dsmart K1 & K2 help

[kadir126]

i need help with my NDS dsmart 092B from Turksat 42,0e
i have card+Modul need help with Keys for Oscam
pls can any body help?
Thanks in advance

 

[kadir126]

i dont know why you laugh ?
But is no more important i did it and 1 very nice full Guy from Board Help me

 

[gattuso]

@kadir126 can you send me pm?

 

[XIL1NX]

great, publish it and very soon d-smart will introduce card killing again

 

[kadir126]

who say that i Publish?
I ask looong Time ago here for Help me and you laugh !!!
instead of helping ...whatshappen now and you Comment my Statement?
Dont worry im not Stupid to publish anything
I have more things in Stock

 

[gattuso]

@kadir126 can you pm me. I am not interested in dsmart. Maybe you can help others now

 

[machine]

Can anybody help me with a D-Smart card please? I am in the same situation as kadir126

 

[Benfica200]

Can anybody help me with a D-Smart card please? I am in the same situation as kadir126

NDS Card / Oscam - classD3 ins54: no cw --> Card needs pin

 

[machine]

Okay I think I have made some progress on this.
I have my boxid and ins7e data.

I have a share of this card which works with breaks as high ecm times.
But I think I have what I need for hashcat now from the log below
My crypted CW in orange and the share decrypted one further down
The same ecm hash in green for both?

Could somebody confirm this for me please?

(reader) D-Smart [videoguard2] Decrypted payload
2020/11/10 19:11:04 5B61BC76 r (reader) AB F7 DE 83 35 48 97 4C 00 00 14 B6 02 01 22 02
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00 0E 02 02 00 0F 04 00 00 00 00 20 04 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00 25 11 00 00 00 00 00 00 00 00 00 00 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00 00 00 00 55 01 83 56 08 00 00 00 00 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] classD3 ins54: CW is crypted, trying to decrypt unique pairing mode 0x83
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] crypted CW is:
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] k1 for unique pairing mode is not set
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_do_ecm: after csystem->do_ecm rc=0
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_do_ecm: ret rc=0
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_process_ecm: cardreader_do_ecm returned rc=0 (ERROR=0)
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] Error processing ecm for caid 092B, provid 000000, srvid 076E, servicename: S SPORT2
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] ecm hash: real time: 109 ms
2020/11/10 19:11:04 41FC4AD3 p (reader) casc ecm (dmsart-share):
2020/11/10 19:11:04 41FC4AD3 p (reader) 80 70 6B 00 00 01 0E CA 0A 99 5C 03 86 AA 55 15
2020/11/10 19:11:04 41FC4AD3 p (reader) 20 01 00 00 96 58 7E 0A 70 D1 D7 F7 D4 B4 C4 F7
2020/11/10 19:11:04 41FC4AD3 p (reader) 00 00 90 4A C0 01 27 BB 14 DE 81 AB 44 36 F2 C7
2020/11/10 19:11:04 41FC4AD3 p (reader) 3D 70 0C 2E 66 A1 56 F5 0F EC AA 2B F5 CB 9D 22
2020/11/10 19:11:04 41FC4AD3 p (reader) E6 C7 22 6D 84 91 EB B0 C3 5A 14 F0 93 E6 00 9F
2020/11/10 19:11:04 41FC4AD3 p (reader) 23 F0 1B 61 DF AE 80 A4 D3 5E 5F EF 96 9A 6F 42
2020/11/10 19:11:04 41FC4AD3 p (reader) E0 22 40 1A C9 5C 3C 06 37 81 1B 1B 38 17
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam: ecm trylock: got lock
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam: ecm-task 17
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: sending ecm for sid 076E(110) to card 0003972d, hop 3, ecmtask 17
2020/11/10 19:11:04 172E88C1 r (reader) emulator [emu] cardreader_do_checkhealth: reader->card_status = 2, ret = 1
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_do_checkhealth: reader->card_status = 2, ret = 1
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: parse_msg=1
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: cws: 17 107974FD9CF141CE0000000000000000
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam: ecm trylock: got lock
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: no ecm pending!
2020/11/10 19:11:04 06F90294 c (ecm) dvbapiau (092B@000000/0386/076E/6E:6FB030960F7311C43923D1FE4A28BEB8): found (711 ms) by dmsart-share (P/2/2/2) - S SPORT2
2020/11/10 19:11:04 06F90294 c (ecm) cw:
2020/11/10 19:11:04 06F90294 c (ecm)

 

[rtznfrtz]

yes, now set the cat free

 

[machine]

Thank you 'rtznfrtz' is this the correct format for hashcat?
I have a 1060 6GB I can give this a try on and see how it goes

hashcat -m 14000 -o /root/key1.txt -a 3 -1 /usr/share/hashcat/charsets/DES_full.charset --hex-charset ?1?1?1?1?1?1?1?1 -w 4 --force

 

[rtznfrtz]

yes, only eCw:dCw --> (path depends on your setup), you might want to use -w 4 --outfile-format 5

 

[machine]

Thank you, I will set this off later today and see how it goes.

 

[machine]

Result, a few days later and just over 82% the mouse was caught

Thank you to all for the help and pointers

 

[rtznfrtz]

great to hear you got it all set

 

[intermedya]

same body help me for dsmart module

 

[intermedya]

2021/05/10 09:44:19 4DEFB142 r (reader) dsmart [internal] ATR: 3F FF 14 25 03 10 80 41 B0 01 69 FF 4A 50 70 00 00 5A 48 01 00 00
2021/05/10 09:44:20 4DEFB142 r (reader) dsmart [internal] Card type: ZHTV
2021/05/10 09:44:20 4DEFB142 r (reader) dsmart [internal] Rom version: 10A1
2021/05/10 09:44:20 4DEFB142 r (reader) dsmart [internal] Credit available on card: 0 euro
2021/05/10 09:44:20 4DEFB142 r (reader) dsmart [internal] No TA1 change for this card is possible by ins7E11
2021/05/10 09:44:20 4DEFB142 r (reader) dsmart [internal] FuseByte: 25
2021/05/10 09:44:20 4DEFB142 r (reader) dsmart [internal] Region Code: TR034002
2021/05/10 09:44:20 4DEFB142 r (reader) dsmart [internal] Country Code: TUR
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [internal] Pincode read: 0000
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [internal] PCB settings: FF FF 0 0
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [internal] type: VideoGuard DSMART Turkey, caid: 092B
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [internal] serial: ########, BoxID: ########, baseyear: 2004
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [internal] ready for requests
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [internal] found card system videoguard2
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] THIS WAS A SUCCESSFUL START ATTEMPT No 1 out of max allotted of 1
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] card detected
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] type: VideoGuard DSMART Turkey
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] ------------------------------------------------------------------
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] |- class -|-- tier --|----- valid to ------|--- package name ----|
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] +---------+----------+---------------------+---------------------+
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] |-- 0f ---|-- 0ff3 --| 2021/06/23-00:00:30 |
2021/05/10 09:44:21 4DEFB142 r (reader) dsmart [videoguard2] ------------------------------------------------------from-ins70--
2021/05/10 09:44:21 00000000 s (main) init for all local cards done

 

[guli]

Okay I think I have made some progress on this.
I have my boxid and ins7e data.

I have a share of this card which works with breaks as high ecm times.
But I think I have what I need for hashcat now from the log below
My crypted CW in orange and the share decrypted one further down
The same ecm hash in green for both?

Could somebody confirm this for me please?

(reader) D-Smart [videoguard2] Decrypted payload
2020/11/10 19:11:04 5B61BC76 r (reader) AB F7 DE 83 35 48 97 4C 00 00 14 B6 02 01 22 02
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00 0E 02 02 00 0F 04 00 00 00 00 20 04 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00 25 11 00 00 00 00 00 00 00 00 00 00 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00 00 00 00 55 01 83 56 08 00 00 00 00 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) 00 00
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] classD3 ins54: CW is crypted, trying to decrypt unique pairing mode 0x83
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] crypted CW is:
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] k1 for unique pairing mode is not set
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_do_ecm: after csystem->do_ecm rc=0
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_do_ecm: ret rc=0
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_process_ecm: cardreader_do_ecm returned rc=0 (ERROR=0)
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] Error processing ecm for caid 092B, provid 000000, srvid 076E, servicename: S SPORT2
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] ecm hash: real time: 109 ms
2020/11/10 19:11:04 41FC4AD3 p (reader) casc ecm (dmsart-share):
2020/11/10 19:11:04 41FC4AD3 p (reader) 80 70 6B 00 00 01 0E CA 0A 99 5C 03 86 AA 55 15
2020/11/10 19:11:04 41FC4AD3 p (reader) 20 01 00 00 96 58 7E 0A 70 D1 D7 F7 D4 B4 C4 F7
2020/11/10 19:11:04 41FC4AD3 p (reader) 00 00 90 4A C0 01 27 BB 14 DE 81 AB 44 36 F2 C7
2020/11/10 19:11:04 41FC4AD3 p (reader) 3D 70 0C 2E 66 A1 56 F5 0F EC AA 2B F5 CB 9D 22
2020/11/10 19:11:04 41FC4AD3 p (reader) E6 C7 22 6D 84 91 EB B0 C3 5A 14 F0 93 E6 00 9F
2020/11/10 19:11:04 41FC4AD3 p (reader) 23 F0 1B 61 DF AE 80 A4 D3 5E 5F EF 96 9A 6F 42
2020/11/10 19:11:04 41FC4AD3 p (reader) E0 22 40 1A C9 5C 3C 06 37 81 1B 1B 38 17
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam: ecm trylock: got lock
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam: ecm-task 17
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: sending ecm for sid 076E(110) to card 0003972d, hop 3, ecmtask 17
2020/11/10 19:11:04 172E88C1 r (reader) emulator [emu] cardreader_do_checkhealth: reader->card_status = 2, ret = 1
2020/11/10 19:11:04 5B61BC76 r (reader) D-Smart [videoguard2] cardreader_do_checkhealth: reader->card_status = 2, ret = 1
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: parse_msg=1
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: cws: 17 107974FD9CF141CE0000000000000000
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam: ecm trylock: got lock
2020/11/10 19:11:04 41FC4AD3 p (cccam) cccam(r) dmsart-share: no ecm pending!
2020/11/10 19:11:04 06F90294 c (ecm) dvbapiau (092B@000000/0386/076E/6E:6FB030960F7311C43923D1FE4A28BEB8): found (711 ms) by dmsart-share (P/2/2/2) - S SPORT2
2020/11/10 19:11:04 06F90294 c (ecm) cw:
2020/11/10 19:11:04 06F90294 c (ecm)

how did you work out the ins7e pal would you share your experience .

 

[machine]

You need to follow read through this other thread about v13 German card. The process is the same
Here

 

[guli]

yes ive read that many times pal but i log the emm's but cant find what im looking for . been trying over a month now .