Need help setting up rqcamd - Digital World Cable Satellite Console Forum

despdan · 3rd July 2009, 19:37

Ok trying to get this cam working on dreambox.

Have uploaded log & n2stream dumps, the sources files are also included.

2shared - download rqcamd.zip

Have it running but still not clearing so need help on the config file see below & will probably need help modifying sources

Could someone Please explain in detail all the settings

Code:

onid_low=0000
onid_high=0001
caid_priorities=1801|1800
emm_pid=1801:0120|1800:0120
emm_g_table=1801:82|1800:84
emm_s_u_table=1801:83|1800:83
swap_control_words=0
ecm_nano_offset=10
hash_control_words=1
mecm_key=0000
mecm_40_address=0000
mecm_60_address=0000
decoder_type=1
card_server_url_0=newcamd://username:password@192.168.0.100:10550/0102030405060708091011121314/EMM
cam_id=00000000
process_emm_g=1
process_emm_s=0
process_emm_u=0
protocol_server_enable=0
protocol_server_type=0
protocol_server_port=11004
protocol_server_caid=1810
protocol_server_newcamd_des_key=0102030405060708091011121314
protocol_server_users=dummy:dummy|dummy_2:dummy_2|dummy_3:dummy_3

nozzer · 3rd July 2009, 20:07

ok, you can probably ignore a lot of it as it wont be relevant at this point.

protocol stuff is all the kinds of servers it can connect to so ignore

process_emm is how Emm's are handled. Again, at this point you aren't interested so i'd be inclined to set all to 0

cam_id, you probably should set to something reasonably realistic although its likely only used to grab the correct Emm's from the stream. I'd set to something like 08010203

card_server - ignore

decoder_type - not sure, you may have to fiddle with this.

mecm - I'd ignore at this point. Leave them all as 00

hash_control_words decides whether the CW's are hashed after they are extracted from the ECM. You probably want to turn this off (0)

ecm_nano_offset - decides where in the ECM to start scanning from in order to find the CW's. You'll need a decrypted ECM in order to fathom out this positioning. This is likely to need to increasing from 10 for normal N2 - Its usually 14 or higher.

swap_control_words - Gives the option to present the CW's to the descrambler either in the order found (ie 1 - 2 ) or the reverse order (ie 2 -1 ). You'll definately need to set this properly !!!

emm tables are descriptions of the stream tables where Emm's are found - ignore for now

emm_pid are the PID's where Emm's are found. You can probably ignore for now.

caid_priorities - decides which scrambling system has a priority in multicast situations. 1801 first means N2 has priority.

onid is original NetId. You should probably set this to the original netid for your provider but not sure what this is for UPC so ignore for the moment.

As you can see, you can ignore most settings as they are either for server connections or Emm stuff. The rest though, you have to get right !

With this CAM, you will need to make sure that its actually picking up the correct data for UPC as its code is optimised for particular US providers at the expense of generallity. You may have to modify the code itself and recompile. Make sure you turn on every debug option you can find so you can make a stab at determining any problems.

If you want to compile then you will need a linux image with a dreambox compile environment. There used to be a DW school image around a while back that would do the job nicely.

Possibly, this source could be discussed/modified by interested parties if anybody fancies trying to get an open source N2 cam working ???

despdan · 3rd July 2009, 21:40

@ nozzer

tried your above settings & wouldn't give me any logs so edited config to:

Code:

swap_control_words=0
ecm_nano_offset=14
hash_control_words=1
mecm_key=0907
mecm_40_address=91F5
mecm_60_address=92F5

That returned these logs:

Code:

Loading ROM102 ROM file... 
Loading ROM102 EEPROM file for provider 0101... 
Loading ROM102 EEPROM file for provider 0901...   WARNING: Could not load /var/scce/EEP08_102.bin.

  cam[di:-]: Ready.

  cam[di:-]: Message data:
    9F 80 32 82 00 3A 03  ( I think this is related to the roms I have in scce )


  SR | SID:5305, NS:EEEE0000, TSID:000D, ONID:0601, PMT PID:0024, DM:1, DMX:1
    Root CA Info | CA Descriptors: 3
      CA Descriptor | CAID: 1800, ECM PID: 1355
      CA Descriptor | CAID: 1801, ECM PID: 1365
      CA Descriptor | CAID: 1802, ECM PID: 13C5

    PID Section | Type: 02 [MPEG2 Video], PID: 0105, CA Descriptors: 0
    PID Section | Type: 04 [MPEG2 Audio], PID: 01A5, CA Descriptors: 0
    PID Section | Type: 06 [Teletext/VBI], PID: 01D5, CA Descriptors: 0
  cam[di:-]: Selected: CAID:1801, ECM PID:1365
  cam[di:-]: Starting decoder... 
  cam[di:0]: Starting EMM-G processor...
  cam[di:0]: Initializing EMM-G processor...
  cam[di:0]: EMM-G processor started...
  ECM[di:0] **** [Thu Jan  1 01:00:42 1970] Start processing ECM...
    CaID:        1801 - Nagravision.
    Provider ID: 5F01 - Supported.
    Raw Encrypted ECM: 
      81 30 47 07 45 5F 01 
    

    Decoder:     Using internal softcam.

    V key not found for provider 5F01.
    Nagra2 ROM/EEPROM not loaded. Aborting.
    Control words:
      CW0 (NOT SET): 00 00 00 00 00 00 00 00 
      CW1 (NOT SET): 00 00 00 00 00 00 00 00

N2stream

Code:

Timestamp:            2009-07-03|22:15:44
Event:                ECM
SID:                  5103
CaID:                 1801
M1-Key:               same as hypercam
V-Key:                00000000000000000000000000000000
Idea-Key-00:         same as hypercam
Idea-Key-01:          00000000000000000000000000000000
Idea-Key-Active:     getting info here
MECM-Idea-Key-00:     00000000000000000000000000000000
MECM-Idea-Key-01:     00000000000000000000000000000000
MECM-Idea-Key-Active: 000000000000000000000 & here

please delete any thing I have missed thats not allowed.

nozzer · 3rd July 2009, 22:28

Thats actually further than I thought it get !

That looks like its found the correct ECM PID, actually got the ECM data itself and attempted to manipulate it.

It also looks like its picking up the correct keyset so I dont think its too far off !

could be its just missing the V key from a card dump.

Pretty sure the hash_control_words will need to be set to 0

mecm also needs to be disabled somehow. Not sure how you would accomplish that - it may require the rom102 files being edited.

nozzer · 3rd July 2009, 22:46

Looking at it a liitle bit more it seems to be aborting whilst attempting to load Roms. Obviously, there aren't any for UPC !

You need to start looking at the code here to fathom what the requirements are. In theory, at this point you shouldn't need any Rom code whatsoever as all you want to do is decrypt ECM's but i'd guess that the US ECM's that the cam is designed for had some embedded code in the ECM that required the Roms.

You could try copying some of the present Rom/EEprom and renaming them. ie something like - EEP5E_102.bin

despdan · 4th July 2009, 13:54

Quote:

Originally Posted by nozzer

Looking at it a liitle bit more it seems to be aborting whilst attempting to load Roms. Obviously, there aren't any for UPC !

You need to start looking at the code here to fathom what the requirements are. In theory, at this point you shouldn't need any Rom code whatsoever as all you want to do is decrypt ECM's but i'd guess that the US ECM's that the cam is designed for had some embedded code in the ECM that required the Roms.

You could try copying some of the present Rom/EEprom and renaming them. ie something like - EEP5E_102.bin

Changed a couple of settings & got a little further see pm for dumps.

Would getting the Control Words off mgcamd be of any use?

Do i need to start looking at the roms now? or Which files should i be looking into?:

box.cpp
idea.cpp
nagra2.cpp
rqcamd-readme.txt
box.h
idea.h
nagra2.h
sha1.cpp
ca.h
Makefile
newcamd-client.cpp sha1.h
cam.cpp
Makefile-includes
newcamd-client.h
sha.h
cam.h
Makefile-mips
nn.cpp
simulator.cpp
common.cpp
Makefile-packages
nn.h
simulator.h
common.h
Makefile-ppc
pmt-proxy.cpp
stats.cpp
console-server.cpp
Makefile-x86
pmt-proxy.h
stats.h
console-server.h
map57.cpp
rqcamd.conf
webif
des.cpp
mapcore.cpp
rqcamd.cpp
win32.h
des.h
mapcore.h
rqcamd.h

Anybody willing to share their card dump please?

obwan · 4th July 2009, 17:58

works with your settings and these three empty files in /var/scce
ROM102.bin
EEP08_102.bin
EEP01_102.bin

nice one despdan...

despdan · 4th July 2009, 19:30

Quote:

Originally Posted by obwan

works with your settings and these three empty files in /var/scce
ROM102.bin
EEP08_102.bin
EEP01_102.bin

nice one despdan...

Yeh clears well on channel changes as well

Many Many Thanks to Nozzer you are the best

despdan · 5th July 2009, 11:41

All the files to get this working are here

Download Here

mhill7895 · 1st August 2009, 10:12

Hi.

Tried the mips version on a DM7025+ and it doesn't seem to be clearing the channels for me... Copied in all of the files into the right directories, all chmod'd appropriately but nothing happening.

Any thoughts?

3rd July 2009, 20:07	#2 (permalink)
nozzer Moderator+ Join Date: Jan 2005 Location: In a house! Posts: 5,747 Downloads: 0 Uploads: 0 Thanks: 0 Thanked 5 Times in 5 Posts Feedback Score: 0 reviews	Re: Need help setting up rqcamd ok, you can probably ignore a lot of it as it wont be relevant at this point. protocol stuff is all the kinds of servers it can connect to so ignore process_emm is how Emm's are handled. Again, at this point you aren't interested so i'd be inclined to set all to 0 cam_id, you probably should set to something reasonably realistic although its likely only used to grab the correct Emm's from the stream. I'd set to something like 08010203 card_server - ignore decoder_type - not sure, you may have to fiddle with this. mecm - I'd ignore at this point. Leave them all as 00 hash_control_words decides whether the CW's are hashed after they are extracted from the ECM. You probably want to turn this off (0) ecm_nano_offset - decides where in the ECM to start scanning from in order to find the CW's. You'll need a decrypted ECM in order to fathom out this positioning. This is likely to need to increasing from 10 for normal N2 - Its usually 14 or higher. swap_control_words - Gives the option to present the CW's to the descrambler either in the order found (ie 1 - 2 ) or the reverse order (ie 2 -1 ). You'll definately need to set this properly !!! emm tables are descriptions of the stream tables where Emm's are found - ignore for now emm_pid are the PID's where Emm's are found. You can probably ignore for now. caid_priorities - decides which scrambling system has a priority in multicast situations. 1801 first means N2 has priority. onid is original NetId. You should probably set this to the original netid for your provider but not sure what this is for UPC so ignore for the moment. As you can see, you can ignore most settings as they are either for server connections or Emm stuff. The rest though, you have to get right ! With this CAM, you will need to make sure that its actually picking up the correct data for UPC as its code is optimised for particular US providers at the expense of generallity. You may have to modify the code itself and recompile. Make sure you turn on every debug option you can find so you can make a stab at determining any problems. If you want to compile then you will need a linux image with a dreambox compile environment. There used to be a DW school image around a while back that would do the job nicely. Possibly, this source could be discussed/modified by interested parties if anybody fancies trying to get an open source N2 cam working ???
	Quote Post

3rd July 2009, 22:28	#4 (permalink)
nozzer Moderator+ Join Date: Jan 2005 Location: In a house! Posts: 5,747 Downloads: 0 Uploads: 0 Thanks: 0 Thanked 5 Times in 5 Posts Feedback Score: 0 reviews	Re: Need help setting up rqcamd Thats actually further than I thought it get ! That looks like its found the correct ECM PID, actually got the ECM data itself and attempted to manipulate it. It also looks like its picking up the correct keyset so I dont think its too far off ! could be its just missing the V key from a card dump. Pretty sure the hash_control_words will need to be set to 0 mecm also needs to be disabled somehow. Not sure how you would accomplish that - it may require the rom102 files being edited. Last edited by nozzer; 3rd July 2009 at 22:36.
	Quote Post

3rd July 2009, 22:46	#5 (permalink)
nozzer Moderator+ Join Date: Jan 2005 Location: In a house! Posts: 5,747 Downloads: 0 Uploads: 0 Thanks: 0 Thanked 5 Times in 5 Posts Feedback Score: 0 reviews	Re: Need help setting up rqcamd Looking at it a liitle bit more it seems to be aborting whilst attempting to load Roms. Obviously, there aren't any for UPC ! You need to start looking at the code here to fathom what the requirements are. In theory, at this point you shouldn't need any Rom code whatsoever as all you want to do is decrypt ECM's but i'd guess that the US ECM's that the cam is designed for had some embedded code in the ECM that required the Roms. You could try copying some of the present Rom/EEprom and renaming them. ie something like - EEP5E_102.bin
	Quote Post

4th July 2009, 17:58	#7 (permalink)
obwan Member +++ Join Date: Oct 2005 Posts: 158 Downloads: 0 Uploads: 0 Thanks: 0 Thanked 1 Time in 1 Post Feedback Score: 0 reviews	Re: Need help setting up rqcamd works with your settings and these three empty files in /var/scce ROM102.bin EEP08_102.bin EEP01_102.bin nice one despdan...
	Quote Post

5th July 2009, 11:41	#9 (permalink)
despdan DW Top Poster Join Date: Nov 2007 Location: Ireland Posts: 500 Downloads: 0 Uploads: 0 Thanks: 3 Thanked 5 Times in 4 Posts Feedback Score: 0 reviews	rqcamd files All the files to get this working are here Download Here
	Quote Post

1st August 2009, 10:12	#10 (permalink)
mhill7895 Newbie + Join Date: Aug 2009 Posts: 6 Downloads: 0 Uploads: 0 Thanks: 0 Thanked 0 Times in 0 Posts Feedback Score: 0 reviews	Re: Need help setting up rqcamd Hi. Tried the mips version on a DM7025+ and it doesn't seem to be clearing the channels for me... Copied in all of the files into the right directories, all chmod'd appropriately but nothing happening. Any thoughts?
	Quote Post

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode