Just wondering how a box takes a hit in the setup process and if it's like a series of commands that are sent to the box? Reason i'm asking is would it be possible to say fake this with a program for a 2110 or V+ box or any other box for that matter to enable details to be retrieved from box? Or am I way overboard on my thoughts? I know on some boxes we can interface with them via Jtag or serial port but surely this initial hit is done via the coax input?And could the hit be logged to see what is happening?
Basically, when the box is installd the engineer rings up Virgin central and gives the box serial No (IRD No) and the card serial No (CamId No). The operator at virgin types these into their computer and this then looks up the corresponding boxkey for the IRD No, and the group private keyset for the CamId No from a database. An Emm is then encrypted using the private keyset, which contains a command to set the boxkey on the card, along with the boxkey data and IRD No data (some providers set the IRD to the card using a seperate Nagra command). The Emm is then placed into the Emm datastream.
Sometime later, the stb will see an Emm that has been sent out for the particular card in its slot (The Emm will be prefixed with the CamId of the card so the box knows its for that particular card. The box ignores 99% of Emm's because they are for other cards). The box will then pass the Emm onto the card.
The card should be the only card in existance that can decrypt and act on the Emm. Once acted upon the card will know the boxkey of the particular box it is connected to. It may also know the IRD No of the box, in which case it is then "married" to that box or this may come in a sperate command slightly later.
At no time does the box itself disclose its boxkey to either the card or to Virgin. Everything is done through data already held on Virgins database.
After this hit other Emm's will be sent to the card, using a similar mechanism to that already described, which put the required package tiers and other information (like the present video decrypt keys) onto the card. At that point your newly hit box should start getting pictures !
There is no way to fake this information into a 2110 or any other box because the box itself does little of the work. It simple acts as a messenger. The boxkey is encrypted and sent out by virginmedia (the box already knows its boxkey - this is permenant and part of its firmware).
The hits have been logged and are well understood - unfortunately, each hit is unique to a particular box/card pairing and as we dont know the master encryption keyset, there is no way we can generate similar Emm's for other box/card pairings. We also dont have access o the boxkey database so wouldn't know what information to send out anyway !
