Nagra Hex block Decryption

[SilliconBastard]

What cable provider are we talking about?

A very big cable provider in The Netherlands, having an big orange logo. Very easy to find. No names, no lawsuits.

[...] but ci+ you can only extract 16c nothing more.

Is this enough for extracting the RSA/Boxkey?

If it is possible, I will get a CI+ module and post a picture of the mainboard.

 

[Benfica200]

A very big cable provider in The Netherlands, having an big orange logo. Very easy to find. No names, no lawsuits.



Is this enough for extracting the RSA/Boxkey?

If it is possible, I will get a CI+ module and post a picture of the mainboard.

You may have the bad luck of block 016c being encrypted by FPK!

 

[bccrew]

CAMs by Sm*t and Sm*rDTV are definitely crypted. Decryption key in inside CPU area. Impossible of dumping RAM because of obfusciation of keys. Every reset of CAM will give other results. Many have tried and many have failed

 

[SilliconBastard]

CAMs by Sm*t and Sm*rDTV are definitely crypted. Decryption key in inside CPU area. Impossible of dumping RAM because of obfusciation of keys. Every reset of CAM will give other results. Many have tried and many have failed

Isn't that the point of desoldering the Atmel (CPU) chip and using the BusPirate to read it out? At least, that's what I understand. There are also people who claim they can decrypt the 016c block, but I don't know if that's true.

 

[adas]

@SilliconBastard

You mean this CI+?

Cau Adas

 

[SilliconBastard]

@SilliconBastard

You mean this CI+?

Cau Adas

Yes.

I contacted my cable provider, in my region they only use Sm*rDTV CI+ modules. I can confirm this, just asked a neighbour to have a look at their module.

What's the abbreviation of this so-called FPK?

 

[Benfica200]

Yes.

I contacted my cable provider, in my region they only use Sm*rDTV CI+ modules. I can confirm this, just asked a neighbour to have a look at their module.

What's the abbreviation of this so-called FPK?

FPK-Flash Protection Key

 

[adas]

Dump will do it soon, certainly the same hardware as NC +, HD +, Polsat CI+.

Reading block 16c and 97 is possible.

Cau Adas

 

[klivo]

Dump will do it soon, certainly the same hardware as NC +, HD +, Polsat CI+.

Reading block 16c and 97 is possible.

Cau Adas

heh .. who this speak ? i see you copy from this forum to pšonko forum some wolds as FPK etc.. is good if you some learning, oszuste

BTW: maybe you not understand what is block 016c is "crypted"

 

[SilliconBastard]

So in short, when you have a Sm*rDTV with internal encryption, you're pretty much out of luck?

Or are there - maybe complicated - ways to grab this FPK? Remember, desoldering components is not a problem.

Edit: Just wondering, how tough is this internal encryption? What protocol is used? Would it be possible to decrypt this encrypted blocks using bruteforce within a reasonable amount of time with current mainstream hardware? My gut feeling says no...

 

[XIL1NX]

Tough enough to not be bf'ed or some other BS which could be done with amateur grade gear.
Here u got the proper reply too all those fools thinkin discussing and publishing in the public forums wouldn't be a big deal and we can make it all open source to help each other .. bla bla bla
Now you gotta live with it ... IDEA CTR shit is over

 

[SilliconBastard]

Tough enough to not be bf'ed or some other BS which could be done with amateur equipment or "soldering".

No surprise brute force isn't possible. Of course this FPK can't be extracted using 'soldering', it's more like the first step to things like hardware analysis. But I was wondering if there are easier ways I missed to extract it.

 

[klivo]

No surprise brute force isn't possible. Of course this FPK can't be extracted using 'soldering', it's more like the first step to things like hardware analysis. But I was wondering if there are easier ways I missed to extract it.

hmm, better for you as ask is read some... For example if is maybe used AES key for this (where can be as one variant) i find for you one page: Can someone randomly guess the key to AES 256 bit encryption?

 

[Benfica200]

No surprise brute force isn't possible. Of course this FPK can't be extracted using 'soldering', it's more like the first step to things like hardware analysis. But I was wondering if there are easier ways I missed to extract it.

FPK decrypt global flash protection key(on cicam It seems to be 2DXXX...), the rest I do not know...

 

[bccrew]

This is where the magic happens

 

[dognaldo]

This is where the magic happens

Ohhhhh............ will change my life !
(just have a sense of humor)

 

[adas]

Ziggo r.1.2

Cau Adas

 

[electron112]

your ci work with card or not ?

 

[XIL1NX]

No the smartcard insertion logo printed on the label is just for fun
Good lord ....

And yes its possible to get the keys from encrypted smartdtv modules. But again i repeat myself: not with a soldering station or spi programmer

 

[electron112]

good luck man
you are entering in a hardest work