Explorer 4000DVB Boxkey Extraction

[stevenrossuk]

Hello all,

I have a Explorer 4000DVB cable box which is paired with the latest Nagra3 Virgin Card. I wish to extract the Boxkey.

From what I have read, having a paired card makes things a lot easier but I am still confused on what exactly I need to do.

A T911 unlooper comes up a lot, is this what I need? I would also appreciate it if someone could explain what a MOSC card is?

Finally, just for clarification. Does IRD + Boxkey + Dbox2 = Successful CS?

Thanks in advance,
Steven Ross

[G77]

if you have a paired n3 card you should still have the paired n1 card. glitch that.

of not, you'll need to lift one of the 256 chips off the board, see our downloads section for a tut

if you need a glitcher, check our classifieds section. im actually selling a dual unlooper.

a mosc is a modified original smartcard, a vm smartcard with a custom image to give you more

either way, your attempting to mess with a subbed box which we dont advise!

[stevenrossuk]

Thank you for your quick response.

I don't have the old card anymore, I have never been so annoyed! Arghhh!!

Anyways, looks like I need to get my hands on the chip inside. I have taken a look inside the Downloads section. However nothing I can see relates to my issue. I would be grateful for a quick hint on what file I need to download and what Box.net shared account it is located on.

EDIT: Found it! Also, would it be possible to purchase another box online, phone virmin to pair the card and extract the boxkey? If so, what is the best box for doing this?

Thanks,
Steven Ross

[G77]

no mate, virgin wont pair anything. they'll prob nick you for receiving stolen goods.

you'll need either a willem or an elvis programmer to read the chip.

if your intent on getting the bk for a box which now has a paired n3 card find someone who still has there paired n1 card lying about.

remember the (ex?) golden rule of the cable hack : dont mess with subbed gear

[TheCoder]

You also cant pair without the pairing key for the card. This is a long 64 byte RSA key that needs to be either extracted from the box or possilby decrypted from another tier on the card (DT08, if it exists - some cards dont have them).

Either way, there is presently no public method for extracting the required pairing key in the UK !

[stevenrossuk]

Wow, thanks for the info. I really appreciate you explaining this for me.

Looks like my only option is to read the chip. Do you think I would be able to read the chip by carefully soldering wires onto the chip legs without removing it?

With the BK, is it possible to CS Virmin using a dBox2?

Thanks again,
Steven Ross

[G77]

Thats what TheCoder is saying, as well as needing the boxkey for C.S you will also need the RSA key which is un-gettable. (publicly)

You wouldnt be able to read the chip en-situ no, you would need to lift totally.

[stevenrossuk]

Right, I thought that they pairing key was only needed when a card was to be paired from one box to another. Does this pairing key play an active role in the continuous decryption of data?

At first I thought that if I simply had the IRD and Boxkey that I could get a dBox2 to display nagra3 encrypted channels on a legit card. Then share the key stream from the cam to others.

Oh well, life isn't simple I suppose. Maybe I should move my efforts to sat?

Thanks for saving me a lot of time ,
Steven Ross

[TheCoder]

The pairing key is used for session based pairing. Every hour or so the box/card renegotiates a new random active encryption key using an encryption algorithm based on the 64 byte key I mentioned above. All further CW transfer to the box is then encrypted using this random negotiated key.

It all works in a very similar way to the N2 pairing system so if you really want you can learn the method by studying the N2 dumps available from various places.

[lost_boy]

stevenross - no RSA = no point!!!