Card Initialisation and Updates - How the cc's do it !

[nozzer]

Ok, quick runthrough of how the cc's initialise and update a subscribed card !

; Card initialisation sequence for TW cards.
; The following Emm's are addressed to a particular card
; and will only be acted upon by that one card whose CAM No
; matches that transmitted in the Emm
;
; Emms are transmitted using PK1 keys which are unique to
; a particular group of cards. No other cards can decrypt
; these Emm's !
;
; Please note the CamId has bee doctored to protect the
; keyset used !
--------------------------------------------------------
; Create a tier 0C with spending limits of £105. Call home @ £100
; Rights Id on this tier is FFFFFF
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
10 -> CREATE DT $0C (EXPENDINGS limit)
FFFFFF ID RIGHTS
0069 EXPENDINGS LIMIT UNITS (HEX)
00 EXPENDINGS LIMIT 1/100 (BCD)
0064 CALL THRESHOLD
00 -> EMM END
--------------------------------------------------------
; Validate the tier withrights Id of FFFFFF (ie our Tier 0C)
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
22 -> VALIDATE DT $01,$02,$06,$08..$0B
00 TD=$08..$0B, COMPARE SYSTEM ID & RIGHTS ID
FFFFFF ID RIGHTS
00 -> EMM END
--------------------------------------------------------
; Update spending limits on Tier 0C to £105
; This makes sure date is set properly for this tier !
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
25 -> UPDATE PPV EXPENDINGS LIMITS
FFFFFF ID RIGHTS
03 DEBT <- VALUE & CREDIT <- 0
006900 VALUE
1E7E UPDATE DATE: 30/03/2007
00 -> EMM END
---------------------------------------------------------
; Update the phone home threshold in the tier 0C to £100
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
2F -> UPDATE DATA IN DT $08..$0C
FFFFFF ID RIGHTS
10 OFFSET
02 DATA LENGTH. DATA TO WRITE:
0064
00 -> EMM END
----------------------------------------------------------
; Update the callback phone number in Tier 06 (sec prov)
; In cable systems this is used as a reference number
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
63 -> UPDATE CALLBACK PHONE NUMBER
A010000034015020 PHONE NUMBER
02FF
00 -> EMM END
----------------------------------------------------------

 

[nozzer]

another bit as too long for one post !

; Update the programmed callback time in the tier 06 (sec prov)
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
62 -> UPDATE PROGRAMMED CALLBACK
04 CALLBACK WHILE (HOURS)
1E7F CALLBACK DATE: 31/03/2007
8352 CALLBACK TIME: 16:26:36
14 CALLBACK RETRIES
00 -> EMM END
----------------------------------------------------------
; Instruct card to pass back a NetId setting command to box
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
64 -> CRYPT IRD COMMANDS
0B IRD COMMAND LENGTH:
00FBDFBEC201A006F02087
----------------------------------------------------------
; Instruct card to pass back a PIN setting command to box
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
64 -> CRYPT IRD COMMANDS
0B IRD COMMAND LENGTH:
00FBDEE412013132333423
---------------------------------------------------------
; Instruct card to pass back a NetId setting command to box
; This is always done twice in any initialisation sequence !
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
64 -> CRYPT IRD COMMANDS
0B IRD COMMAND LENGTH:
00FBDEE5C201A006F02087
----------------------------------------------------------
; Create tier 8 for Sky Sports Extra
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
0D4175 ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
0019 MIN. CHANNEL ID
0019 MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
0D4175 ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Create tier 8 for Supreme Package
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBBD ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
00DE MIN. CHANNEL ID
01EB MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBBD ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Create tier 8 for Disney channel
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBD6 ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
0008 MIN. CHANNEL ID
0008 MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBD6 ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Create tier 8 for Sky Cinema 1,2
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBD2 ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
0003 MIN. CHANNEL ID
0003 MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBD2 ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Create tier 8 for Sky Movies 2,4,6,8,10
;
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBD3 ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
000B MIN. CHANNEL ID
000B MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBD3 ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------

 

[nozzer]

and yet another bit.......

; Create tier 8 for Sky Movies 1,3,5,7,9
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBD9 ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
0001 MIN. CHANNEL ID
0001 MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBD9 ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Create tier 8 for Sky Sports 1
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBDA ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
000D MIN. CHANNEL ID
000D MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBDA ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Create tier 8 for Sky Sports 2
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBD1 ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
0004 MIN. CHANNEL ID
0004 MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBD1 ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Create tier 8 for Sky Sports 3
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
12 -> CREATE ELEMENT OF VALID CHANNEL SERVICES
00DBD5 ID RIGHTS FOR NEXT EMM
0000 (UNUSED)
1E7E INITIAL DATE: 30/03/2007
5B8C EXPIRATION DATE: 12/12/2037
1EBD RIGHTS DATE: 29/05/2007
000A MIN. CHANNEL ID
000A MAX. CHANNEL ID
8000 COMPONENT
FF MIN. THEME
00FF MAX. THEME
00 LEVEL
20 -> DATE UPDATE FOR DT $08..$0C
03 OPERATION SELECTOR
33 EXPIRATION DATE / DATE RIGHTS
00DBD5 ID RIGHTS
1E7E DATE TO COMPARE: 30/03/2007
1E7E DATE FACTOR TO INITIAL DATE
5B8C DATE FACTOR TO EXPIRATION DATE
1EBD DATE FACTOR TO RIGHTS DATE
00 -> EMM END
--------------------------------------------------------
; Validate tiers !
;
00 -> Filter: CAM #
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD17423 CAM #
22 -> VALIDATE DT $01,$02,$06,$08..$0B
20 TD=$02, COMPARE ONLY SYSTEM ID
000000 ID RIGHTS
00 -> EMM END
----------------------------------------------------------

 

[nozzer]

and now the monthly update Emm's.

Mothly tier updates are handled by a sligthly different Emm
which is addressed to a complete group of cards. A group is
any card where the first three bytes of the Cam No match that
transmitted in the Emm. Thus there may be upto 256 individual
cards addressed by this one Emm !
----------------------------------------------------------
; Example of tier update. This particular one addresses all
; cards in the group and which are ALSO SELECTED in the BITMAP.
;
20 -> Filter: BY SHARED ADDRESS & MASK
5B01 PROVIDER ID (Telewest Cable2 (UK))
2CD174 SHARED ADDRESS TO FIND
00 LOW GROUP
BITMAP:
0000800002000002000000100000200040004000210100004080242800000000
20 -> DATE UPDATE FOR DT $08..$0C
00 OPERATION SELECTOR
03 EXPIRATION DATE / DATE RIGHTS
00DBD3 ID RIGHTS
1E78 DATE TO COMPARE: 24/03/2007
0021 DATE FACTOR TO INITIAL DATE
0021 DATE FACTOR TO EXPIRATION DATE
1EB7 DATE FACTOR TO RIGHTS DATE
00 -> EMM END
;
; The bitmap -
; 0000800002000002000000100000200040004000210100004080242800000000
;
; selects cards in the group to which this update is to be applied.
; In this case the Filter (20) means that the bitmask contains a
; 256 bit mask. Each bit in each byte selects one of the possible
; cards in the group.
;
; In the above case card No,s 10, 26, 3e, 5b, 72, 81, 91, a2, a7, af,
; c1 ,c8, d2 ,d5 ,da and dc are selected for an update to the tier with
; an IDRight of 00DBD3 (Sky Movies 2,4,6,8,10).

These update Emm's are transmitted approximtely monthly. One Emm is transmitted for every possible tier to which at least one card in any particular group is subscribed to.

On TW there are about 11000 card groups and approx 30 different tiers so thats a lot of maintenance Emm's !

 

[john!]

usefull but afraid its beyond me nozzer

 

[davidh]

nice on m8
here is one though
when the cc's do a hit on a box the info gets sent to the box for a particular card
lets say a rom 10 with a cam number of 12 34 56 78

now if i have another rom 10 and i clone the cam to be same
12 34 56 78
and get a hit from the cc would that card take the hit putting details on the card ird bk etc??

making it a complete clone of the first card???

 

[nozzer]

nice on m8
here is one though
when the cc's do a hit on a box the info gets sent to the box for a particular card
lets say a rom 10 with a cam number of 12 34 56 78

now if i have another rom 10 and i clone the cam to be same
12 34 56 78
and get a hit from the cc would that card take the hit putting details on the card ird bk etc??

making it a complete clone of the first card???

No, because the Emm's are sent encrypted using PK1 keys just changing the CamId on a particular card would not be enough to allow decryption. Your clone card would have to have the correct PK1 keyset for that particular group !

If you opened the card before the initial hit and copied the complete image to an alternative card then your alternative would act exactly like the original. It would get set up with the same IRD/Boxkey and all tiers !

Unfortunately, the fact that it would get IRD/Boxkey overwritten means that it would be rejected by any alternative box although, in theory, you could prevent that relatively easily !

 

[nozzer]

Notice the dates on the monthly update command above.

When the tier is updated it updates for two months in the future. This means when it is updated next month that it still has a month to run. This means cards dont go off simply because they miss an update - they have a whole month of grace to accept the update Emm's

cards which are de-subscribed actually receive Emm's to physically remove the tiers meaning they are turned off usually within 24 hours.

So, if you could prevent your subbed card from receiving Emm's before stopping subscription then, in theory, you could continue to get free tv for upto 2 months !

 

[john!]

Notice the dates on the monthly update command above.

When the tier is updated it updates for two months in the future. This means when it is updated next month that it still has a month to run. This means cards dont go off simply because they miss an update - they have a whole month of grace to accept the update Emm's

cards which are de-subscribed actually receive Emm's to physically remove the tiers meaning they are turned off usually within 24 hours.

So, if you could prevent your subbed card from receiving Emm's before stopping subscription then, in theory, you could continue to get free tv for upto 2 months !

this is really above me .though i am interested but confused nozzer

So, if you could prevent your subbed card from receiving Emm's before stopping subscription then, in theory, you could continue to get free tv for upto 2 months

can this b done

 

[nozzer]

Yes, it can !

There used to be some devices around that blocked all Emm's from getting to the card.

 

[john!]

Yes, it can !

There used to be some devices around that blocked all Emm's from getting to the card.

can this info b explained in plain english 2 get my head around it i dont mind reading to learn

 

[nozzer]

can this info b explained in plain english 2 get my head around it i dont mind reading to learn

Not sure I can put it any plainer !

A few years ago there were some devices that plugged into a box card slot. The card then plugged into another slot on the end of the device.

The device monitored the data stream and simply prevented all Emm's from reaching the card. All other commands were allowed through unhindered.

Remember, this was in the days before keychanges, so it was quite possible to extend your viewing rights for a couple of months after your subscription had expired.

Its possible to do the same today but if there is a keychange then you would have to manually send the keychange Emm to the card in order for it to update.