HondaPower77
Freak
- Registriert
- 14. Januar 2012
- Beiträge
- 226
- Reaktionspunkte
- 20
- Punkte
- 300
AW: V14 Pairing aktiviert?
Könnte mal ein "Zwangstauscher" das mal machen/probieren?
Bei NDS kann man ganz leicht sehen ob die Karte gepaired ist oder nicht.
Zur Info.. (Beispiel SkyUk)
First of all:
The card is always asked by the ICAM to receive or send information. The card never asks the ICAM to do anything! To do this the ICAM always sends a 5 byte long command packet header to the card.
Example: 48 INS P1 P2 P3
The first byte is always 48 (command class) followed by the instruction number. The last 3 bytes are the parameters. P1 and P2 are used differently and are often ignored. P3 is the length of the packet to be send or expected to receive. The cards first reply is the instruction number which is a vital value for the ICAM. These instruction numbers are possibly contained in a jumptable in the ICAMs source leading to a specific offset where processing continues.
The Answer To Reset (ATR):
3F 7F 13 25 03 40 B0 0B 69 4C 4A 50 C0 00 00 53 59 00 00 00
3F TS - "3F" indicates inverse convention ("3B" would be direct convention)
7F T0 - "7" (0111...) indicates TA1,TB1,TC1 will be sent "F" (...1111) indicated that 15 historical bytes will be send.
13 TA1
25 TB1
03 TC1
40 B0 0B 69 4C 4A 50 C0 00 00 53 59 00 00 00 the 15 historical bytes
1. On start up we get 48 52 00 00 14. This asks the card for 14h bytes.
> 48 52 00 00 14
< 52 card replies command for ICAM
< SN SN SN SN card SN (unique address)
< 00 A status byte?
< 01 19 11 00 0C 09 00 01 02 03 04 10 01 00 00 always the same?
< 90 00 sw1/sw2
2. The next cmd is 48 58 00 00 35. This asks the card for 35h bytes.
> 48 58 00 00 35
< 58 card replies command for ICAM
< 00 fuse byte (see below)
< 01 09 60 always the same
< 00 SN SN SN card SN (unique address)
< ff ff ff ff unknown
< 00 SN SN three bytes of card number (shared address)
< 00 ff ff ff 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 unknown
< 00 xx xx xx was written with the 4e nano on activation
< 47 42 52 "GBR" on British cards only
< 00 01 00 00 unknown
< 03 RC specific region code for local programming. See later under INS1C
< 00 00 00 00 unknown
< 90 00 sw1/sw2
The fuse byte indicates whether the card is a virgin or married or active or deactivated. The fuse byte is set during the intitial activation possibly with the 3d nano.
00 - Virgin
05 - Married/FTV only?
20 - Virgin/??
24 - Married/Deactivated?
25 - Married/Activated
3. The IRD then askes to send 09 bytes with 48 4C 00 00 09
> 48 4C 00 00 09
< 4C card replies command for ICAM
> IN IN IN IN IRD Serial Number
> 02 00 00 D8 02 unknown
< 90 20 correctly married
If the card belongs to this box it replies 90 20 (OK).
If the card does not belong to this box it replies 90 00 (Not OK).
If the card has the fuse byte set but is previously unmarried, this command writes the IRD number to the card, thereby completing the marriage (sw1/2 = 90 a1). If the card is deactivated and this command arrives the IRD Serial Number is written to the cards EEPROM too (sw1/2 = 90 20).
If the IRD number is set to 00 00 00 00 it will be accepted by any box. eg an engineer's card.
The card must receive the correct IRD number before it will give valid responses to ECMs and EMMs.
Hier im Forum in der Italienischen Sektion gibt es ein Programm zum auslesen der Karte. Nur ich weis nicht ob es mit den Deutschen NDS Karten klappt. Einfach mal probieren....
Link ist nicht mehr aktiv.
Interessant wäre jetzt zu wissen was die neuen V14 Karten für ein Fusebyte haben (nach Pairing) und was die alten die noch mit Oscam laufen
Könnte mal ein "Zwangstauscher" das mal machen/probieren?