--- a/override.c        Tue Aug 09 21:25:55 2011 +0200
+++ b/override.c        Thu Aug 25 23:51:07 2011 +0200
@@ -129,17 +129,18 @@ bool cValidityRange::ParseFreqRange(cons
 bool cValidityRange::ParseSourceRange(const char *str)
 {
   bool res=false;
   int l;
   char *s1=0, *s2=0;
   if((l=sscanf(str,"%a[^-:]-%a[^-:]",&s1,&s2))>=1) {
     if(s1 && (fromSource=cSource::FromString(s1))>0 &&
        (l<2 || (s2 && (toSource=cSource::FromString(s2))>0))) {
-      if(cSource::IsSat(fromSource) && (toSource<0 || (cSource::IsSat(toSource) && toSource>fromSource))) {
+      if((cSource::IsSat(fromSource) && (toSource<0 || (cSource::IsSat(toSource) && toSource>fromSource))) ||
+         ((cSource::IsCable(fromSource) || cSource::IsTerr(fromSource)) && toSource<0)) {
         res=true;
         }
       else PRINTF(L_CORE_LOAD,"override: SOURCE range error");
       }
     else PRINTF(L_CORE_LOAD,"override: SOURCE parse error");
     }
   else PRINTF(L_CORE_LOAD,"override: SOURCE format error");
   free(s1); free(s2);
@@ -360,21 +361,21 @@ public:
 cRewriterNagraBeta::cRewriterNagraBeta(void)
 :cRewriter(RWNAME_NAGRA_BETA,RWID_NAGRA_BETA)
 {}
 bool cRewriterNagraBeta::Rewrite(unsigned char *&data, int &len)
 {
   unsigned char *d=Alloc(len+10);
   if(d) {
-    static const unsigned char tunnel[] = { 0xc9,0x00,0x00,0x00,0x01,0x10,0x10,0x00,0x48,0x12,0x07 };
+    static const unsigned char tunnel[] = { 0xc9,0x00,0x00,0x00,0x01,0x10,0x10,0x00,0x48,0x12 };
     d[0]=data[0];
-    SetSctLen(d,len+10);
+    SetSctLen(d,len+7);
     memcpy(&d[3],tunnel,sizeof(tunnel));
-    memcpy(&d[14],&data[4],len-4);
+    memcpy(&d[13],&data[3],len-3);
     if(len>0x88) { // assume N3
       d[3]=0xc7; d[11]=0x87;
       }
     if(d[0]&0x01) d[12]++;
     data=d; len+=10;
     return true;
     }
--- a/systems/cardclient/camd.c Tue Aug 09 21:25:55 2011 +0200
+++ b/systems/cardclient/camd.c Thu Aug 25 23:53:10 2011 +0200
@@ -689,20 +689,17 @@ bool cCardClientCamd35::ProcessECM(const
       if(cb->udp_header.cmd==0x01 || cb->udp_header.cmd==0x44)
         PRINTF(L_CC_CAMD35,"unexpected CW answer on flush");
       else
         HandleEMMRequest(cb);
       }
     cb->udp_header.cmd=0x00;
     cb->service.srvID=bswap_16(ecm->prgId);
     cb->service.casID=bswap_16(ecm->caId);
-    switch(ecm->caId>>8) {
-      case 0x18: n=(data[5]*256)+data[6]; break;
-      default: n=ecm->provId; break;
-      }
+    n=ecm->provId;
     cb->service.prvID=bswap_32(n);
     cb->service.pinID=pid;
     memcpy(&cb->data[0],data,length);
     if(SendBlock(cb,length)) {
       exclusive=true;
       time.Set(CCTIMEOUT);
       do {
         sleepCond.TimedWait(*this,50);