Neue EMM ´s

[ZampixOne]

2511 00 [77FEDED1BC61E81F} <- ist das vorletzte DCW oder ECW ?

DCW = C6F316F23EA43D75

With 000x 01 02 03 is indicated as Aes_Box_Key. I think something similar on astro if I'm not mistaken from a long time ago with dimeno_magic mod.
Yes I agree with you, the K1 used for CW must be 2x8, when I say 8+8 I mean the same thing.
In short 2 equal octets, otherwise it couldn't be reduced to DES, obvious.

@mileta5

54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 01

These bytes indicate the use of 3DES, otherwise with 0010 AES.

i make log card-stb with saleae logic analyzer ,and see change on last 10 bytes on ins7e
before: 00010202030002020203
now: 00010002030000000000

This is very strange, I was not aware of this. This byte should indicate the algorithm to be used in generic mode, 02 is 3DES, 10 aes, 01 aes_box_key, 00 no algo selected? I don't know.
Then it could also be like V13, everything indicates 3des, but in the end it's a des, without a brute you can't know.

 

[mileta5]

without a brute you can't know.

no key ,after brute finish
ins7423 is same as before card stop working on oscam ,is not changed

 

[ZampixOne]

2511 00 [77FEDED1BC61E81F} <- ist das vorletzte DCW oder ECW ?

Yes, I think there is the previous dw there, which in this case will be 8*00 because I did the test with the good old smartmouse sending only that ecm.

no key ,after brute finish
ins7423 is same as before card stop working on oscam ,is not changed

But on oscam it worked in overcrypt in generic mode no?
So the 7423 was not used.
If the brute force didn't go, it means it's a full 3des. I don't know the previous events of your 091F caid.

 

[Gelöschtes Mitglied 488570]

Yes, I think there is the previous dw there, which in this case will be 8*00 because I did the test with the good old smartmouse sending only that ecm.

Wenn sie ein Timeshift einbauen könnten sie das DCW vom Livebild nehmen und den Stream welchen sie aufgenommen haben damit entschlüsseln ...

 

[ZampixOne]

Yes you are right.
In Italy they never used tag 2511, in the old 0919/093B cards it was 2509 if I'm not mistaken, or something like that. You could activate it by adding the nano 4708+adj after the 7F0A+adj in 0919 and the nano D608+adj after the 7E0A+adj in 093B. On 09CDs it is different.

A long, long time ago they used it on Astro.

Spoiler: Astro_ECM

time= 331A4240
D140408052007E0A83681685E625CDD3000047083311F987735F2D8590398001C20809331A42400002002438030100E6040313C7C00300EDC003003FC003002FC003012EC003022DC0030064C067086561C2F770049D46

90398001
C208 09331A4240000200
24
3803 0100E6
04
0313C7C0
0300EDC0
03003FC0
03002FC0
03012EC0
03022DC0
030064C0
6708
6561C2F770049D46

7E0A= 83681685E625CDD3
SIgna = 6561C2F770049D46
4708 = 3311F987735F2D85
DW = 414EF85EFD03B8D4
2511 = 2B9639F0F17D49A6


time = 331A4245
D140408052007E0A688B121D9AB364A300004708BFB8EFD6988F7BB690398001C20809331A42450002002438030100E6040313C7C00300EDC003003FC003002FC003012EC003022DC0030064C067082EA341F8043981D9

7E0A = 688B121D9AB364A3
SIgna = 2EA341F8043981D9
4708 = BFB8EFD6988F7BB6
DW = 86B3374EEF98C994
2511 = 414EF85EFD03B8D4

 

[mileta5]

But on oscam it worked in overcrypt in generic mode no?

work with unique pairing mode 03

 

[Gelöschtes Mitglied 488570]

@ZampixOne wie schnell ist Ihre Karte mit dem berechnen ? ~ 50ms

 

[ZampixOne]

@Katze Flohli
Unfortunately I can't use new ECMs because I only have expired test cards, sorry.

 

[RuckZuck]

If you only have expired card(s) without tiers, you can‘t test anything

 

[ZampixOne]

Even if the cards have expired, they are not necessarily without tiers.

 

[Gelöschtes Mitglied 488570]

@ 007.4 can you test that?

 

[007.4]

Yes. I somewhat agree with ZampixOne.
In the UK an expired card still opens a few channels even though all the tiers have expired. The channels do not open if the card is removed. ECMs are still processed but the few channels that do open are not paired 5501 80.

 

[Gelöschtes Mitglied 488570]

you can activate the tag 25

 

[007.4]

Do you mean the 25_09 and/or 25_11 in INS54?
If so, is that a question or a statement?

I've never seen the tag 25 payload populated for UK cards. I do not know how to activate it - if it is possible.

 

[ZampixOne]

Spoiler: Expired Card 09CD_0003

Ins70
392800000000000000000000000000000000000000000000000000000000000000006000040260000000 [9000] - P1 = 02
No Tiers

D0 74 23 00 16 54 14 00 02 00 01 xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 02 [9000]

SEND INSD14C_SI
D1 4C 00 00 09 xx xx xx xx 03 00 00 0F 64 [90 20]
SEND INSD07E_SI
D1 7E 10 00 1A 42 73 25 10 xx xx xx xx xx xx xx xx 00 00 00 00 00 01 00 02 03 00 02 02 02 03 [90 21]

Old ECM Spot, no tiers needed
D140408021007D09445B3687A216FFDC159013C002516DE7F72D5AD824AEB080D3F52618F9B6 [9020]

DW = EB7A201362A5E2F3 + 0000
TIERS = 0000
TYPE Tiers = FF
TYPE DW = 01
TAG 2202 = 0000
TAG 0E02 = 8000
TAG 0F06 = 000000000000
TAG 2004 = 60000000
TAG 2511 = 0000000000000000000000000000000000
TAG 2A04 = 00000000
TAG 5501 = 83
TAG 5608 = 0000000000000000
TAG 4503 = 820000

SEND INSD14C_SI
D1 4C 00 00 09 xx xx xx xx 03 00 00 0F 64 [90 20]
SEND INSD17E_MOD_SI
D1 7E 10 00 1A 42 73 25 10 xx xx xx xx xx xx xx xx 00 00 00 00 00 01 00 02 03 00 02 02 02 03 [90 01]

DW = 5C549E83720F10F9 + 0000
TIERS = 0000
TYPE Tiers = FF
TYPE DW = 01
TAG 2202 = 0000
TAG 0E02 = 8000
TAG 0F06 = 000000000000
TAG 2004 = 60000000
TAG 2511 = 0000000000000000000000000000000000
TAG 2A04 = 00000000
TAG 5501 = 81
TAG 5608 = 0000000000000000
TAG 4503 = 820000

SEND INSD14C_NO
SEND INSD17E_NO

DW = 6E609B695126BE35 + 0000
TIERS = 0000
TYPE Tiers = FF
TYPE DW = 01
TAG 2202 = 0000
TAG 0E02 = 8000
TAG 0F06 = 000000000000
TAG 2004 = 60000000
TAG 2511 = 0000000000000000000000000000000000
TAG 2A04 = 00000000
TAG 5501 = A0
TAG 5608 = 0000000000000000
TAG 4503 = 820000

Active tag_2511
D140408029007D11545B3687A216FFDC155B3687A216FFDC159013C002516DE7F72D5AD824AEB080D3F52618F9B6 [9100]

SEND INSD14C_SI
SEND INSD17E_SI

DW = EB7A201362A5E2F3 + 0000
TIERS = 0000
TYPE Tiers = FF
TYPE DW = 01
TAG 2202 = 0000
TAG 0E02 = 8000
TAG 0F06 = 000000000000
TAG 2004 = 60000000
TAG 2511 = 01EB7A201362A5E2F3 0000000000000000
TAG 2A04 = 00000000
TAG 5501 = 83
TAG 5608 = 0000000000000000
TAG 4503 = 820000 - Rating: 82

SEND INSD14C_SI
SEND INSD17E_MOD_SI

DW = 5C549E83720F10F9 + 0000
TIERS = 0000
TYPE Tiers = FF
TYPE DW = 01
TAG 2202 = 0000
TAG 0E02 = 8000
TAG 0F06 = 000000000000
TAG 2004 = 60000000
TAG 2511 = 015C549E83720F10F90000000000000000
TAG 2A04 = 00000000
TAG 5501 = 81
TAG 5608 = 0000000000000000
TAG 4503 = 820000

SEND INSD14C_NO
SEND INSD17E_NO

DW = 6E609B695126BE35 + 0000
TIERS = 0000
TYPE Tiers = FF
TYPE DW = 01
TAG 2202 = 0000
TAG 0E02 = 8000
TAG 0F06 = 000000000000
TAG 2004 = 60000000
TAG 2511 = 016E609B695126BE350000000000000000
TAG 2A04 = 00000000
TAG 5501 = A0
TAG 5608 = 0000000000000000
TAG 4503 = 820000 - Rating: 82

This type of ECM allows overcrypt unique or generic to be activated and at the same time generate the DCW.