spielen wir

>48 58 00 00 35
<58 card replies command for ICAM
<00 fuse byte (see below)
<01 09 60 always the same
<00 SN SN SN card SN (unique address)
<ff ff ff ff unknown
<00 SN SN three bytes of card number (shared address)
<00 ff ff ff 00 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 unknown
<00 xx xx xx was written with the 4e nano on activation
<47 42 52 "GBR" on British cards only
<00 01 00 00 unknown
<03 RC specific region code for local programming. See later under INS1C
<00 00 00 00 unknown
<90 00 sw1/sw2

The fuse byte indicates whether the card is a virgin or married or active or deactivated. The fuse byte is set during the intitial activation possibly with the 3d nano.
00 - Virgin
05 - Married/FTV only?
20 - Virgin/??
24 - Married/Deactivated?
25 - Married/Activated

3. The IRD then askes to send 09 bytes with 48 4C 00 00 09

>48 4C 00 00 09
<4C card replies command for ICAM
>IN IN IN IN IRD Serial Number
>02 00 00 D8 02 unknown
<90 20 correctly married

If the card belongs to this box it replies 90 20 (OK).
If the card does not belong to this box it replies 90 00 (Not OK).
If the card has the fuse byte set but is previously unmarried, this command writes the IRD number to the card, thereby completing the marriage (sw1/2 = 90 a1). If the card is deactivated and this command arrives the IRD Serial Number is written to the cards EEPROM too (sw1/2 = 90 20).
If the IRD number is set to 00 00 00 00 it will be accepted by any box. eg an engineer's card.
The card must receive the correct IRD number before it will give valid responses to ECMs and EMMs.

4. The card is then asked for 09 bytes with 48 2C 00 00 09.

>48 2C 00 00 09
<2C card replies command for ICAM
<00 00 convert to HEX and add then 8000h - this is your PIN
<XX XX 00 00 on active card: FF FF 00 00, on deactivated card: 00 00 00 00
<00 Parental Control Byte (PCB) - see below
<00 00 unknown
<90 20 sw1/sw2

lui $a1, 0x48
.text:00438170 move $a0, $zero
.text:00438174 la $a1, aCaControl02x02 # "CA control %02X %02X CWE %c\n"
.text:00438178 jal sub_41DB88
.text:0043817C sw $v0, 0x478+var_468($sp)
.text:00438180 lui $a1, 0x48
.text:00438184 li $a3, 0x14
.text:00438188 move $a0, $zero
.text:0043818C la $a1, aCweSetup # "CWE setup "
.text:00438190 jal sub_41DC1C
.text:00438194 addiu $a2, $s1, 0x11B
.text:00438198 lhu $a2, 0x114($s1)
.text:0043819C lui $a1, 0x48
.text:004381A0 move $a0, $zero
.text:004381A4 jal sub_41DB88
.text:004381A8 la $a1, aPinCode04u # "Pin code %04u\n"
.text:004381AC lhu $a2, 0x10A($s1)
.text:004381B0 move $a0, $zero
.text:004381B4 jal sub_41DB88
.text:004381B8 addiu $a1, $s5, -0x527C
.text:004381BC move $a0, $s3
.text:004381C0 jal sub_4063FC
.text:004381C4 li $a1, 4
.text:004381C8 lbu $v1, 0x1AD($s0)
.text:004381CC lbu $a3, 0x1AC($s0)
.text:004381D0 sw $v1, 0x478+var_468($sp)
.text:004381D4 lbu $v1, 0x1AE($s0)
.text:004381D8 move $a2, $v0
.text:004381DC sw $v1, 0x478+var_464($sp)
.text:004381E0 lbu $v1, 0x1AF($s0)
.text:004381E4 move $a0, $zero
.text:004381E8 addiu $a1, $s4, -0x3E44
.text:004381EC jal sub_41DB88
.text:004381F0 sw $v1, 0x478+var_460($sp)
.text:004381F4 lb $v1, 0x109($s0)
.text:004381F8 li $v0, 1
.text:004381FC bne $v1, $v0, loc_438230
.text:00438200 lui $a1, 0x48
.text:00438204 move $a0, $zero
.text:00438208 la $a1, aSubscriptionId # "Subscription ID "
.text:0043820C addiu $a2, $s1, 0x14C
.text:00438210 jal sub_41DC1C
.text:00438214 li $a3, 4
.text:00438218 lui $a1, 0x48
.text:0043821C move $a0, $zero
.text:00438220 la $a1, aSystemtime # "Systemtime "
.text:00438224 addiu $a2, $s1, 0x15C
.text:00438228 jal sub_41DC1C
.text:0043822C li $a3, 4