Neue EMM ´s

[mileta5]

The V13 gets fed with the first key

you mean sky de v13 still use 8 bytes k1?

 

[Miese.Ratte]

It doesn't work with the old (T)DES anymore. It needs to use AES after a mandatory update. I don't know how the AES K1 look like.

You need to distinguish between unique and generic "pairing". The keys from the 38C1 are only for generic "pairing". The mandatory update was for the unique pairing. It's needed for almost all Sky channels.

 

[ZampixOne]

It is very likely that the last 2 bytes of the ins 7423 tell the decoder which generic key should be used these 2 bytes on 8130/8131.

eg 7423 for SkyIT
54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 02

eg for SkyIT
80 30_15 00 01 00 02 03 .............
81 31_15 00 02 02 02 03 ............. -> this key is used for generic mode

eg for SkyUK
80 30_15 00 01 00 02 03 .............
81 31_15 00 02 02 02 03 .............

eg for SkyDE
80 30_15 00 01 10 10 05 ............
81 31_15 00 02 10 10 05 ............

The last 2 bytes of ins 7423 in SkyUk are 0002 if I'm not mistaken, and should use 8131 for generic mode. What are the last 2 bytes of the ins 7423 in SkyDE?

 

[007.4]

The last 2 bytes of ins 7423 in SkyUk are 0002 if I'm not mistaken

Not in the logs I've seen, SkyUK (0963 cards) 7423 ends with 0001.

D0 74 23 00 16
54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 01

Some channels are 5501 80 and others are 5501 83 (unique). So I assume it is using 80 30_15 for generic.

CORRECTION -EDIT
Correction to my previous statement.
The 0960 cards 7423 ends with 00 02
It is only the 0963 cards that end with 00 01

 

[ZampixOne]

I remembered differently, wonder why.
In the light of that, I assume too that it uses 8030 buffer, shame I don't have a hsm or cdi dump from an official UK decoder to confirm that.
That would be interesting.

 

[Gelöschtes Mitglied 488570]

It is very likely that the last 2 bytes of the ins 7423 tell the decoder which generic key should be used these 2 bytes on 8130/8131.

eg 7423 for SkyIT
54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 02

eg for SkyIT
80 30_15 00 01 00 02 03 .............
81 31_15 00 02 02 02 03 ............. -> this key is used for generic mode

eg for SkyUK
80 30_15 00 01 00 02 03 .............
81 31_15 00 02 02 02 03 .............

eg for SkyDE
80 30_15 00 01 10 10 05 ............
81 31_15 00 02 10 10 05 ............

The last 2 bytes of ins 7423 in SkyUk are 0002 if I'm not mistaken, and should use 8131 for generic mode. What are the last 2 bytes of the ins 7423 in SkyDE?

Old ... SkyDE - MODE 81 ( DES // TDES )
81 30_15 00 01 02 02 03
81 31_15 00 02 02 02 03

eg for SkyUK
80 30_15 00 01 00 02 03

decrypted Payload ?

 

[007.4]

decrypted Payload ?

For what? INS54 or INS7423 ?

 

[Gelöschtes Mitglied 488570]

2021/07/13 09:41:43 1AE60AA6 r (reader) SkyV14 [videoguard2] Decrypted payload
2021/07/13 09:41:43 1AE60AA6 r (reader) 4E 41 60 06 A1 68 D0 B0 00 00 00 C4 00 01 22 02
2021/07/13 09:41:43 1AE60AA6 r (reader) 00 00 0E 02 03 00 0F 06 00 00 00 00 00 00 20 04
2021/07/13 09:41:43 1AE60AA6 r (reader) 00 00 00 00 25 11 00 00 00 00 00 00 00 00 00 00
2021/07/13 09:41:43 1AE60AA6 r (reader) 00 00 00 00 00 00 00 2A 04 00 C4 00 00 55 01 81
2021/07/13 09:41:43 1AE60AA6 r (reader) 56 08 00 00 00 00 00 00 00 00 2B 02 00 00

Smartcardtype ...

0F 04 = V13
0F 06 = V14 / V15

Byte 1-8 crypted cw - & - 56 08 "00 00 00 00 00 00 00 00" = TDES
Byte 1-8 crypted cw - & - 56 08 Byte 9-16 gefüllt = AES

55 01 81 = generic OC key
55 01 83 = private ( unique ) Key

eg 7423 for SkyIT
54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 02

ich denke 0F 06 <- analog V14 / V15

SkyUK 7423 ends with 0001.

Ich denke 0F 04 <- analog Type V13

 

[007.4]

Two variants of SkyUK cards 0963 (White card older) and 0960 (Red card -newer).
[There is also an even newer 0961 card which I do not have.]

0963 [videoguard2] White Card Decrypted payload
F8 B6 2B D9 8E BB A3 EC 00 00 00 00 FF 03 22_02
C0 05 0E_02 80 00 0F_05 00 00 00 00 00 20_04 00
00 00 00 25_09 00 00 00 00 00 00 00 00 00 2A_04
00 00 00 00 55_01 80
AES not supported
0F_05 ..
25_09 ..

0963 [internal] Decrypted payload
D1 74 23 00 16
54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 01

=============

0960 [videoguard2] Red Card Decrypted payload
D7 95 BA 45 38 DE 2B 52 AA 55 00 00 FF 03 22_02
C0 05 0E_02 80 00 0F_06 00 00 00 00 00 00 20_04
00 00 00 00 25_11 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 2A_04 00 00 00 00 55_01 88
56_08 00 00 00 00 00 00 00 00
AES supported
0F_06 ..
25_11 ..

0960 [internal] Decrypted payload
D1 74 23 00 16
54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 02

==========
Correction to my previous statement.
0960 cards 7423 ends with 00 02
It is only the 0963 cards that end with 00 01

I've also seen 4 different "letter" chip variants. C, K, X and Z.

 

[Gelöschtes Mitglied 488570]

22_02 C0 05 ist etwas über dieses Tag bekannt ?

54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 02

Ich vermute mal das es etwas mit der Keylänge zu tun hat bzw welcher Teil verwendet wird

0001 = 8 Byte
bei 3DES würde das mehrfach den gleichen Key bedeuten und man könnte das auf DES reduzieren

0002 = 16 Byte
Es werden alle 16 Btyes genutzt
K1 ; K2 ; K3=K1 bei TDES
16 Bytes bei AES

 

[ZampixOne]

decrypted Payload ?

in italy we have
8130 00 01 00 02 03
8131 00 02 02 02 03 -> This is what has always been used
These are the payloads of an 09CD with the first serial numbers 0003 and an 09CD with the first serial numbers 0004.
I used respectively ins7E with last 5 bytes:
0002 02 02 03
0002 10 10 05
0002 01 02 03

Spoiler: Test_09CD

D140408090007D09446596F132EA53CB7A9082C804E6105CF0400B3DEB108A7485E2F0584A300A13E843517D314D7FFB0F515A168CB5AB37EE4FE523BE6DC6DA2C
828EB09377F23D9007A04F85379FA8332C7277F0F5B7EA0417F86B16F203B11483561FC99C9053D902E53D7E64316DA82694D15616C708C6287C3BC2357B90E444
74DEA7C28F694F76B505BE85931E4613101829

DCW = C6F316F23EA43D75

14095B64166AD83600000000FF01220200000E0280000F06000000000000200460000000251100000000000000000000000000000000002A04000000
00550181560800000000000000004503810000

1598D3B01209603000000000FF01220200000E0280000F06000000000000200460000000251100000000000000000000000000000000002A04000000
0055018156085D6F5FB9A03201044503810000

F4C52889605A66800000000FF01220200000E0280000F0600000000000020046000000025110077FEDED1BC61E81F00000000000000002A04000000
00550181560800000000000000004503810000


14095B64166AD83600000000FF01220200000E0280000F06000000000000200400000000251100000000000000000000000000000000002A04000000
005501815608000000000000000045038100002B020000

1598D3B01209603000000000FF01220200000E0280000F06000000000000200400000000251100000000000000000000000000000000002A04000000
0055018156085D6F5FB9A032010445038100002B020000

FF4C52889605A66800000000FF01220200000E0280000F0600000000000020040000000025110077FEDED1BC61E81F00000000000000002A04000000
005501815608000000000000000045038100002B020000

They confirmed 100% that buffer 8130 is used in generic mode on V13s with ins 7423 and 0001 final, while buffer 8131 is used on V14/V15 with ins 7423 and 0002 final. In Italy 100% sure that with ins 7423 with 0002 final is used buffer 8131.
The same should be true for UK.
Another thing 100% sure is that the official decoders do not support DES with Ladder, or rather it is expected as an algorithm, but strangely does not work, perhaps is disabled, then the decoder calculates all the process k2/k1/dcw in 3des or Aes depends, specifically in 3des the k1 obviously will never be 8+8 in this way except that it would be used an ek1 8+8 equal, and this is not the case.

So you might be right @Katze Flohli, as long as all cards with ins 7423 ending with 0001 use Des mode.
If the final of ins 7423 ends with 0001 then buffer 8130 is used and the decoder knows that it has to take only 8 bytes of k1 and repeat them 2 times to execute a 3des which in the end is a des.

@007.4 do you know if 0963 that end with 00 01 is des or 3des?

 

[Gelöschtes Mitglied 488570]

With 0002 I didn't mean 2 x the same 8 bytes but that there are 2 x 8 bytes keys ...
front 00020001 could mean that the front is EK2 and the others are EK1

 

[007.4]

@ZampixOne
It is definitely 3DES.

 

[Gelöschtes Mitglied 488570]

if I use 3DES with 3 x the same key, this can be reduced to DES.
so my guess was that I only use 1 part of the ins.

Then the ladder calculates correctly but the assignment of the keys is wrong because you only use a part

2511 00 [77FEDED1BC61E81F} <- ist das vorletzte DCW oder ECW ?

 

[mileta5]

ins 7423 from total tv 091f,after refresh card on original stb
ins 7423 is same as before card stop working on oscam
54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 01

after tag 55 01 03 no zeros

(reader) totaltv [videoguard2] Decrypted payload
5D 5F 11 AF ED B5 E9 8F 00 00 00 D3 00 01 22 02
00 00 0E 02 01 00 0F 04 00 00 00 00 20 04 00 00
00 00 25 09 00 00 00 00 00 00 00 00 00 55 01 03

i make log card-stb with saleae logic analyzer ,and see change on last 10 bytes on ins7e
before 00010202030002020203
now 00010002030000000000

what is this des,3des or aes?