Nagra Hex Block Decryption Research

[terrestrial]

Is it correct Ziggo?

Provider ID: 7811

Cau Adas

The provider ID is 007911 but the sysid/management id is 007811 but that same sysid is used for many UPC providers in Europe. So having a dump with 7811 does NOT automaticly mean it's from the Netherlands

 

[Benfica200]

Yap this work with same mods of upc(RO,CH, etc)

 

[adas]

Nagra Hex block Decryption

Cau Adas

 

[terrestrial]

So if i understand correctly if i have the mods from upc schweiz, you're telling me they work for the Netherlands too?

 

[adas]

UPC Schweiz also fits

Cau Adas

 

[Benfica200]

So if i understand correctly if i have the mods from upc schweiz, you're telling me they work for the Netherlands too?

A tip, in a good oscam the sysid used in cmd0E you have to get it in dt05_00(cta_res[24])

 

[terrestrial]

Ok i tried to init my rom110 A7 card in CAK7 mode, but i think the card is not quitte ready for it yet. It does not want to switch to cak7 mode, keeps wanting to use BK/RSA. (sessionkey)

 

[adas]

CAID, init log, you write a lot, I'm getting lost.

Cau Adas

 

[Benfica200]

Or oscam not know this!lol
DNASP110 A7?

 

[terrestrial]

Or oscam not know this!lol
DNASP110 A7?

Yes DNASP110 A7 and it works fine in CAK6 mode, i just wanted to try and see if it dealt with CAK7. I didn't make a log.

 

[Benfica200]

Some card not switch to DNASP4(like dnasp14x, dnasp11x) dont know if is your case.

 

[Benfica200]

Ok i tried to init my rom110 A7 card in CAK7 mode, but i think the card is not quitte ready for it yet. It does not want to switch to cak7 mode, keeps wanting to use BK/RSA. (sessionkey)

Your use oscam for polish source?
in this case need add you DNASP1x(but i doubt if this switch)

You don't have permission to view the code content. Log in or register now.

to

You don't have permission to view the code content. Log in or register now.

 

[tvglotze]

Do TIGER Cards also have 016c block in flash, where rsakey is derived from? Is process the same, because Tiger RSA length doesn't correspond to let's say "standard" IRD keyset lengths (3140/3240/3310/3460/3588)?

 

[Benfica200]

Do TIGER Cards also have 016c block in flash, where rsakey is derived from? Is process the same, because Tiger RSA length doesn't correspond to let's say "standard" IRD keyset lengths (3140/3240/3310/3460/3588)?

Which tiger card?

 

[tvglotze]

183E
Flash is crypted, I cannot find any block 016c.
Only chance is to dump ram?

 

[Benfica200]

183E
Flash is crypted, I cannot find any block 016c.
Only chance is to dump ram?

rsa key not out from block 016c, new rsa same(size) like old rsa for tiger.

 

[tvglotze]

So it's from rodata like MODs?

 

[Benfica200]

So it's from rodata like MODs?

Right!!!

 

[adas]

I have not seen the encrypted block in Tiger

Cau Adas

 

[tvglotze]

It just was a guess, because I didn't find any block 016c.
As binwaIk doesn't find anything readable, may I assume I need to bit swap?