Could you guys help clear up some mosc info for me?

[KeepGood2006]

Hi guys,

Lately I've been fiddling with mosc's as I found an SA4200 in a cupboard and have read that fun's dont work in these boxes (I tried it anyway but had no joy). I've came close to bouncing the box/card/proggers off the wall a few times. I've been hunting through the forums for info but I'm still coming up short for info to fill in the gaps (gaps in my brain that is). I hoping some peeps more experienced in the subject can help out (it could be useful for others too).

Right, this is what I think I know and what I need to know...

A ROM card? ...

I know these are the cards that are used with stb's. I've examined NagraEdit and I understand (a good chunk of) the info the card holds. What I'm not sure about is how the card functions; like a funcard contains a CPU, RAM and Flash Storage, it runs the software stored in the flash nah nah nah. You get the idea. A rom card on the other hand, I have no idea how it functions. Any insight into this would be cool.

EMM's

From what I gather, these are commands sent in the datastream and intercepted/processed by the rom card?

Keys?

Data decryption keys used to decode the channel stream (audio/video). I see in NagraEdit there are public keys, parity keys, emm keys etc. Although I know the priniple of a decryption key, I'm not sure where each of these different keys come into effect (taking me back to not knowing the function of the device).

Teirs?

Now this one has been doing my nut in. From what I can see, teir info seems to hold some kind of subscription info for certain channels? What I dont understand is; with the above mentioned box I couldn't get a mosc to work so I phoned a mate who didn't have time to gabber on about how a mosc works but he did tell me I could manually enter the keys to get the box happening for the moment. At this point I did realise what a muppet I had been not even thinking to do that first (I've spent too much time with AU funs). I entered the public keys and bingo, all worked well (I understand when the keys roll I will need to manually update the keys again); what I dont understand is why all the channels work fine when there is only one 'standard teir' on the card? I'm seeing posts with peeps asking about adding teir info to their cards yet this card is allowing all the channels with only the one teir. Just incase I was tripping out my nut I grabbed another card and made a copy of the one thats working (changing the BK/IRD to match my box in the livingroom) and chucked it in the livingroom box and again, all channels work. So its now safe to say, I have no clue how the teir info on the card works lol.

AU?

Auto updating cards. Again with mosc's I'm not sure how this works. My brain is telling me an EMM will be sent down the line telling the card the keys are going roll, the new keys are updated, channels continue to work. Maybe something vaguely like that? lol What I'm wondering about is why the cards keys arent just updated anyway if the card is receiving the correct info whether you manually enter the keys or not. I'm not going to ask too much about this one at the moment as I think this will become clearer as I get more info about the device.

Locking cards?

I bought a glitcher for unlocking my card (damn with the cash I've spent on hardware for this it would've been much cheaper for me to nip down to the local trader and got him to do my box's, but hey, where is the fun in that ). How do the CC's lock a card?

Important card info?

What I mean by this is...I'm reading posts about cards being 'targetted' due to info on the card that isnt quite right. What is this targettable info? I can see date/time info being an obvious one but what else is hiding in that card?

Destroyed cards?

I've read about cards being killed by the CC. I'm wondering how this is done when the box 'should' only be able to communicate with the card (internally in the stb) by the standard that complies to the cards being used. Surelythe box shouldnt be able to physically damage the card? Perhaps the box can write to an area of the card that can stop the card going through its normal startup sequence (just a shot in the daqrk...I dont know how the card works yet lol).

ATR?

I see that when you are trying to communicate with a card, the card responds to the software with some info. I'm assuming this is the process of resetting/initialising the card? An attention command? More info on this would be good.


Right, I'm going to leave it at that for the moment. I've tried to keep the post as clear as I can. Feel free to correct me where I'm wrong and fill in the missing info.

With any luck this will cut down on stupid posts by me in the future lol.

Cheers guys

 

[speedy1234]

try this av done an au fun with this box worked fine http://www.digitalworldz.co.uk/forums/index.php?resources/1205/&act=down

 

[charlie senator]

A lot of questions there mate but maybe the most important one is the tiers if you only use one tier the cc will probably destroy the atr on the card so its best to try and make a tier list that closely matches a genuine card

 

[edcase]

Hi guys,

Lately I've been fiddling with mosc's as I found an SA4200 in a cupboard and have read that fun's dont work in these boxes (I tried it anyway but had no joy). I've came close to bouncing the box/card/proggers off the wall a few times. I've been hunting through the forums for info but I'm still coming up short for info to fill in the gaps (gaps in my brain that is). I hoping some peeps more experienced in the subject can help out (it could be useful for others too).

You want to know lots, thats a good thing but it would take far too long to explain this all here, so just some brief explanations is all you are going to get. The information is all out there but its many many hours of reading

Right, this is what I think I know and what I need to know...

A ROM card? ...

I know these are the cards that are used with stb's. I've examined NagraEdit and I understand (a good chunk of) the info the card holds. What I'm not sure about is how the card functions; like a funcard contains a CPU, RAM and Flash Storage, it runs the software stored in the flash nah nah nah. You get the idea. A rom card on the other hand, I have no idea how it functions. Any insight into this would be cool.

The rom card has its main cpu, hardcoded rom, ram, eeprom and a maths coprocessor. The eeprom (nagra image) contains the data area and codespace for patches to the rom code

EMM's

From what I gather, these are commands sent in the datastream and intercepted/processed by the rom card?

EMMs are the messages they send to the card, they can do anything that they want to the card with these! They use these to update the cards codespace to add new routines/functionality and also to add more security patches to lock us out etc. The keyrolls are also transmitted as an emm (so some are good some are bad). Fun/atmega cards will decrypt all global emms and compare them to a known keyroll, if it is a match it will extract the new keys. The rom card will just decrypt and execute the emm as it was intended. This is why new keyroll types knock off fun/atmega but not mosc cards but also why fun/atmega cards dont update and lock you out.

Keys?

Data decryption keys used to decode the channel stream (audio/video). I see in NagraEdit there are public keys, parity keys, emm keys etc. Although I know the priniple of a decryption key, I'm not sure where each of these different keys come into effect (taking me back to not knowing the function of the device).

Too much to go into here, basically you need the correct public keys to watch TV. You need the correct emm keys to decrypt emms. As the public keys come from emms you need the emm keys to decrypt the emm to get the public keys.

Teirs?

Now this one has been doing my nut in. From what I can see, teir info seems to hold some kind of subscription info for certain channels? What I dont understand is; with the above mentioned box I couldn't get a mosc to work so I phoned a mate who didn't have time to gabber on about how a mosc works but he did tell me I could manually enter the keys to get the box happening for the moment. At this point I did realise what a muppet I had been not even thinking to do that first (I've spent too much time with AU funs). I entered the public keys and bingo, all worked well (I understand when the keys roll I will need to manually update the keys again); what I dont understand is why all the channels work fine when there is only one 'standard teir' on the card? I'm seeing posts with peeps asking about adding teir info to their cards yet this card is allowing all the channels with only the one teir. Just incase I was tripping out my nut I grabbed another card and made a copy of the one thats working (changing the BK/IRD to match my box in the livingroom) and chucked it in the livingroom box and again, all channels work. So its now safe to say, I have no clue how the teir info on the card works lol.

Tiers or DataType08s (DT08) determine what level of subscription you have. Legit customers may have a tier that relates to a sports package/family package/porno or whatever. While it is possible to authorise all channels from 1 single DT08 the cable compaines know that none of their legit cards will look like this so it is something that they can target with a killer emm (like they have been doing since November).

AU?

Auto updating cards. Again with mosc's I'm not sure how this works. My brain is telling me an EMM will be sent down the line telling the card the keys are going roll, the new keys are updated, channels continue to work. Maybe something vaguely like that? lol What I'm wondering about is why the cards keys arent just updated anyway if the card is receiving the correct info whether you manually enter the keys or not. I'm not going to ask too much about this one at the moment as I think this will become clearer as I get more info about the device.

If you mosc card is not correctly updating the keys then it is not succesfully running the keyroll emm, either a blocker is blocking the emm or your emm decrypt keys are incorrect (probably a good thing if you are only using a single DT08 to open all channels - otherwise your card would be fryed!!!!!)

Locking cards?

I bought a glitcher for unlocking my card (damn with the cash I've spent on hardware for this it would've been much cheaper for me to nip down to the local trader and got him to do my box's, but hey, where is the fun in that ). How do the CC's lock a card?

EMMs again! Though there are ways to prevent a card from updating - again too much for here or I will be here all day lol

Important card info?

What I mean by this is...I'm reading posts about cards being 'targetted' due to info on the card that isnt quite right. What is this targettable info? I can see date/time info being an obvious one but what else is hiding in that card?

Loads and loads of things! Try to keep you card looking as much like a legit card or use a blocker (though the public blockers are not very good, the ones I have seen are badly coded and since they are in the public domain they are also easy targets.

Destroyed cards?

I've read about cards being killed by the CC. I'm wondering how this is done when the box 'should' only be able to communicate with the card (internally in the stb) by the standard that complies to the cards being used. Surelythe box shouldnt be able to physically damage the card? Perhaps the box can write to an area of the card that can stop the card going through its normal startup sequence (just a shot in the daqrk...I dont know how the card works yet lol).

They can perform checks on the card to see if its a legit one with an emm. If they decide it isnt then a further emm can add patches to codespace that are called from rom. They can add a patch that will just loop endlessly and go nowhere. This is essentially what they have been doing since November. The loop is added before the card fully starts up, way before the ATR is generated. The result is a deaf and blind card that cant do anything except sit in an endless loop.

ATR?

I see that when you are trying to communicate with a card, the card responds to the software with some info. I'm assuming this is the process of resetting/initialising the card? An attention command? More info on this would be good.

ATR is answer to reset. Any ISO7816 smartcard will do this when its reset line is toggled. It basically spits out some information about how it wants to communicate in the future. In the case of our cards it also tells us the card type and codespace revision level.

Right, I'm going to leave it at that for the moment. I've tried to keep the post as clear as I can. Feel free to correct me where I'm wrong and fill in the missing info.

With any luck this will cut down on stupid posts by me in the future lol.

No such thing as stupid posts, only stupid people lol

Cheers guys

Like I said there is loads and loads of info out there about these things, some of it is hard to find and/or hard to understand and sadly the majority of people couldnt care less about the technicalities as long as they get their free tv.

edc.

 

[maca]

nice reading m8

 

[KeepGood2006]

Fantastic response!!! Sorry I've not been around in a while so its taken until now for me to reply.

@speedy1234 Cheers mate. I'll have a look into that.

@edcase A VERY big thanks goes to ya. You have helped fill in alot of the gaps. I will now be able to take in alot more of the info spread around the forums.

The teir one was really doing my nut in as the card being used is an original and it only had the one teir on it although this card is going to from waaaaayyyy before November (just for the record, the card is still working to my surprise).

As for emm's, I can see whats happening now. Again, from your post I've managed to find alot more info on how rom cards/emm/decrypt keys work.

All I need to do now, is find out what an original card looks like then start reading til my eyes bleed.

I wont waste anymore time, I have reading to do

Thanks again guys, most appreciated.