INS7E for 092F

[dorinelul]

Hello Who can help me for Ins7e for this 092f coschip receiver

 

[dorinelul]

From my understanding is:

535517000000000300437E160 +
0000000 +
00010202030002020203

535517000000000300437E160000000000010202030002020203

is correct?

 

[rtznfrtz]

check with your BoxID (byte 9 - 12)

 

[dorinelul]

• 2022/11/04 13:20:05 412EF152 r (reader) ORANGE [internal] type: VideoGuard Dolce Romania (092F), caid: 092F
• 2022/11/04 13:20:05 412EF152 r (reader) ORANGE [internal] serial: 00028AED, BoxID: 80437E16, baseyear: 2004

5355170000000003 00437E16 0000000000010202030002020203

The first digit seem to be different
BOxid is obtain with oscam -S command

 

[Benfica200]

00437E16 xor 80000000=boxid

 

[dorinelul]

Hello, this means my Ins7e is correct in how I described above.?

 

[dorinelul]

• 2022/11/04 14:55:38 412EF152 r (reader) ORANGE [videoguard2] Decrypted payload
• 2022/11/04 14:55:38 412EF152 r (reader) C7 A4 04 C1 47 58 8C 71 00 00 00 9B 00 01 22 02
• 2022/11/04 14:55:38 412EF152 r (reader) 00 00 0E 02 01 00 0F 04 00 00 00 00 20 04 00 00
• 2022/11/04 14:55:38 412EF152 r (reader) 00 00 25 11 00 00 00 00 00 00 00 00 00 00 00 00
• 2022/11/04 14:55:38 412EF152 r (reader) 00 00 00 00 00 55 01 83 56 08 00 00 00 00 00 00
• 2022/11/04 14:55:38 412EF152 r (reader) 00 00
• 2022/11/04 14:55:38 412EF152 r (reader) ORANGE [videoguard2] classD3 ins54: CW is crypted, trying to decrypt unique pairing mode 0x83
• 2022/11/04 14:55:38 412EF152 r (reader) ORANGE [videoguard2] crypted CW is: C7A404C147588C710000000000000000
• 2022/11/04 14:55:38 412EF152 r (reader) ORANGE [videoguard2] k1 for unique pairing mode is not set
• 2022/11/04 14:55:38 412EF152 r (reader) ORANGE [videoguard2] cardreader_do_ecm: after csystem->do_ecm rc=0
• 2022/11/04 14:55:38 412EF152 r (reader) ORANGE [videoguard2] cardreader_do_ecm: ret rc=0
• 2022/11/04 14:55:38 412EF152 r (reader) ORANGE [videoguard2] cardreader_process_ecm: cardreader_do_ecm returned rc=0 (ERROR=0)

 

[dorinelul]

Hello All, can somebody ho help me if now Boxkey and ins7e is ok, also ecw and dcw form this log
Thanks

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] Answer from cardreader:

2022/11/06 17:50:16 359C27AD r (reader) 90 20

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] write to cardreader

2022/11/06 17:50:16 359C27AD r (reader) D3 54 00 00 52

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] Answer from cardreader:

2022/11/06 17:50:16 359C27AD r (reader) 09 89 7C B5 70 59 11 D6 51 74 06 E4 E8 84 ED D7

2022/11/06 17:50:16 359C27AD r (reader) F8 6C BB 7B A6 B0 86 35 99 EA 27 14 F2 4B EE 53

2022/11/06 17:50:16 359C27AD r (reader) 51 C9 1B A7 95 22 4F D9 A6 7B 84 5D 16 F1 E4 04

2022/11/06 17:50:16 359C27AD r (reader) 7E 37 A6 F5 8F 8A EA 5B ED 14 C4 24 B8 DC B7 AA

2022/11/06 17:50:16 359C27AD r (reader) 85 CE 11 DC 1B 9D 1B D3 F7 83 18 08 6E 8E 22 2A

2022/11/06 17:50:16 359C27AD r (reader) 16 E6 90 20

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] Decrypted payload

2022/11/06 17:50:16 359C27AD r (reader) AB 0E E8 00 07 B8 F7 8E 00 00 00 9B 00 01 22 02

2022/11/06 17:50:16 359C27AD r (reader) 00 00 0E 02 01 00 0F 04 00 00 00 00 20 04 00 00

2022/11/06 17:50:16 359C27AD r (reader) 00 00 25 11 00 00 00 00 00 00 00 00 00 00 00 00

2022/11/06 17:50:16 359C27AD r (reader) 00 00 00 00 00 55 01 83 56 08 00 00 00 00 00 00

2022/11/06 17:50:16 359C27AD r (reader) 00 00

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] classD3 ins54: CW is crypted, trying to decrypt unique pairing mode 0x83

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] crypted CW is: 0000000000000000AB0EE80007B8F78E

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] k1 for unique pairing mode is not set

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_do_ecm: after csystem->do_ecm rc=0

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_do_ecm: ret rc=0

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_process_ecm: cardreader_do_ecm returned rc=0 (ERROR=0)

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] Error processing ecm for caid 092F, provid 000000, srvid 012F, servicename: Viasat History

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] ecm hash: FD532E77D29B6AF019F16478794DB235 real time: 125 ms

2022/11/06 17:50:16 60A5D37F c (ecm) anonymous (092F&/012F/0517/012F/83:FD532E77D29B6AF019F16478794DB235.6F8D1943_000000000000000082F645BD7052BD7F HOP:00): found (237 ms) by nline_f34 (P/2/2/2) - Viasat History

2022/11/06 17:50:16 60A5D37F c (ecm) cw:

2022/11/06 17:50:16 60A5D37F c (ecm) 00 00 00 00 00 00 00 00 82 F6 45 BD 70 52 BD 7F

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_do_checkhealth: reader->card_status = 2, ret = 1

 

[007.4]

Yes, your INS7E appears correct.
However, obviously the dCW is not correct as you do not have the K1.

 

[dorinelul]

eCW is from my card at this moment without K1, but dCW is from an N card 092F paired already.

If Ins7, i eCW and dCW are correctly extracted here can somebody help me with K1 hash?

 

[machine]

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] classD3 ins54: CW is crypted, trying to decrypt unique pairing mode 0x83

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] crypted CW is: 0000000000000000AB0EE80007B8F78E

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] k1 for unique pairing mode is not set

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_do_ecm: after csystem->do_ecm rc=0

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_do_ecm: ret rc=0

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_process_ecm: cardreader_do_ecm returned rc=0 (ERROR=0)

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] Error processing ecm for caid 092F, provid 000000, srvid 012F, servicename: Viasat History

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] ecm hash: FD532E77D29B6AF019F16478794DB235 real time: 125 ms

2022/11/06 17:50:16 60A5D37F c (ecm) anonymous (092F&/012F/0517/012F/83:FD532E77D29B6AF019F16478794DB235.6F8D1943_000000000000000082F645BD7052BD7F HOP:00): found (237 ms) by nline_f34 (P/2/2/2) - Viasat History

2022/11/06 17:50:16 60A5D37F c (ecm) cw:

2022/11/06 17:50:16 60A5D37F c (ecm) 00 00 00 00 00 00 00 00 82 F6 45 BD 70 52 BD 7F

2022/11/06 17:50:16 359C27AD r (reader) ORANGE [videoguard2] cardreader_do_checkhealth: reader->card_status = 2, ret = 1


The ECM hashes match and your ECW is in red and DCW is in green.

Plenty of setups to rent on here for hashcat K1 calculation
Rent GPUs on Vast.ai

 

[007.4]

Only a K1 using DES can be brute-forced. I'm pretty sure we are dealing with 3DES here.

 

[dorinelul]

Hello, as I know:
in my case 092F is DES

CAID: 0907, 091F, 092B, 092F, 0944, 09AA, 09C4 = DES
CAID: 0911, 0927, 0952 098C, 098D, 09AF, 09BB, 09CD = 3DES

Does somebody else have other information?

 

[milosina]

wrong
09c4 after update is aes
091F after update is 3des

 

[dorinelul]

in my case is 092F

 

[schnucki]

Only a K1 using DES can be brute-forced. I'm pretty sure we are dealing with 3DES here.

I don't think it's a real 3 - DES
0F0400000000 <- similar to German V13
3DES with the same key
K1encrypt-K1decrypt-K1encrypt since the first two cancel each other out, you can shorten this to DES

56 08 00 00 00 00 00 00 00 00 <- is zero so I don't think AES

 

[007.4]

I agree it is certainly not using AES.
It may be using 3DES in single DES mode - the only way to find out would to BF the whole keyspace.
Hit = 3DES in single mode
No hit = real 3DES mode

 

[schnucki]

Unfortunately I still can't see the picture
what happens if you take the generic key from oscam?

boxid = E11809B5
ins7e = 4D00166000000000611809B50000000000010202030002020203
k1_generic = 86C1F1CB6DB59740 (V13)

 

[007.4]

The SkyDE generic key will be no use at all for the OP using his 092F card.

 

[schnucki]

the generic key is not only for Sky De