Nagra Hex block Decryption

terrestrial · Feb 26, 2018

kS1k1mod1 XOR kS1k1mod2 perhaps?

onsitbin · Feb 26, 2018

HI Supermoderador delit my post ?

EI'm seeing what you're worried about ??

to finish once and for all of the PAYSERVERS who are here infiltrated

Benfica200 · Feb 26, 2018

onsitbin said:
to inform that this key is only found in the STB ram, and with the card there, if they remove the card, this key disappears, the origin of the key is found in the (stlinux in .rodata) or in Os21 SH40 in the flash nor in cak7, coming from a xor between two keys I just see people here who do not want to study, I'm sorry.
Tankyou

LOL, what nonsense, mod2 is found in the ram too that I know 3411(HD+) does not use yet...
if we go for this logic...

viperx32cwpk · Feb 26, 2018

HI Supermoderador delit my post ?

EI'm seeing what you're worried about ??

onsitbin said:
HI Supermoderador delit my post ?

It seems so, someone gave him elbow pain.

viperx32cwpk · Feb 26, 2018

Benfica200 said:
LOL, what nonsense, mod2 is found in the ram too that I know 3411(HD+) does not use yet...
if we go for this logic...
And already ram dumps that said key is not even there!

MAN

This has now come from selling Eggs from Peru from the Hypermarket
use only a nickname and not these
sambas68, benfica200, NK, etc

ahahahahahhaahah

terrestrial · Feb 26, 2018

onsitbin, It looks like you found nano 01 keys for several providers, i can't be 100% sure because you didn't post the one for M7 but one thing is certain. Your keys are NOT used for decrypting the ecwpk into the dcwpk!

What you posted before about the mod1, mod2 and data88_generic is all great, but you left the most important part out. key1 = univeral, key3 = universial and you can find them in every receiver.. But how does one find the exact position of key 2 and 4 ?

Benfica200 · Feb 26, 2018

viperx32cwpk said:
MAN

This has now come from selling Eggs from Peru from the Hypermarket
use only a nickname and not these
sambas68, benfica200, NK, etc

ahahahahahhaahah

I saw you're a child....
you do not have arguments.

I'm still waiting for you to give me the mods of Help_I'm_dead.

onsitbin · Feb 26, 2018

terrestrial said:
NOT used for decrypting the ecwpk into the dcwpk!

Yes, according to you, but they do other things.

braza · Feb 26, 2018

SysId or nagra keyladder session key 3 ? and now ?

/**
Summary:
This struct defines the encrypted session structure.

Description:
This structure contains the information necessary to generate the
Session Key which is Key3 in BRCM terminology.
**/
typedef struct NEXUS_SecurityEncryptedKey3

and final stage

/**
Summary:
This struct defines the encrypted control word (CW) structure.

Description:
This structure contains the information necessary to generate the
control word which is Key4 in BRCM terminology.
**/
typedef struct NEXUS_SecurityEncryptedKey4
{

viperx32cwpk · Feb 26, 2018

Benfica200 said:
I saw you're a child....
you do not have arguments.

I'm still waiting for you to give me the mods of Help_I'm_dead.

man
You are accustomed to shuffling the dumps, you are an artist of the Tagus, look I gave in private to the propretário that is here in the forum I gave you all the detailed information, and who passed me the correct dump, and I do not you that abuses in manipulating the dumps and remove the most important parts, you are a magnum..

(Help_I'm_dead) Ajuda eu estou morto, á muito e obsoleto,

hihihihihi
ps:. talk to #dognaldo, he tells you a story

Benfica200 · Feb 26, 2018

viperx32cwpk said:
man
You are accustomed to shuffling the dumps, you are an artist of the Tagus, look I gave in private to the propretário that is here in the forum I gave you all the detailed information, and who passed me the correct dump, and I do not you that abuses in manipulating the dumps and remove the most important parts, you are a magnum..

(Help_I'm_dead) Ajuda eu estou morto á muito, hihihihihi

I've already seen that you need to study more.
copy and paste does not work on that file...

onsitbin · Feb 26, 2018

braza said:
SysId or nagra keyladder session key 3 ? and now ?

/**
Summary:
This struct defines the encrypted session structure.

Description:
This structure contains the information necessary to generate the
Session Key which is Key3 in BRCM terminology.
**/
typedef struct NEXUS_SecurityEncryptedKey3

and final stage

/**
Summary:
This struct defines the encrypted control word (CW) structure.

Description:
This structure contains the information necessary to generate the
control word which is Key4 in BRCM terminology.
**/
typedef struct NEXUS_SecurityEncryptedKey4
{

Brasa, já te mandei várias pm, e tu sabes do que eu estou a falar, se queres discutir a sério sobre esse operador do teu Pais eu falo contigo na boa, mas não mistures alhos, com bugalhos por favor.

Sorry to speak with this friend in Portuguese but he forgets quickly, with whom he talked for at least two years
sorry sorry

braza · Feb 26, 2018

Vc tem algum programa privado pro bcm df72xxxxxxxxxxx extrair chaves privadas otpkeyA or B o C, nocs privado ou algo pra extrair a secret content key ?
Vc tem uma keyladder ?
Posso executar qualquer coisa no bcm ( telnet rs232 ).

hmac_sha256.. how to 00 00 00 00 checksun = SCK .. SKC = opt a b c ?

terrestrial · Feb 26, 2018

onsitbin said:
Yes, according to you, but they do other things.

sure, ofcourse every key has a function. But your 2nd picture (one page back) suggests the 3des calculation is using the same key in every receiver. That is not the way the keyladder works.

onsitbin · Feb 26, 2018

braza said:
Vc tem algum programa privado pro bcm df72xxxxxxxxxxx extrair chaves privadas otpkeyA or B o C, nocs privado ou algo pra extrair a secret content key ?
Vc tem uma keyladder ?
Posso executar qualquer coisa no bcm ( telnet rs232 ).

hmac_sha256.. how to 00 00 00 00 checksun = SCK .. SKC = opt a b c ?

Tu sabes bem o que eu tenho, sources etc, se queres algo tens pm á muito, parece que ao entrar nao encontras uma chamada de atenção que tens pm verifica melhor isso.
abraço
foi Dormir

Good Night to all

onsitbin · Feb 26, 2018

Brasa parece que e tipo isto que, te fundamente certo?

Brasa looks like it's kind of like that, right?

key3.keyladderID = NEXUS_SecurityKeyladderID_eA;
key3.keyladderType = NEXUS_SecurityKeyladderType_e3Des;
switch (keyladder_data->rootkey_src) {
case bcrypto_rootkey_cust_key:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eCuskey;
break;
case bcrypto_rootkey_otp_a:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eOtpKeyA;
break;
case bcrypto_rootkey_otp_b:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eOtpKeyB;
break;
case bcrypto_rootkey_otp_c:
key3.rootKeySrc = NEXUS_SecurityRootKeySrc_eOtpKeyC;
break;
default:
BDBG_ERR(("b_keyslot_m2m_allocate: Unsupported keyladder root key source"));
goto error_keyslot;

onsitbin · Feb 26, 2018

* root key generation
*/
typedef enum BCMD_RootKeySrc_e
{
BCMD_RootKeySrc_eCusKey = 0,
BCMD_RootKeySrc_eOTPKeya = 1,
BCMD_RootKeySrc_eOTPKeyb = 2,
BCMD_RootKeySrc_eOTPKeyc = 3,
BCMD_RootKeySrc_eOTPKeyd = 4,
BCMD_RootKeySrc_eOTPKeye = 5,
BCMD_RootKeySrc_eOTPKeyf = 6,
BCMD_RootKeySrc_eReserved0 = 7,
BCMD_RootKeySrc_eReserved1 = 8,
BCMD_RootKeySrc_eReserved2 = 9,
BCMD_RootKeySrc_eMax
}BCMD_RootKeySrc_e;

/*
* key ladder root key destination enum used for key ladder
* root key generation
*/
typedef enum BCMD_GenRootKeyDest_e
{
BCMD_GenRootKeyDest_eReserved0 = 0,
BCMD_GenRootKeyDest_eReserved1 = 1,
BCMD_GenRootKeyDest_eReserved2 = 2,
BCMD_GenRootKeyDest_eReserved3 = 3,
BCMD_GenRootKeyDest_eMax
}BCMD_GenRootKeyDest_e;

/* Virtual Key ladder ID */
typedef enum BCMD_VKLID_e
{
BCMD_VKL0 = 0, /* Virtual Key Ladder 0 */
BCMD_VKL1 = 1, /* Virtual Key Ladder 1 */
BCMD_VKL2 = 2, /* Virtual Key Ladder 2 */
BCMD_VKL3 = 3, /* Virtual Key Ladder 3 */
BCMD_VKL4 = 4, /* Virtual Key Ladder 4 */
BCMD_VKL5 = 5, /* Virtual Key Ladder 5 */
BCMD_VKL6 = 6, /* Virtual Key Ladder 6 */
BCMD_VKL7 = 7, /* Virtual Key Ladder 7 */

BCMD_VKLDummy = 8,
BCMD_VKL_KeyRam_eMax = 8, /* Max of VKL ram FW supported */
BCMD_VKLID_eSecureCWKey = 8, /* Secure CW key source, used by FW code only */
/* Reserve 7-0x1F for future VKL expand */
BCMD_VKLID_eSWKey = 0x10, /* SW key source */
BCMD_VKLReserved17 = 0x11,

BCMD_VKLReserved18 = 0x12,
BCMD_VKLReserved19 = 0x13,
BCMD_VKLReserved20 = 0x14,

BCMD_VKL_eMax
}BCMD_VKLID_e;

/*
* key ladder key source/destination enum used for key ladder
* non-root key generation from key3 - key5
*/
typedef enum BCMD_KeyRamBuf_e
{
BCMD_KeyRamBuf_eReserved2 = 0,
BCMD_KeyRamBuf_eReserved3 = 1,
BCMD_KeyRamBuf_eReserved4 = 2,

BCMD_KeyRamBuf_eKey3 = 3, /* key3 */
BCMD_KeyRamBuf_eKey4 = 4, /* key4 */
BCMD_KeyRamBuf_eKey5 = 5, /* key5 */

BCMD_KeyRamBuf_eReserved0 = 6,
BCMD_KeyRamBuf_eReserved1 = 7,

BCMD_KeyRamBuf_eFirstRam = 8, /* FW internal 192 bit user key ram, not used by host */
BCMD_KeyRamBuf_eMax

}BCMD_KeyRamBuf_e;

/* swizzle type supported*/
typedef enum BCMD_SwizzleType_e
{
BCMD_SwizzleType_eNoSwizzle = 0,
BCMD_SwizzleType_eSwizzle1 = 1,
BCMD_SwizzleType_eSwizzle0 = 2,
BCMD_SwizzleType_eMax
}BCMD_SwizzleType_e;

dognaldo · Feb 27, 2018

viperx32cwpk said:
man
ps:. talk to #dognaldo, he tells you a story

I think i missed something. I did not understand anything.

onsitbin · Feb 27, 2018

dognaldo said:
I think i missed something. I did not understand anything.

What do not you understand? see mp

Micha_123 · Feb 27, 2018

who can help me with cas7-helper.c and cas7-helper.h

i have an source vor HD03/04 but it Need Cas7-helper, anyone can help me with it ?

Nagra Hex block Decryption

Inactive User

Member ++

DW Member ++

DW Member ++

DW Member ++

Inactive User

DW Member ++

Member ++

Member

DW Member ++

DW Member ++

Member ++

Member

Inactive User

Member ++

Member ++

Member ++

Member ++

Member ++

Inactive User

Similar threads

We value your privacy