Nagra Hex block Decryption

looking for help to calculate the mod keys

blubber83 said:

looking for help to calculate the mod keys

Click to expand...

Look in rodata and search for the universal nagrakeys

key1 (universal) xor key 2 = rsamod1
key3 (universal) xor key 4 = rsamod2

terrestrial said:

Look in rodata and search for the universal nagrakeys

key1 (universal) xor key 2 = rsamod1
key3 (universal) xor key 4 = rsamod2

Click to expand...

Thanks - now which is key2/4? 3460/3588?

blubber83 said:

Thanks - now which is key2/4? 3460/3588?

Click to expand...

no those are keys from the 016c block...

terrestrial said:

no those are keys from the 016c block...

Click to expand...

Yes, but then which ones are key2/4?

onsitbin said:

Obrigado #rafadias6 pelo teu contributo, eu tenho aqui muito material para a netcard inclusive binários , Hexs e a source

abraço

Click to expand...

Acredito que o soft usado para gerar o ntb não seja o M-Studio, apesar da semelhança. Se vc tem a source do pic da netcard, fica bem mais fácil adaptar esse código para trabalhar com as firmwares v5.X. Estou testando outros metódos tb, se vcs repararem, se a gente gravar o "bootloader v4" no PIC com o CP desativado, o programa não roda. Ou seja, só de desativar a proteção do código do PIC, o software já impede a placa de trabalhar, o led nem acende. Estou tentando fazer ela funcionar com o CP desativado, pois fazendo a leitura de uma placa funcional já seria possível jogar nas outras. Se alguém tiver mais arquivos NTBs aí e puder compartilhar, seria bom para estudo.

Any help rsa and box find ?

pepem said:

What's up friends ..

I have this dump N3 inside it has rsa and box .. but I can not find the block 0116c or 000097 u 9882 ..

some help to decipher this dump.

dump file: Dump-N3-mx25l3255exci.bin

Thank you

Click to expand...

hi freind, provider and stb (cpu=) model?

pepem said:

Any help rsa and box find ?

Click to expand...

I'm wondering if this dump is good because usually there is some readable text in a dump, here nothing. But maybe some experts can make more sense of it.

pepem said:

Any help rsa and box find ?

Click to expand...

provider 1802 . N3 , use only rsa and box
america central ..... Cl@ro tv

i have 3 dump .. same models ... other stb ... but nothing block 0016c
but have other stb and have block..
thz

hi
i have 2 box ( french provider )
im search ( uart open )

pace 7105 juc
pace 7105 jud

if one know .......... thanks

I think that document ANSI_SCTE 201 2013 is more complete than ts_103162v010101p
I'm reading, understanding, I can not guarantee it.

u have dump file ?

electron112 said:

hi
i have 2 box ( french provider )
im search ( uart open )

pace 7105 juc
pace 7105 jud

if one know .......... thanks

Click to expand...

pepem said:

u have dump file ?

Click to expand...

don't think he has alreay dumped it since he is asking for help to find uart.

i find uart but just read are open

i have a log ( liaison uart )

thanks

electron112 said:

i find uart but just read are open

i have a log ( liaison uart )

thanks

Click to expand...

when you turn on your receiver and press Enter several times does it enter uboot mode ?

When receiver is ON do you have a shell over uart ?

Sometimes TX communication is capped and you need to insert a electric resistance on motherboard circuits.

are you injectin 3.3v ?

When you try to make TX communication does your TTL interface, flash the led on tx ?

Root_key Key ladder and Cpu BCM


{
#if NEXUS_HAS_SECURITY
NEXUS_Error rc;
NEXUS_KeySlotHandle pKeySlot = NULL;
NEXUS_SecurityKeySlotSettings keySettings;
NEXUS_SecurityAlgorithmSettings algSettings;
NEXUS_SecurityClearKey key;

NEXUS_Security_GetDefaultAlgorithmSettings(&algSettings);
switch (encryption->type) {
case bencryption_type_aes:
BDBG_MSG(("b_keyslot_m2m_allocate: Creating AES keyslot"));
algSettings.algorithm = NEXUS_SecurityAlgorithm_eAes;
break;
case bencryption_type_des:
BDBG_MSG(("b_keyslot_m2m_allocate: Creating DES keyslot"));
algSettings.algorithm = NEXUS_SecurityAlgorithm_eDes;
break;
case bencryption_type_3des:
BDBG_MSG(("b_keyslot_m2m_allocate: Creating 3DES keyslot"));
algSettings.algorithm = NEXUS_SecurityAlgorithm_e3DesAba;
break;
default:
BDBG_MSG(("b_keyslot_m2m_allocate: Unsupported encryption type: %d",encryption->type));
goto error;
}

NEXUS_Security_GetDefaultKeySlotSettings(&keySettings);
#if NEXUS_NUM_DMA_CHANNELS
keySettings.keySlotEngine = NEXUS_SecurityEngine_eM2m;
#else
keySettings.keySlotEngine = NEXUS_SecurityEngine_eCp;
#endif
pKeySlot = NEXUS_Security_AllocateKeySlot(&keySettings);
if (!pKeySlot) {
BDBG_ERR(("b_keyslot_m2m_allocate: Unable to allocate m2m keyslot"));
goto error;
}

algSettings.algorithmVar = encryption->blockmode == bcrypto_blockmode_cbc ? NEXUS_SecurityAlgorithmVariant_eCbc : NEXUS_SecurityAlgorithmVariant_eEcb;
algSettings.terminationMode = NEXUS_SecurityTerminationMode_eClear;
#if NEXUS_NUM_DMA_CHANNELS
algSettings.operation = encrypt ? NEXUS_SecurityOperation_eEncrypt : NEXUS_SecurityOperation_eDecrypt;
#else
algSettings.dest = encrypt ? NEXUS_SecurityAlgorithmConfigDestination_eCps : NEXUS_SecurityAlgorithmConfigDestination_eCpd;
#endif
algSettings.enableTimestamps = timestamp;
rc = NEXUS_Security_ConfigAlgorithm(pKeySlot, &algSettings);
if (rc != 0) {
BDBG_ERR(("b_keyslot_m2m_allocate: Unable to configure m2m algorithm"));
goto error_keyslot;
}

if (encryption->key_ladder) {
#if NEXUS_HAS_KEYLADDER_SUPPORT
bcrypto_keyladder_data *keyladder_data = (bcrypto_keyladder_data *)encryption->long_key;
NEXUS_SecurityEncryptedSessionKey key3;
NEXUS_SecurityEncryptedControlWord key4;

if (encryption->key_length != 8*sizeof(bcrypto_keyladder_data)) {
BDBG_ERR(("b_keyslot_m2m_allocate: Invalid keyladder_data size"));
goto error_keyslot;
}
if (!keyladder_data) {
BDBG_ERR(("b_keyslot_m2m_allocate: No keyladder data provided!"));
goto error_keyslot;
}

if (keyladder_data->keyladder_key != bcrypto_keyladder_key_4 && keyladder_data->keyladder_key != bcrypto_keyladder_key_5) {
BDBG_ERR(("b_keyslot_m2m_allocate: Unsupported keyladder key"));
goto error_keyslot;
}

key3.keyladderID = NEXUS_SecurityKeyladderID_eA;
key3.keyladderType = NEXUS_SecurityKeyladderType_e3Des;
switch (keyladder_data->rootkey_src) {
case bcrypto_rootkey_cust_key:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eCuskey;
break;
case bcrypto_rootkey_otp_a:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eOtpKeyA;
break;
case bcrypto_rootkey_otp_b:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eOtpKeyB;
break;
case bcrypto_rootkey_otp_c:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eOtpKeyC;
break;
default:
BDBG_ERR(("b_keyslot_m2m_allocate: Unsupported keyladder root key source"));
goto error_keyslot;
}
switch (keyladder_data->swizzle) {
case bcrypto_swizzle_none:
key3.swizzleType = NEXUS_SecuritySwizzleType_eNone;
break;
case bcrypto_swizzle_0:
key3.swizzleType = NEXUS_SecuritySwizzleType_eSwizzle0;
break;
case bcrypto_swizzle_1:
default:
BDBG_ERR(("b_keyslot_m2m_allocate: Unsupported swizzle"));
goto error_keyslot;
}
key3.keyEntryType = NEXUS_SecurityKeyType_eOdd;
key3.operation = keyladder_data->gen_key_decrypt ? NEXUS_SecurityOperation_eDecrypt : NEXUS_SecurityOperation_eEncrypt;
key3.cusKeyL = keyladder_data->key_cust_low;
key3.cusKeyH = keyladder_data->key_cust_high;
key3.cusKeyVarL = keyladder_data->key_var_low;
key3.cusKeyVarH = keyladder_data->key_var_high;
BKNI_Memcpy((void *)(key3.keyData),
(void *)(keyladder_data->odd_in_3),
24);
key3.bRouteKey = false;

onsitbin please stop spamming this thread with non crucial information and smiles...... already the 3 time.....

This is a discussion topic about serious stuff not a Facebook CHAT....

Please forum admins do something about this spam guys.....

no problem
pachecoso he just want help

pachecoso said:

onsitbin please stop spamming this thread with non crucial information and smiles...... already the 3 time.....

This is a discussion topic about serious stuff not a Facebook CHAT....

Please forum admins do something about this spam guys.....

Click to expand...

Do you know much about @onsitbin @pachecoso the guys a legend and can teach us a lot