STB model 6E736B20 and ins7E (CAID 09BB)

[dvbuser]

Hello,

Firstly I apologize this post is in English rather than German. This part of the forum is read more often than the English forum, so I decided to post here.

I am trying to find the ins7e for my view card and its paired STB. The CA diagnostics shows the following string:

Spoiler

6E736B20XXXXXXXXXXXXXXXXXXYYYYYYYY 02 11 04 N 132 0

The model ID is very similar to the skyQ model which has the string 6E736B21.

Spoiler

I create the boxID by adding +80 to the first two digits of the YYYYYYYY to give ZZZZZZZZ. The oscam file looked like this

[reader]
label = reader1
protocol = mouse
device = / dev / ttyUSB0
boxid = ZZZZZZZZ
ins7e = 6E736B20XXXXXXXXXXXXXXXXYYYYYYYY00010202030002020203
detect = cd
group = 1
emmcache = 1,3,2,0
blockemm-unknown = 1
blockemm-g = 1
saveemm-u = 1
saveemm-s = 1
dropbadcws = 1

When I run oscam the card is recognized correct which confirms that the BoxID is correct. However, when trying to view a channel I get an error

Spoiler

classD3 ins54: no cw -> Card needs pairing / extra data

This suggests that my ins7E is incorrect. Can anybody suggest what else i can try for ins7E?

The log is as follows:

Spoiler

2020/10/31 22:01:01 00000000 s >> OSCam << cardserver log switched, version 1.20_svn, build r11650 (x86_64-linux-gnu)
2020/10/31 22:01:01 00000000 s (main) System name = Linux
2020/10/31 22:01:01 00000000 s (main) Machine = x86_64
2020/10/31 22:01:01 00000000 s (main) creating pidfile /var/run/oscam.pid with pid 802865
2020/10/31 22:01:01 00000000 s (config) userdb reloaded: 1 accounts loaded, 0 expired, 0 disabled
2020/10/31 22:01:01 00,000,000 s (main) signal handling initialized
2020/10/31 22:01:01 00000000 s (reader) reader1 [mouse] creating thread for device / dev / ttyUSB0
2020/10/31 22:01:01 00000000 s (main) waiting for local card init
2020/10/31 22:01:01 479143B2 h (webif) webif: decompressed 185615 bytes back into 491040 bytes
2020/10/31 22:01:01 479143B2 h (webif) HTTP Server running. ip = 0.0.0.0 port = 8888
2020/10/31 22:01:01 11C5F567 r (reader) reader1 [mouse] Reader initialized (device = / dev / ttyUSB0, detect = cd, mhz = 357, cardmhz = 357)
2020/10/31 22:01:02 11C5F567 r (reader) reader1 [mouse] card detected
2020/10/31 22:01:03 11C5F567 r (reader) reader1 [mouse] ATR: 3F FD 14 25 02 50 80 0F 41 B0 0D 69 FF 4A 50 F0 80 00 42 52 03
2020/10/31 22:01:03 11C5F567 r (reader) reader1 [mouse] Setting baud rate to 76800 bps
2020/10/31 22:01:04 11C5F567 r (reader) reader1 [mouse] Card type: BRTV
2020/10/31 22:01:04 11C5F567 r (reader) reader1 [mouse] Rom version: 20AD
2020/10/31 22:01:04 11C5F567 r (reader) reader1 [mouse] Credit available on card: 0 euro
2020/10/31 22:01:04 11C5F567 r (reader) reader1 [mouse] FuseByte: 05
2020/10/31 22:01:04 11C5F567 r (reader) reader1 [mouse] Country Code: IND
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [mouse] Pincode read: 0000
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [mouse] PCB settings: FF FF FF FF
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [mouse] type: VideoGuard Unknown Card, caid: 09BB
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [mouse] serial: ########, BoxID: ########, baseyear: 1997
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [mouse] ready for requests
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [mouse] found card system videoguard2
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] THIS WAS A SUCCESSFUL START ATTEMPT No 1 out of max allotted of 1
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] card detected
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] type: VideoGuard Unknown Card
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] ------------------------------- -----------------------------------
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] | - class - | - tier - | ----- valid to ------ | --- package name - --- |
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] + --------- + ---------- + --------- ------------ + --------------------- +
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] | - 00 --- | - 0002 - | 2013/12 / 23-00: 00: 00 |
--snip--
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] | - 06 --- | - 06a0 - | 2013/12 / 23-00: 00: 12 |
2020/10/31 22:01:05 11C5F567 r (reader) reader1 [videoguard2] ------------------------------- ----------------------- from-ins70--
2020/10/31 22:01:06 00000000 s (main) init for all local cards done
2020/10/31 22:01:06 00000000 s (emmcache) loaded 0 emmcache records from /tmp/oscam/oscam.emmcache in 0 ms
2020/10/31 22:01:06 00000000 s (emmcache) loaded 0 emmstat records from /tmp/oscam/oscam.emmstat in 0 ms
2020/10/31 22:01:06 1E5ACAF5 c (client) plain dvbapi-client granted (tvh, au = off)
--snip--
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Demuxer 0 request controlword for ecm 09BB @ 000000/0340 / 278E / 8F: 31B0A517F75C545ADFF6FDFCFD8121A0
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Processing socketdata completed after 2 packets with 0 bytes left unprocessed
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Got packetdata (msgid size: 0, clientprotocol: 2)
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) FF FF 00 00 00 02 01 B0 1B FF FF C5 00 00 09 04
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) 09 AA E0 C0 09 04 09 BB E0 C0 09 04 06 F6 E0 BF
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) C3 C3 EE E3
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) This is a DVBAPI_FILTER_DATA packet with size 36 => lets process it!
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Demuxer 0 filter3 [0] = 01, filter mask [0] = FF, flt & mask = 01, buffer [0] = 01, buffer [0] & mask = 01
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Demuxer 0 filter 3 fetched CAT data (length = 0x01E):
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) 01 B0 1B FF FF C5 00 00 09 04 09 AA E0 C0 09 04
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) 09 BB E0 C0 09 04 06 F6 E0 BF C3 C3 EE E3
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Demuxer 0 stop filter 3 try 1 (fd: 65535 api: 0, caid: 0001, provid: 000001, emmpid: 0001)
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Sending packet to dvbapi client (fd = 12):
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) 00 00 6F 2A 00 00 02 00 01
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Added new emmpid 0 CAID: 09AA EMM_PID: 00C0 PROVID: 000000 TYPE: UNIQUE: SHARED: GLOBAL:
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Added new emmpid 1 CAID: 09BB EMM_PID: 00C0 PROVID: 000000 TYPE: UNIQUE: SHARED: GLOBAL:
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Added new emmpid 2 CAID: 06F6 EMM_PID: 00BF PROVID: 000000 TYPE: UNIQUE: SHARED: GLOBAL:
2020/10/31 22:01:10 1E5ACAF5 c (dvbapi) Processing socketdata completed after 1 packets with 0 bytes left unprocessed
2020/10/31 22:01:10 11C5F567 r (reader) reader1 [videoguard2] classD3 ins54: no cw -> Card needs pairing / extra data
2020/10/31 22:01:10 11C5F567 r (reader) reader1 [videoguard2] classD3 ins54: no cw -> tier expired

 

[RuckZuck]

2020/10/31 22:01:10 11C5F567 r (reader) reader1 [videoguard2] classD3 ins54: no cw -> tier expired

seems that your Card isn‘t active, so no Need to set ist up
In OSCam.

 

[dvbuser]

The card works fine in the official STB.

Oscam is able to read the card using the boxid. That verifies that the boxid is correct. The ins7e is probably not.

@RuckZuck1986 What else do i need in Oscam?

 

[RuckZuck]

If you have valid tiers & active card, you Need the Card paired, valid ins7E, BoxID and the dCW with Same ECM-Hash of your eCW in Mode 83 (of equal pairing Mode).
Search the Forum for vast.ai / hashcat.
But this will only work of you Card dies DES, no 3DES or AES Overcrypt.

 

[Betatester_2000]

Which Provider uses by the way 09bb ?

 

[mrbones]

If you have valid tiers & active card, you Need the Card paired, valid ins7E, BoxID and the dCW with Same ECM-Hash of your eCW in Mode 83 (of equal pairing Mode).
Search the Forum for vast.ai / hashcat.
But this will only work of you Card dies DES, no 3DES or AES Overcrypt.

And where to get the dCW?

 

[Betatester_2000]

The big question is to get the dCW. When the card is paired correctly, you only get eCWs.

 

[mrbones]

If this is a common card you can google for some test lines from payservers.

 

[dvbuser]

If you have valid animals & active card, you need the card paired, valid ins7E, BoxID and the dCW with Same ECM-Hash of your eCW in mode 83 (of equal pairing mode).
Search the forum for vast.ai / hashcat.
But this will only work of you Card dies DES, no 3DES or AES Overcrypt.

The card is paired. I dont know what encryption it uses. Unfortunately, I also don't know the correct ins7E. I made up the ins7E string (mentioned in the opening post) following other threads in this forum, but received 'Card needs pairing / extra data' pairing error.

If this is a common card you can google for some test lines from payservers.

Yes, others seem to have this CAID working. I was able to get a testline and view a channel. The oscam log is attached for a working channel. Is there anything from this log which can be useful to get my own card working?

 

[RuckZuck]

Caid in log is 09AA, yours is 09BB, so not the same card!

 

[dvbuser]

That is an interesting observation.

Sie müssen registriert sein, um Links zu sehen.

supports both irdeto and video guard encryption. The oscam logs also shows this,

2020/11/04 01:34:00 50D32641 c (dvbapi) Added new emmpid 0 CAID: 09AA EMM_PID: 00C0 PROVID: 000000 TYPE: UNIQUE: SHARED: GLOBAL:
2020/11/04 01:34:00 50D32641 c (dvbapi) Added new emmpid 1 CAID: 09BB EMM_PID: 00C0 PROVID: 000000 TYPE: UNIQUE: SHARED: GLOBAL:
2020/11/04 01:34:00 50D32641 c (dvbapi) Added new emmpid 2 CAID: 06F6 EMM_PID: 00BF PROVID: 000000 TYPE: UNIQUE: SHARED: GLOBAL:

The 09BB CAID is detected as Videoguard as shown by the logs in the opening post. The 09AA CAID is also defined as Videoguard in the oscam code

Sie müssen registriert sein, um Links zu sehen.

. Unfortunately, I am not sure why two CAID exist for the same encryption and the same provider.

 

[RuckZuck]

The Channel you‘r watching can be decrypted by three cards. Each card-type has it‘s own Caid.
The Testline has caid 09AA, your Card has 09BB, so it doesn‘t really match

 

[August12]

Its Airtel India Card
You need First to Add your Card Videoguard Common C
Tiers are not Correct this Card must have many many of Them Because the Package of Airtel is Huge

Then i asume that you dont will have Luck Bruteforce Works only on 09AA Cards

 

[fun7]

You can froget about 09BB card to get the key via bruteforce

 

[August12]

- Set prio List in your DVB.Api
P:09BB
I:09AA

- Right Boxid and Ins7E

- Compile Osacam with Right Reader Baseyear Yours is 2004

Look Here

Spoiler: Log Part Modified CW KEY

2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] classD3 ins54: Tag55_01 = 8B, CW-overcrypt may not required
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] classD3 ins54: CW is crypted, trying to decrypt unique pairing mode 0x8B
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] crypted CW is: 0000000000000000B02AA282F141F75E
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] k1 for unique pairing mode is not set
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] cardreader_do_ecm: after csystem->do_ecm rc=0
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] cardreader_do_ecm: ret rc=0
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] cardreader_process_ecm: cardreader_do_ecm returned rc=0 (ERROR=0)
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] Error processing ecm for caid 09BB, provid 000000, srvid 33E2, servicename: 09BB@000000:33E2 unknown
2021/02/15 01:02:01 5441E252 r (reader) Airtel_India [videoguard2] ecm hash: BCCA86D50E01D2E764AC7DB7AE740815 real time: 93 ms
2021/02/15 01:02:01 5356491B c (ecm) 123 (09BB@000000/0497/33E2/62:BCCA86D50E01D2E764AC7DB7AE740815:0F06000000000000: not found (96 ms) by Airtel_India
2021/02/15 01:02:01 5356491B c (ecm) cw:
2021/02/15 01:02:01 5356491B c (ecm) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

When Evrything Looks like This here you can Forward Thinking About K1