SKY HD Channels GONE - Is This The End Of Sky HD and Card Share C/S

This how-to is as simple as possible to explain how their EMMs best posting in this forum, if you need help or want to report EMMs for the collection list.
On the one hand not only important so that we can help you or the posted EMMs as many contain valuable information, but on the other hand, because ye very quickly come out against Sky can, if you just sign posted too much.
we also the structure of the EMM explained in detail.

the following is valid for the EMMs to the V13 / V14 cards CAIDs 098C and 09C4.

oscam / other 02er:
82 70 LL 41 SS SS SS SS 02 00 LL 90 LL MM NN XX ... (General structure)
82 70 21 41 00 82 75 D4 02 00 19 90 17 44 02 01 A6 5E 4C 73 E1 DB 74 AB 7A 5E 20 DA 89 1F 31 55 (original EMM)
82 70 21 41 XX XX XX XX 02 00 19 90 17 44 02 XX ... (so post)
82 70 21 .. 02 Series with 44 02 (or so, bears ALL available data)

oscam / other 07er:
82 70 L L 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B LL 05 II BB BB BB BB LL 9 0 LL MM NN XX ... (General structure)
82 70 6C 41 00 2C 5A 41 07 64 05 31 00 2C 5A 41 2B 5B 05 02 00 00 00 00 18 90 16 44 01 BA 7D 46 A6 8B 53 14 85 1E C8 14 7F AA C9 A3 85 CA D2 57 8E 03 00 00 00 00 18 90 16 44 01 00 31 45 71 7C ... (original EMM)
82 70 6C 41 XX XX XX XX 07 64 05 31 XX XX XX XX 2B 5B 05 02 XX XX XX XX 18 90 16 44 01 XX ... (so post, for experts)
82 70 6C .. 07er (minimum)

cccam 02er:
82 00 LL 41 02 00 LL 90 LL MM NN XX ... (General construction)
82 00 1D 41 02 00 19 90 17 44 02 01 A6 5E 4C 73 E1 DB 74 AB 7A 5E 20 DA 89 1F 31 55 (original EMM)
82 00 1D 41 02 00 19 90 17 44 02 XX ... (so post)
82 00 1D .. 02er with 44 02 ( or so, wearing ALL available data )

cccam '07:
82 00 LL 41 07 LL 05 31 SS SS SS SS 2B LL 05 II BB BB BB BB LL 90 LL MM NN XX ... (General structure)
82 00 68 41 07 64 05 31 00 2C 5A 41 2B 5B 05 02 00 00 00 00 18 90 16 44 01 BA 7D 46 A6 8B 53 14 85 1E C8 14 7F AA C9 A3 85 CA D2 57 8E 03 00 00 00 00 18 90 16 44 01 00 31 45 71 7C ... (original EMM)
82 00 68 41 07 64 05 31 XX XX XX XX 2B 5B 05 02 XX XX XX XX 18 90 16 44 01 XX ... (so post, for experts)
82 00 68 .. 07er (minimum)

No serial number and encrypted data post! Stop at the latest by 44 02/44 01!

Details:

In order to explain which parts need to be masked, the rough structure of the EMM must be understood

EMM structure explains:

00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C ... address HEX
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ... address DEC
82 70 21 41 00 82 75 D4 02 00 19 90 17 44 02 01 A6 5E ... sample EMM 82 70 6C 41 00 2C 5A 41 07 64 05 31 00 2C 41 5A 2B 5B 05 02 00 00 00 00 18 90 16 44 01 BA ... sample EMM 82 70 Start-brand EMM 82 70 LL number of remaining bytes to follow in the EMM (Hex); Length 82 70 LL 41 EMM addressed to smart card (unique) 82 70 LL 41 SS SS SS SS serial number of the smart card 82 70 LL 41 SS SS SS SS 02 EMM-typing; Single-EMM (another meaning?) 82 70 LL 41 SS SS SS SS 02 00 fixed value 82 70 LL 41 SS SS SS SS 02 00 LL number of remaining bytes to follow in the EMM (Hex); Length 82 70 LL 41 SS SS SS SS 02 00 LL 90 fixed value 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL number of remaining bytes to follow in the EMM (Hex); Length 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL 44 EMM-typing; User Encryption 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL 60 EMM-typing; System Encryption ( info ) 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL MM 01 Key Index ?; V13 cards 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL MM 02 Key Index ?; V14 cards 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL 40 EMM-typing; System Encryption ( info ) 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL MM 01 Key Index? 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL MM 02 Key Index? 82 70 LL 41 SS SS SS SS 02 00 LL 90 LL MM NN XX XX XX ... encrypted data 82 70 LL 41 SS SS SS SS 07 EMM-typing; Multi-EMM 82 70 LL 41 SS SS SS SS 07 LL number of remaining bytes to follow in the EMM (Hex); Length 82 70 LL 41 SS SS SS SS 07 LL 05 31 fixed value 82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS serial number of the smart card 82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B fixed value 82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B LL number of still ...; Length 82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B LL 05 fixed value; Subsequently up to 5 sub-EMMs

82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B LL 05 II Sub-EMM; See section " Sub-EMM Structure "
82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B LL II 05 BB BB BB BB Box Serial (or 00 ... 00)
82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B LL II 05 BB BB BB BB LL 90 LL ... like single-EMM; then, if necessary, further sub-EMM
82 70 LL 41 SS SS SS SS 07 LL 05 31 SS SS SS SS 2B LL II 05 BB BB BB BB LL 90 LL ... PP 00 checksum and EMM end
82 70 LL 01 directed EMM to multiple smart cards (shared / global)
82 70 LL 01 Further analysis follows ... See also Sammelthread
82 70 LL C1 EMM addressed to the receiver / CAM
82 70 LL C1 Further analysis follows ... See also Sammelthread

exception cccam:
EMMs of cccam clients come missing the first serial numbers section! These 4 bytes missing easy. But the value of the first length byte is LL corresponding to 4 smaller and the EMMs begin 82 00 instead of 82 70 .

Example cccam:
82 00 1D 41 02 00 19 90 17 44 02 01 A6 5E 4C 73 E1 DB 74 AB 7A 5E 20 DA 89 1F 31 55

Sub-EMM structure

00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 .. .. 6C 6D 6E ... Address HEX
00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 .. .. .. 108109 ... address DEC
82 70 6C 41 00 2C 5A 41 07 64 05 31 00 2C 41 5A 2B 5B 05 << >> SUBEMMS PP 00 example-EMM

sub-EMM:

00 D5 25 A7 81 18 90 16 44 01 BA 7D 46 A6 8B 53 14 85 1E C8 14 7F AA C9 A3 85 CA D2 57 8E
II Sub-EMM ID (00 through 04. possible)
II BB BB BB BB CA Serial / box Serial if set or 00 00 00 00
II BB BB BB BB LL 90 LL number of remaining bytes in the following sub-EMM (Hex); Length payload
II BB BB BB BB LL 90 LL 44 01 Sub-EMM type V13 Cards
II BB BB BB BB LL 90 LL 44 02 Sub-EMM type V14 Cards
II BB BB BB BB LL 90 LL 44 0d XX XX XX ...encrypted data

are always the sub-EMMs with the IDs 00 until 04 of row after transfer. Depending on the length of the sub-EMMs all 5 sub-EMMs may have place in a multi-EMM, or be transmitted through multiple multi-EMM (as an EMM maximum length can not exceed).
Have multi-EMM therefore not necessarily a sub . -EMM with ID 00 as the first sub-EMM

It example can always three multi-EMM are sent, each with the following content:
Multi-EMM # 1 contains sub-EMM 00 and 01
multi-EMM # 2 contains sub-EMM 02
Multi -EMM # 3 contains sub-EMM 03 and 04

the length of the sub-EMMs is not arbitrary. There are, depending on card type (V13 or V14) only two lengths may have a sub-EMM. A brief / named long.
A short sub-EMM (which includes its ID) 0x1E bytes long (V13) or 0x1F bytes long (V14).
A long sub-EMM (which includes its ID) 0x51 bytes long (V13) or 0x52 bytes long (V14).

it follows that the entire multi-EMM can accept only certain lengths, depending on how many short / long sub-EMM they contain.

For V13 possible EMM lengths (length specification 3. byte ): 0x30, 0x4E, 0x63, 0x6C, 0x81, 0x8A, 0xA8
For V14 are the possible EMM lengths (length specification 3. byte): 0x31, 0x50, 0x64, 0x6F, 0x83, 0x8E, 0xAD

Other features:
- Short Sub-EMMs the ID 00, the CA-Serial included, it is but then reduced by 0x80000000
- Short sub-EMMs the ID 01, 02, 03, 04 do not contain CA Serial
- Long sub-EMMs always contain a CA-Serial
- It always come sub-EMMs set Serial, ie 00, 01 with, 02 without, 03 without, 04 without. 00 without, 01 with, ... there is no

What needs to be posted, which censored?
Must be censored in any case each serial number and Box ID (if the box ID is occupied with 00 00 00 00, best leave the stand, so that the ideal contrast to assigned XX XX XX can detect XX).
further to encrypted data are censored, as these same point as the serial number on the user!
the rest of the data can be allowed to stand. In particular, are lengths and type isierungsangaben important to be able to help! So this leave.

Example log:

82702741009210D602001F901D4402C02D299DDA1B22BC87755E3CCC183E82223A829425B68E00B6DEE5
82702741009210D602001F901D4402C02D299DDA1B22BC87755E3CCC183E82223A829425B68E00B6DEE5
82702741009210D602001F901D4402C02D299DDA1B22BC87755E3CCC183E82223A829425B68E00B6DEE5
82702741009210D602001F901D44026C28B946D1EF2EA2FA1F9DDA31D08AE53710B27E1F36E21E032907
82702741009210D602001F901D44026C28B946D1EF2EA2FA1F9DDA31D08AE53710B27E1F36E21E032907
82708141002C6B6F07790531002C6B6F2B7005005543029B1890164401538535732AB53C6D0C65AB633EF97A452CE2AB7401D543029B4B90494401A612203EA390

posted correctly:

82 70 27 41 XX XX XX XX 02 00 1F 90 1D 44 02 X1 X1 X1 ...
82 70 27 41 XX XX XX XX 02 00 1F 90 1D 44 02 X1 X1 X1 ...
82 70 27 41 XX XX XX XX 02 00 1F 90 1D 44 02 X1 X1 X1 ...
82 70 27 41 XX XX XX XX 02 00 1F 90 1D 44 02 X2 X2 X2 ...
82 70 27 41 XX XX XX XX 02 00 1F 90 1D 44 02 X2 X2 X2 ...
82 70 81 41 XX XX XX XX 07 79 05 31 XX XX XX XX 2B 70 05 00 XX XX XX XX 18 90 16 44 01 X3 X3 ... X3 X3 01 XX XX XX XX 4B 90 49 44 01 X4 X4 ...

censorship with X1, X2, etc. intended to indicate that the values are different in otherwise identical EMMs.

If you want to play it safe, because it is precisely the reading of '07 EMMs is not so simple, should just stop at 07er EMMs to 10 bytes and 02er EMMs to 15 bytes (with cccam 4 less each!).
So:
82 70 27 41 XX XX XX XX 02 00 1F 90 1D 44 02 ... (3 times)
82 70 27 41 XX XX XX XX 02 00 1F 90 1D 44 02 ... (2 times)
82 70 81 41 XX XX XX XX 07 79 ... (1 time)

review / questions / suggestions for improvement are welcome.

become I know the post is not the shortest but it is also not about trifles ;)

no responsibility ;)is all based on assumptions and statistical evaluations. Claims such as "fixed value" mean that I have considered several million EMMs and there was never anything else. This does not mean that it is not yet there more values. If someone finds such a, like Report.


Less often also tuts
goal was to show what you can post safely, and what no.
Often it is enough for the first Examine the EMM but the info if it / is CCCam oscam, the length , and the type.
So:

82 70 21 .. 02 Series with 44 02
82 70 6C .. '07
82 00 1D .. 02er with 44 02

the 02 Series are already using this information fully described ! More data does not exist for the evaluation. The 07er is not because the multiple EMMs the form of the 02 may contain.

Utilities: Calculate the serial number / Box Id

Determine the card serial number of own EMMs using the card imprint:
The last digit of the serial number is deleted, then it uses the last 10 digits of the serial number and converts them with a calculator from decimal to Hex (which can for example the Windows calculator in view "programmer")

example: 700 0,008,237,900 1
results Converted by Hex the 8,237,900 value 7DB34C . This we now fill from the left with zeros to 8 characters and write, for readability, the bytes in two small groups:
Result: 00 7D B3 4C

characteristics: The first byte should in every 00 (if not, this post is now very old ;)) , The second byte is V13 cards between 00 and 3F , with V14 map between 40 and AF .

Determination of boxing Id own EMMs with the imprinted CA serial number of the receiver / CI + module:
The last digit of the CA serial number is deleted, then you use the last 10 digits of the CA serial number and converts them with a calculator from decimal to Hex (which can for example the Windows calculator in the "programmer")

example: 23452 2924562552 3
Converted to Hex yields di e 2,924,562,552 de n value AE514878 . This we now fill from the left with zeros to 8 characters and write, for readability, the bytes in two small groups:
Result: AE 51 48 78

Features: so far nothing is known / analyze ...
 
Im glad its nearly all over.
Since it finished things have never been better.
All 3pm football matches!
All in HD!
VOD!
4K streams!
No glitching!
No dish!
You never got that on 28.2°E (C/S)

Thank you SLY for ending C/S.
125730
 
Back
Top