Nagra Hex Block Decryption Research

[Benfica200]

How to see is it cap102?

All maxtv modul, block 016c is encrypted with FPK.

 

[rtznfrtz]

yes - i know - my block is at adress 0x20000

 

[rockenroller]

How to read that info from the cam?

 

[rtznfrtz]

open ci module read chip id (eg. cap102), desolder flash an read it with a suitable programmer

 

[rtznfrtz]

All maxtv modul, block 016c is encrypted with FPK.

you know what type of encryption is used?

 

[adas]

You have 166MHz on the bus, so you probably know what to do.

Cau Adas

 

[schwarzekatze]

you know what type of encryption is used?

man FPK is complete bullshit 016c is decrypted by key from cap102 cpu in ci+ , fpk could be just des used for encrypt/decrypt spi flash content

 

[Benfica200]

man FPK is complete bullshit 016c is decrypted by key from cap102 cpu in ci+ , fpk could be just des used for encrypt/decrypt spi flash content

Only spi flash and des?! Lol
You are kidding!

 

[rtznfrtz]

holy cow - so that's making it really easy and selfdeclaring now

 

[schwarzekatze]

Only spi flash and des?! Lol
You are kidding!

right it is just des used for nor flash otp sector lock/unlock from many year

 

[electron112]

I have problems with a sti 7101 maybe someone can help on this
(open console)

 

[silvermindphasar]

Here in Italy we have tivusat, an Italian company that uses smartcards with nagravision3 and related nagravision3 certified decoders with their own brand. We cannot use the nagravision3 smartcard in other Linux decoders with emulator, which are not certified by them. The smartcard does not work with the emulator in Linux decoders such as Dreambox or others. if we don't have their nagravision3 decoders certified by them with the corresponding nagravision3 smartcard, we don't see the channels. it's possible that these certified nagravision3 have some kind of hardware fingerprint?

 

[schnucki]

Tivu Sat Block 0180
what is the key 50 04 and FE 0C ?


20 08 XX XX XX XX XX XX XX XX
30 08 XX XX XX XX XX XX XX XX
31 40 X7 XX XX XX ....... XX XX XX X6 XF XF
33 10 XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
34 60 X5 XX XX ... .. .. .. .XX XX X6
35 88 X3 XC XX XX XX ... XX XX XX X8
50 04 XX XX XX XX | ???
D0 08 XX XX XX XX XX XX XX XX
E0 02 00 01
FE 0C XX XX XX XX XX XX XX XX XX XX XX XX | ???
A4 40

 

[electron112]

great and big question

 

[electron112]

have same problem

 

[schnucki]

Have you ever had a box with 2 x NUIDs?

 

[Benfica200]

Waste time with this!
Focus on another place...

 

[schnucki]

I'm looking for the "DT06 expand" and "DT08" tool, can someone provide me with it?

Thank you very much.

 

[jor]

Digging I have found just DT08 tool but not the DT06 expand ...

 

[schnucki]

DT06 how is this key expanded?
Are the few bytes all calculated with an exponent/modulo or how do you do that? All statements refer to a tool that no longer seems to exist.