Nagra Hex block Decryption

[fes_786]

Nice links and interesting stuff

Will have a proper read through it soon

Cheers

 

[andy16v]

@ Trojan box empty

 

[XIL1NX]

Bloc 000097 new paring nagra/merlin cak7, Country Chile South America




CAK VERSION R-BALAE-ADFBN-----South America provide



Cwpk active is 03 = 04 number off 05 Cwpk Key crypted


Tanks KubLinux

Absolutely worthless information ... but keep going

You provider VM UK already made changes , in future stb your flash inlcuding your 016c block will be chipset encrypted, so you wont get any pairingdata at all. But thats always gonna happen if people make a lot of bla bla in public.

And if they wanna kick the existing cards as well they simply disable DT08 sessionkey neogatiation like done on german smartcard generation.

 

[Tr0jan]

Absolutely worthless information ... but keep going

You provider VM UK already made changes , in future stb your flash inlcuding your 016c block will be chipset encrypted, so you wont get any pairingdata at all. But thats always gonna happen if people make a lot of bla bla in public.

And if they wanna kick the existing cards as well they simply disable DT08 sessionkey neogatiation like done on german smartcard generation.

It's already started the 016C block is encrypted in the Samsung_Tivo box and yes they can disable DT08 session-key negotiation. And for all these ones that say they can't do it on vm because certain models of boxes don't/can/t take the new encrypten then just look at certain s.a providers that imply it.

tr

 

[fr3n2y]

@ Trojan box empty

Andy, your inbox is full. Mine was also full, I already removed some messages

Please, reply my last pm

Thanks

Enviado desde mi D5803 mediante Tapatalk

 

[andy16v]

message box emptied

 

[dognaldo]

empty your pm's Andy

 

[dognaldo]

Hi All
I learn 016c header and would like to try 9882.
Some good soul have some dump with 9882 header to study?

[ ] ´s

 

[andy16v]

@ dognaldo empty

 

[fr3n2y]

Hi All
I learn 016c header and would like to try 9882.
Some good soul have some dump with 9882 header to study?

[ ] ´s

I'm also interested in some 9882 dump to study.

Regards

 

[Tr0jan]

9882=1001.1000.1000.0010 bin
016C=0000.0001.0110.1100 bin


16 15 14 13-12 11 10 9-8 7 6 5-4 3 2 1

swap:
1 <---> 5
2 <---> 6
3 <---> 16
4 <---> 8
7 <---> 12
9 <---> 13
10 <---> 14
11 <---> 15

 

[andy16v]

@ Trojan

am I right in thinking that the 9882 block is split into 16 blocks then organised into the above sequence, this will then become the 016C block and decrypted in the same way?

thanks Andy

 

[Tr0jan]

@ Trojan

am I right in thinking that the 9882 block is split into 16 blocks then organised into the above sequence, this will then become the 016C block and decrypted in the same way?

thanks Andy

The 9882 block is decrypted using bit-swap in the order shown. Then it will show as the 00016c block which is then decrypted using the idea decrypt method

 

[morpheu]

Can someone explain to me? If cwpk pairing uses a "CPUID". I got two receivers and removed NAND for both, afterward, I did reballing of first NAND at second receiver and it's working perfectly. How is this is possible?

 

[Tr0jan]

Can someone explain to me? If cwpk pairing uses a "CPUID". I got two receivers and removed NAND for both, afterward, I did reballing of first NAND at second receiver and it's working perfectly. How is this is possible?

well since you replaced the NAND chip as far as im aware they would both hold the same firmware and not any blocks needed like the encrypted 00016c block or the decrypted 00016c block or the 000097 block either encrypted or decrypted.

plus as you said in your post "CPU-ID"
will be the same as the both boxes will have the same Bcm or stixxx cpu.


Just been curious what provider are you ? As i,m sure that certain providers at one time you could use the same NUID and key/keys to decrypt the final cw but since it was posted public, then it never lasted very long. As they closed that hole. that's what happens when things go public.

 

[locka]

Here's a dump for studies .. for extract rsa
https://www.sendspace.com/file/tqm5ep

 

[Tr0jan]

Here's a dump for studies .. for extract rsa
https://www.sendspace.com/file/tqm5ep

Plenty for people who want to learn how/what the cak is in that dump.
CAK VERSION R-AKTAH-ACXCO

 

[morpheu]

Ird
0000606d

rsa
1b08aeff81ffdc33946aa0c1222c33c3d3d112f755a8f5150a6ba9d58d8b1ddd307d476f6d19c2bfcd9dd5567984a96c59a1c315ec62b308952c97799ca0573b

boxkey
8244195295df6813

here's a dump for studies .. For extract rsa
https://www.sendspace.com/file/tqm5ep

- - - Updated - - -

Dear Tr0jan;

These receptors are the Cloro TV Brazil (caid: 1802).

The receivers have different NUID and HD's channels are working yet, after change NAND.

Thanks.

well since you replaced the NAND chip as far as im aware they would both hold the same firmware and not any blocks needed like the encrypted 00016c block or the decrypted 00016c block or the 000097 block either encrypted or decrypted.

plus as you said in your post "CPU-ID"
will be the same as the both boxes will have the same Bcm or stixxx cpu.


Just been curious what provider are you ? As i,m sure that certain providers at one time you could use the same NUID and key/keys to decrypt the final cw but since it was posted public, then it never lasted very long. As they closed that hole. that's what happens when things go public.

 

[fr3n2y]

9882=1001.1000.1000.0010 bin
016C=0000.0001.0110.1100 bin


16 15 14 13-12 11 10 9-8 7 6 5-4 3 2 1

swap:
1 <---> 5
2 <---> 6
3 <---> 16
4 <---> 8
7 <---> 12
9 <---> 13
10 <---> 14
11 <---> 15

Thanks Tr0jan, I got it.

I sent you a PM, if you prefer I can ask in the forum.

Regards

Enviado desde mi SM-P605 mediante Tapatalk

 

[mtssouza]

Hello friends,


Good Afternoon!


I'm from Brazil and I am seeking help, I have a dump of a decoder BGA PACE HDC 74x1, and do not know where to start to extract BK & RSA could help me?


hugs