Nagraravison3_Source_Code_Algorithm.zip

  • PUDN用户
    了解作者
  • C/C++
    开发工具
  • 58KB
    文件大小
  • zip
    文件格式
  • 0
    收藏次数
  • 1 积分
    下载积分
  • 109
    下载次数
  • 2009-11-20 23:40
    上传日期
you can studies nagra3 function
Nagraravison3_Source_Code_Algorithm.zip
  • Nagraravison 3 Source Code (Algorithm)
  • Nagraravison 3.txt
    291.4KB
内容介绍
www.banksat.com ---------------------------------- __ __ __ ___ __ __ The NagraVision3 hacking by banksat.com team /_/ /_/ /_/ | | /_/ /_/ Revision: 00000000 |_|/_/ /_/ |_| /_/ |_| | || | | | | | | | | | -- -- -- - -- -- Contents: 0: Openers 0.1: Introduction/About me 0.2: Where to find this FAQ 0.3: Contributors 0.4: Detractors 1: The T=1 protocol 1.1: NagraVision2 ATR 1.2: NagraVision's packet structure I: The ISO-specified portion 1.2.1: Chained messages 1.3: NagraVision's packet structure II: The IRD-to-CAM information field 1.4: NagraVision's packet structure III: The CAM-to-IRD information field 1.5: The status word 2: Commands 2.1: Command list 2.2: Command lengths, expected replies, and reply lengths 2.3: Command breakdown 2.3.Rom152.CMD.04: CMD $04/RSP $84 Entitlement Management Message (EMM) 2.3.Rom152.CMD.07: CMD $07/RSP $87 Entitlement Control Message (ECM) 2.3.Rom152.CMD.12: CMD $12/RSP $92 Serial Number Request 2.3.Rom152.CMD.15: CMD $15/RSP $95 Processing cycle request 2.3.Rom152.CMD.17: CMD $17/RSP $97 Special Entitlement Management Message Cmd17 (EMM) 2.3.Rom152.CMD.18: CMD $18/RSP $98 Special Entitlement Management Message Cmd18 (EMM) 2.3.Rom152.CMD.1A: CMD $1A/RSP $9A Control Word Request (video decryption key request) 2.3.Rom152.CMD.1C: CMD $1C/RSP $1C Control Word Request (video decryption key request) 2.3.Rom152.CMD.22: CMD $22/RSP $A2 Data item request 2.3.Rom152.CMD.2A: CMD $2A/RSP $AA MECM key request 2.3.Rom152.CMD.2B: CMD $2B/RSP $AB MECM key update 2.3.Rom152.CMD.32: CMD $32/RSP $F2 Request for encryption of data to be sent in callback 2.3.Rom152.CMD.33: CMD $33/RSP $F3 Request for data encrypted by previous command $32 2.3.Rom152.CMD.48: CMD $48/RSP $78 Special Entitlement Management Message Cmd48 (EMM) 2.3.Rom152.CMD.49: CMD $49/RSP $79 Get EMMPlaintext from Cmd48 2.3.Rom152.CMD.4A: CMD $4A/RSP $7A Special Encrypt Message Cmd4A 2.3.Rom152.CMD.64: CMD $64/RSP $E4 Write IRD info 2.3.Rom152.CMD.65: CMD $65/RSP $E5 Get IRD Command from EmmCmd64 2.3.Rom152.CMD.68: CMD $68/RSP $E8 Process UROM2 Data 2.3.Rom152.CMD.69: CMD $69/RSP $E9 Process UROM2 Data 2.3.Rom152.CMD.6A: CMD $6A/RSP $EA Update Provider Filter 2.3.Rom152.CMD.6B: CMD $6B/RSP $EB Update and play with DecryptKey no 7A and Provider Filter 2.3.Rom152.CMD.6C: CMD $6C/RSP $EC Update Provider Filter 2.3.Rom152.CMD.6D: CMD $6D/RSP $ED Update or Create DecryptKeyno24 2.3.Rom152.CMD.C4: CMD $C4/RSP $84 Special Entitlement Management Message CmdC4 (EMM) 2.3.Rom152.CMD.C7: CMD $C7/RSP $B7 Request for ID of updated data items 2.3.Rom152.CMD.C8: CMD $C8/RSP $B8 Request for date/time 27Rom Total 2.3.FW.CMD.05: CMD $05/RSP $85 unknow 2.3.FW.CMD.08: CMD $08/RSP $88 unknow 2.3.FW.CMD.16: CMD $16/RSP $96 unknow 2.3.FW.CMD.19: CMD $19/RSP $99 unknow 2.3.FW.CMD.27: CMD $27/RSP $A7 unknow 2.3.FW.CMD.28: CMD $28/RSP $A8 unknow 2.3.FW.CMD.29: CMD $29/RSP $A9 unknow 2.3.FW.CMD.2C: CMD $2C/RSP $AC unknow 2.3.FW.CMD.2D: CMD $2D/RSP $AD unknow 2.3.FW.CMD.63: CMD $63/RSP $E3 unknow 2.3.FW.CMD.6E: CMD $6E/RSP $EE unknow 2.3.FW.CMD.C9: CMD $C9/RSP $B9 unknow 12FW Total 2.4: Basic command sequences 2.4.1: Finding out if the card is busy or has new information 2.4.2: Finding out what data types in the card's database have changed 2.4.3: Retrieving a specific data item from the card 2.4.4: Getting the data required to decrypt the video stream 3: EMM commands 3.1: EMM command list 3.2: EMM command breakdown 3.2.01: EMM command $01 Set up for EMM commands 3.2.10: EMM command $10 Spending limit item create 3.2.12: EMM command $12 Create subscription tier 3.2.13: EMM command $13 PPV Service 3.2.20: EMM command $20 Modify subscription dates 3.2.46: EMM command $46 Create and update Dt08 ItemId0A 3.2.47: EMM command $47 DT06 key update for key no 30 (CMD48) 3.2.48: EMM command $48 Create and update Dt08 ItemId0A 3.2.49: EMM command $49 Create and update Dt08 ItemId0A 3.2.42: EMM command $42 DT06 key update 3.2.4F: EMM command $4F CW Extra encryption 3.2.54: EMM command $54 Update blackout bytes 3.2.81: EMM command $81 Master program provider activation 3.2.83: EMM command $83 Change EMM system ID 3.2.64: EMM command $64 Encrypt IRD command 3.2.90: EMM command $90 Create ItemID0B 3.2.85: EMM command $85 Create ItemID04 3.2.9F: EMM command $9F EmmHeader for nextemmcmd by Cmp UpstatMsb:Lsb 3.2.A1: EMM command $A1-AF Emm Filter by CamId 3.2.B1: EMM command $B1 Execute code from RAM 3.2.B1.0801 List: Emm Command $B1 List of packet 41 42 43 44 45 46 47 3.2.C4: EMM command $C4 EmmCmdXX with Extra encryption Layer 3.2.C5: EMM command $C5 WriteEEp at 311E and 311F and Update Date_Copy 3.2.E0: EMM command $E0 ItemID Update 3.2.E3: EMM command $E3 Write eeprom 3.2.E3: EMM command $E3 Write eeprom, Sub section all EmmcmdE3 packet for Rom102Rev241 to Rom102Rev242 3.2.E3: EMM Command $E3 write eeprom, Sub Section Understand EmmcmdE3 by dasm 3.2.F3: EMM command $F3 4: 21-xx data types 4.1: Data type list 4.2: Data type breakdown 4.2.00: Data Type$00 Mapped ItemID[01] - IRD INFO 4.2.01: Data Type$01 Mapped ItemID[02] - System Type 4.2.02: Data Type$02 Mapped ItemId[03] - 4.2.03: Data Type$03 Mapped ItemID[04] - 4.2.04: Data Type$04 Mapped ItemID[05] - Provider Info 4.2.--: Data Type$-- Mapped ItemID[06] - Decrypt Keys 4.2.05: Data Type$05 Mapped ItemID[07] - Tier 4.2.06: Data Type$06 Mapped ItemID[08] - Provider Filter 4.2.07: Data Type$07 Mapped ItemID[09] - Spending Limit 4.2.08: Data Type$08 Mapped ItemID[0A] - DT08+C8 4.2. : Data Type$ Mapped ItemID[0B] - 4.2. : Data Type$ Mapped ItemID[0C] - 4.2. : Data Type$ Mapped ItemID[FF] - DTMatchany 5: The backdoors 5.1: The backdoor passwords 5.2: The backdoor commands 6: Inside NagraVision cards 6.1: The MCU core 6.2: AA-06 vs AA-07 7: Glossary 7.1: Glossary 8: Encryption 8.1: ECM encryption 8.1.1: The encryption algorithm 8.2: EMM encryption 8.3: The valid hash 9: Hacks 10: Firmware versions of the various E* cards 10.102: ROM152 firmware versions 11: Writing code for NagraVision cards 11.3: ROM152 cards 11.3.1: Bug-catcher modules 11.3.2: Hooking in a bug-catcher 11.3.3: Useful routines and memory locations 11.3.3.1: Utility routines 11.3.3.2: Database routines 11.3.3.3: Low-level routines 11.3.3.4: Encryption/decryption routines 11.3.4: Memory usage 11.3.4.1: ZP RAM 11.3.4.2: Other RAM 11.3.4.3: Tables in ROM and EEPROM 11.3.5: MAPROM 13: Stream 13.1: Bootup sequence 0101 13.2: Bootup sequence 0101 cut 13.3: Bootup sequence 0801 13.4: Bootup sequence 0801 cut 13.8: Nagra_3_config1.1.cfg for T-Rex Nagra-Tool 13.9: DASM ROM152_ND13_A0FF-INTERCEPT-autoVCC_20.XVB Blockerv7 Backdoor dasm Blockerv7 emmhandler dasm 22sk dasm _____________________________________________________________________________________________________ /| /| / | / | /__|_______________
评论
    相关推荐
    • 3DES加密算法源代码.rar
      DES加密源代码,用3DES加密算法。 加密强度高,到目前为止,还无人能够破解!
    • crc.zip
      CRC校验程序,使用了CRC-16和CRC-CCITT方法
    • rsa1.03.zip
      rsa算法实现,包含文档
    • fast-des3.0.tar.z
      des算法实现源码
    • des3_win32_vc.zip
      一个3des算法的库文件和使用库文件的例子
    • dcpcrypt.zip
      Delphi加密控件源码,包括对称钥匙加密控件和散列函数控件
    • rc.zip
      含有rc2、rc4、rc5、rc6算法的rc算法集合
    • oicqpass.zip
      读取OICQ用户保存在本地机器上的密码
    • elgamal.zip
      另一种公开密钥加密算法的Pascal实现和例子。实现了签名和确认
    • linuxscanners.zip
      linux下的端口扫描器