Nagra Hex block Decryption

[ZIED JOMAA]

Can anyone help with this nagra binary?for extract CWPK keys i have oscam merlin pm me

 

[Benfica200]

Can anyone help with this nagra binary?for extract CWPK keys i have oscam merlin pm me

Well, only STi guys know...:Mad2:

 

[AbouRayene]

- - - Updated - - -

Can anyone help with this nagra binary?for extract CWPK keys i have oscam merlin pm me

the problem is not the extraction of cwpk or the data but you will stuck in their decryption with the cpu key

 

[AbouRayene]

Can anyone help with this nagra binary?for extract CWPK keys i have oscam merlin pm me

if you still need your 2 blocs from dump PM me
but with crypted cwpk of course

 

[bolle2k]

first 3 CWPK used the same key for decryption (common key) rest is uniqe

 

[Pampalini]

Hi Masters!

Can anyone help with this dump?
Need the boxkey and rsa key.
Download Atmel_AT45DB161_00-20FFFF.bin from Sendspace.com - send big files the easy way

Thanks for everybody who can help me.

 

[avavynova]

hi masters!

Can anyone help with this dump?
Need the boxkey and rsa key.
download atmel_at45db161_00-20ffff.bin from sendspace.com - send big files the easy way

thanks for everybody who can help me.

ird:
6b0f1e08
bk:
7eb4dc1dc1ad900e
rsa:
D9702dc42c2c4a5b67b8ac26a14be53a0cf0bac51551db9c538feb9a4751ae6e61ea0827e32644c8b958946886621f25c2fc21395fb9f0bc055e0c50d93efab9

 

[Benfica200]

hi masters!

Can anyone help with this dump?
Need the boxkey and rsa key.
download atmel_at45db161_00-20ffff.bin from sendspace.com - send big files the easy way

thanks for everybody who can help me.

ird: 6b0f1e08
2008: 28c1c0a2b91d8d8a
3008: 921df5abf844110c
3140: D9702dc42c2c4a5b67b8ac26a14be53a0cf0bac51551db9c538feb9a4751ae6e61ea0827e32644c8b958946886621f25c2fc21395fb9f0bc055e0c50d93efab9
3310: C6db120701e87262b0b3c509f5c8b1fa
3460: 95644ea3bf54e0c39cb50be41a0e0702c91cdab46cae89b9b9195c5491d22c59c7965ba9d86af97b03fe72496d37e4b7e74d2bf38e49ded2541a59656aef9161ca25f561dc59952b8a5fd0630114fb1003658e3ed14aa98eb565e1d21d30bac1
3588: 6b1934bc3ff3661c93c58f002088eacb4ea7a14a8802c07e29ef11200629a618c73b6f33f1d002fc53bf9b2934ba60ad3cd146b8d8ded3022ab26839fc69a9948de7941d04dacdcb465baf69721f1b4975fc80a807817ecba84b46b4dc1f3d52ec6f8bb59ca18cfa010a58a995051df3275baba3290d9b2e51c16e29489b684462cce40159d30812
d008: Eca929b639e98102
e002: 0001
mod1:
mod2:
boxkey: 7eb4dc1dc1ad900e
rsa key: D9702dc42c2c4a5b67b8ac26a14be53a0cf0bac51551db9c538feb9a4751ae6e61ea0827e32644c8b958946886621f25c2fc21395fb9f0bc055e0c50d93efab9

upc!

 

[mybuntu]

Magic_Data-B6711C868C3EE72533A4E08C1364B83AEEFDEBE9FB54156A87 76D872CBC41FF2E5EA2CBAF4F26A58C521EC53E310FC494354 E49ECE6CD0F9631B724FAB0C8BAEC1F66C346AD2DB1CB3871A F44C1E1592
Magic_Mod-DB9E1F1BD23C6153444E444D8E6C471E162EC63C599D44F476 E0D40C3840E0FDB7B63D174DD73B575543983F2F2DFB94E364 4958AE642C91636A6BE55528478EB7A422479598C68E6F1FC9 D647BBC4D5

Benfica, could you please PM me the Original dump for study?

 

[terrestrial]

Can someone explain to me how to calculate or where the RSA mods are located in the dump.... take the UPC dump above here for example if you like. If you don't want to share it publicly send me a PM.

The following information suggests that there are 4 blocks of data but where do we find these?

Required for Processing DT05 structure RSA_MOD1 Static from STB flash, and RSA Mod2 Static from STB flash and RSA_MOD88 generic

These 2 0x70 RSAs are a Result of Xoring other 4 blocks of 0x70 bytes stored in STB firmware Flash.

Block 1 XOR Block 2 = RSA_MOD_1 Provider STB manufacturer specific global key ( This key is only used on DT05_00 and DT05_10 RSA decrypt steps for Global Generic Pairing Mode)

Block 3 xor Block 4 = RSA_MOD_2 Provider Specific STB Global RSA key ( This key is Unique for Each Provider and this key is used only for STB using Unique Pairing with CMD DT05_20)

Block 4 xor Block 5 = RSA_MOD88 used for CMD$03 steps

Or do we need that magic_hastable?

 

[Benfica200]

Block 4 xor Block 5 = RSA_MOD88 used for CMD$03 steps

Something is wrong, because Block4(is 0x70) xor Block5 = 0x88?!:Mad2:

 

[mybuntu]

@benfica: could you give a hint on how it's done? I guess there is another way..

 

[terrestrial]

Something is wrong, because Block4(is 0x70) xor Block5 = 0x88?!:Mad2:

I never said the info was correct, it's just something i found. But look forward to any solution or hints.

 

[avavynova]

block 016C decryption

enjoy !!!

 

[mybuntu]

and block 0097....?
Still dont know how to calculate RSAmod1 + 2.

PM

 

[terrestrial]

Yeah block 016c is no problem anymore. Block 97 is not encrypted, but it contains encrypted cwpk's.. Decrypting these is done by the CPU based on the nuid or in case of no block 97 using ota and the CPU.

Just leaves the RSAmods which are necessary to initialise the card.

 

[AbouRayene]

Yeah block 016c is no problem anymore. Block 97 is not encrypted, but it contains encrypted cwpk's.. Decrypting these is done by the CPU based on the nuid or in case of no block 97 using ota and the CPU.

Just leaves the RSAmods which are necessary to initialise the card.

thanks friend,
But 0097 & cwpk are needed to get clear dcw if not we will get only the black screen using the 000016c block info no ?

and for 00016c decryption i think gays have a new tool used for full info thanks for share it in PM

 

[zaran]

anyone has oscam cak7

 

[zaran]

or a patch for oscam merlin

 

[dreambox2011]

hi all please help nds card caid 092b help lovers of favor cak7