emu] Trying to Decrypt
csaUsed: 0, xorMode: 0, ecmSrvid: 000A, hashModeCw: 0, modeCW: 0
channel hash: 00000000, group id: 0000
enrique@live:$
sudo apt-get install dvbsnoop bless bsdextrautils coreutils
dvbsnoop -if example_powervu.ts -s ts -b 0x177A > example_powervu_ECM.bin
hexdump -C example_powervu_ECM.bin
od -w=47 -t x1 example_powervu_ECM.bin
bless example_powervu_ECM.bin
Well you need the KEYs. Most of them are not public.
Code:hexdump -C Irdeto_ECM.bin
This is OScam files and methods. Keys are store in SoftCam.Key. Irdeto keys start with IBut the channel is decrypted with a key right? So we have a key
In example_irdeto.ts what is the key?
I 060400 04 07B6289B43AEE146B32DF989B3B73468 ; example_irdeto.ts # ACTIVE
I 060400 06 08B08F42090C588E7253E53AFA5CBAD7 ; example_irdeto.ts # NEXT
I 060400 M1 98B4DCAD44E8C9504C3F4E51692A7047 ; example_irdeto.ts # (ECM Seed)
I 060400 M2 AE652B210BF89FC69507609842FD303E ; example_irdeto.ts # (ECM IV)
All is inside:the work now is on ECM to find the header the provider and the KEY to decrypt it
There are many members who want to learn as well as me, but I don't know why they don't participateIf you think you still want to learn then respond me those question. I do not have a lot of time as I used to do. But willing to create a new thread on Programming on GPU to do BruteForce.
Do you have Cuda or AMD GPU?
enrique@live:$ lspci -k | grep -A3 -i -e'VGA\|Graphics'
00:02.0 VGA compatible controller: Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller (rev 09)
Subsystem: Hewlett-Packard Company Device 165a
Kernel driver in use: i915
Kernel modules: i915
--
01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Whistler [Radeon HD 6730M/6770M/7690M XT]
Subsystem: Hewlett-Packard Company Radeon HD 6770M
Kernel driver in use: fglrx_pci
Kernel modules: radeon, fglrx
enrique@live:$