Nagra Hex block Decryption

[dockmur]

I found my eck encryted in ram:

88000000 84000000, i believe this swap in 32 bit !

hummmm.. strange value...

How did you get there?

Thx

 

[terrestrial]

I found my eck encryted in ram:

88000000 84000000, i believe this swap in 32 bit !

You can probably read that from the dump too. What you need is the plain cwpk.

 

[braza]

The dump of my ram show this :

54 45 67 56 78 EE B2 01 88 00 00 00 84 00 00 00
EK EK EK EK EK EK E0 F3 FE F4 AE 11 18 55 38 EA
EK EK EK EK EK EK E1 AD 54 72 FF 41 26 2F AA 5A
EK EK EK EK EK EK E2 67 54 5C 2A D7 9D 3C 6F 9E
EK EK EK EK EK EK E3 53 E1 1F 88 68 88 A6 B2 0D
EK EK EK EK EK EK E4 E5 45 7D 40 4C 9A C4 1B CA
EK EK EK EK EK EK E5 8D 4F 2D E6 32 94 9B 46 6E
EK EK EK EK EK EK E6 FA 80 3A 8E 69 BC DC 12 CB
EK EK EK EK EK EK E7 7F E3 D7 9E C8 68 6E C6 7F
D0 01 00 00 CC 01 00 00 10 D7 8F 01 00 00 00 00

I have 3 receptors.. all bcm7358 and the log is the same for all 8800000084000000 ECK0 ~ ECK7 and the D0 01 00 00 CC 01 00 00 10 D7 8F 01 00 00 00 00 on the end of block .


Not the ECK.. same value in spi0.0 CFE block 00000097. Encypted>

Maybe need 3310 key and xor.

 

[terrestrial]

The ECK0-ECK7 is the same as is found in the 00 00 00 97 block but it's both encrypted and it does not need 3310 key but keyladder from or in the CPU.

And as your CPU is a Broadcom it will be very difficult to get a solution. Broadcom is a one of most secure processors in the world.

 

[braza]

I need to test!
I believe found the cwpk !
I have moded ram and receive msg ( in hd channel) card not paired ! SD channel is ok !
I believe found the cwpk;.

 

[Benfica200]

I need to test!
I believe found the cwpk !
I have moded ram and receive msg ( in hd channel) card not paired ! SD channel is ok !
I believe found the cwpk;.

It is easy to know if it is correct, decrypt the ECW with CK and check checksum! OK(cool)NOK(insert coin)!lol

54 45 67 56 78 EE B2 01 88 00 00 00 84 00 00 00

78 EE B2 01---->01 B2 EE 78(It like address,need check what have)

So many beers up

 

[avavynova]

please freind

i need how to know my rsa mod1 and 2 from my dump
i haven t .rodata.bin in nor , i have it in nand

than can someone let me know where i find it


thanks in advance.

 

[braza]

I have one question !

My ram start with 0x00000000 second /proc/iomem !

The block of cwpk send instruction to load ->

D0010000 CC010000 32 Bits swap

000001D0 load 8FA30024

000001CC load 8FA40028

My ram start in 00000000 and end in 0fffffff by proc/iomem !

HOW TO LOAD 0X8F0000000 ?

 

[gallesio]

Help for rsa and bk extraction?


CAID: 1802
DECO - 174936331330IRD - 68452A71

[FONT=source_sans_proregular]MEGA

[/FONT]

 

[mybuntu]

Chipset: 1*6326*873
Cak6.3
Pace 2231/78
Encrypted 016C

 

[Benfica200]

Help for rsa and bk extraction?


CAID: 1802
DECO - 174936331330IRD - 68452A71

[FONT=source_sans_proregular]MEGA

[/FONT]

Download rodata2211 from Sendspace.com - send big files the easy way

 

[gallesio]

Hi, good afternoon, friend, what would you upload? Could you help me how to meet 016c? thank you

 

[LGSmart]

HelloI have a record card CAID 1868 also have bk and rsa and even dump memory and card i do not mean i have to have oscam not public or any extra numbers to card has movedCARDOK 23 is reporting it but it does not decode it
Please help

 

[LGSmart]

klivo
You have a full mailbox I can not send you messages

 

[klivo]

aah sorry.. try now

 

[braza]

HI All !
I have .gpg certicate signatue for bcm73xx and payloader to open telnet.
I can change it with the secret cmd for bmc73XX!
I have 500 GB of SDK for bcm73XX !

I need the secret cmd to extract all key in bcm7346.

 

[Benfica200]

HI All !
I have .gpg certicate signatue for bcm73xx and payloader to open telnet.
I can change it with the secret cmd for bmc73XX!
I have 500 GB of SDK for bcm73XX !

I need the secret cmd to extract all key in bcm7346.

In some BCM boxes if uart is open and get access busybox to open telnet only need do:
mount -o remount,rw /dev/root
vi /etc/init.d/rcS
uncommented "#utelnetd -d"
# telnet (development only)
#utelnetd -d

save file and enjoy!!!

Your payload does not need to have the uart open! Interesting...

 

[ilia]

a little Up nothing new ?

 

[marcelorider]

What would be new?
Everyone is working to get something, you should do the same. Together we can, alone we can't.

 

[constance007]

For Those Who want The oscam Modified With CWPK Cases from 1 to 8

contact me On pm

only those who CWPK for 1811

we can work together