N3 hex block with rsa and boxkey

[TheCoder]

Originally Posted by R.e.L.o.A.D.e.D

...Check up your mail inbox pls...i replied to your question...

ok, replied. Thanks for the info.

[braza]

I have one dump and don´t find 016C , only 00009883 and 00009882 .

How to convert 00009883 to 0000017C or 00009882 to 0000016C ?

[R.e.L.o.A.D.e.D]

Originally Posted by braza

I have one dump and don´t find 016C , only 00009883 and 00009882 .

How to convert 00009883 to 0000017C or 00009882 to 0000016C ?

Friend, check your PM, pls! I wana try help for ya!

;-)

[SabeL]

I have a hungarian U*C card and i have to change it, the new one will be N3 with paired STB.

I have a dump from a Humax with CPU CX24155, ive already have the BK+RSA. I trying to figure out the method of decrypting. (i want to solve my new card problem on my own )

My dump has 016c block (364 byte cipher block) so my theory about xoring and other is messed up. I collect many block layout from forums like:

0000006E 340D201C 0303
2008 1248BC6D8C1DD7B2
3008 42128CF2393955FA
3140 C77FD2596EE6E59C60D6C51C2F4243434F8F7C342A64619979 63591ACF06E7F6041E0ED7FBA4E8EC
169AB115E371F6E63E6927CD40795386B711199EEFFD1723
F842981EAB5E1064 E002 D008 0001

But it cant be applied to 016c block size.

I think the next step is that i need to disassembly a dump and extract the kernel with CAKV6. I cant do it. I've tried IDA PRO and QEMU.

My file offset (maybe its not the right word, i newbie in reversing): 0x0 - 0x400011 (4mb)

I know the flash part starting at 0x200000, + 0x200 byte is the bootloader (???) so the interesting part is starting after 0x200200.

I unable to run this dump with QEMU and cant configure IDA to move the correct part to RAM (i dont know the RAM size).

So my journey is over again.

The latest thing i found is a coship kernel (2 mb bin file) i take a look in it with hex editor and found many text about CAK in quetly readable format.

I hope this is what i searching for.

But again dont know the next step. Ive tried to extract it with STUN but nothing, no any usable file with normal gzip header.

If someone of you (TheCoder, Reloaded etc.) have time to help me please contact in PM, i can send you the kernel what i have.

Thank you.
Best Regards

[TheCoder]

ok, first thing to realise is that different set-top-boxes may use different processors so, if your going to try and disassemble anything, you must first learn to recognise the processor core.

The most common chips around are the ST made parts which contain ST20 type processors (a kind of derivative of the old transputer core) but there are also chips based on ARM, MIPS, SuperH and a whole host of others. These chips are all code imcopatible. They have very different instruction sets.

Once you've found the identity of the core processor then you need to try some disassembly. IdaPro can help with a good number of processors but you must be aware that nearly all of these stb cores have custom modified instruction sets. You'll probably find opcodes that dont disassemble with standard tools. You may just get far enough though as things like the Nagra libraries tend to be writtten as generic bits of code rather than making use of special facilities of a particular chip.

You may be able to find emulators for some chips, for instance, there are various ST20 core emulators around and even emulators for specific stb processors (STi5518 etc). There are also more generic ARM and MIPS emulators around that may help.

My dump has 016c block (364 byte cipher block) so my theory about xoring and other is messed up. I collect many block layout from forums like:

0000006E 340D201C 0303
2008 1248BC6D8C1DD7B2
3008 42128CF2393955FA
3140 C77FD2596EE6E59C60D6C51C2F4243434F8F7C342A64619979 63591ACF06E7F6041E0ED7FBA4E8EC
169AB115E371F6E63E6927CD40795386B711199EEFFD1723
F842981EAB5E1064 E002 D008 0001

I dont think you'll get far trying to decrypt that as its already decrypted. The top line is the block length, the ird No and a delimiter (0303). After that you get the various keys. 3140, for instance, is the pairing key your all after !

[TheCoder]

An exanple of the kind of stuff you may end up with from a disassembler -

 .text
 .globl __start
__start:
 lw $a0 0($sp) 
 addiu $a1 $sp 4 
 addiu $a2 $a1 4  
 sll $v0 $a0 2
 addu $a2 $a2 $v0
 jal main
 nop
 li $v0 10
 syscall   # syscall 10 (exit)
 .globl __eoth
__eoth:
...
...
...
 .globl main
main:
...
...
...

To get anywhere at this point, you would need to be familiar enough with the architecure of the processor in your stb to make sense of the above type of gobblygook and to actually fathom what it does.

[CG121]

Their CAS is all over the place at present so anyone wishing to log will find:

static DCWs
loss of CAS altogether (no CAID in stream) [free to air services]

They got big problems, modems down, vod down, CAS down....

[TheCoder]

Originally Posted by CG121

Their CAS is all over the place at present so anyone wishing to log will find:

static DCWs
loss of CAS altogether (no CAID in stream) [free to air services]

They got big problems, modems down, vod down, CAS down....

That seems to be happening quite frequently at the moment for some reason. Not sure if its anything to do with network upgrades needed for the upcoming speed doubling. It may have something to do with channel seperation of stb modems away from the standard modem channels affecting cam function. I haven't seen anything posted before so I assumed it was a regional thing.

[CG121]

It's almost as if we can DDOS their 'systems' and cripple their CAS but I'm not suggesting anything of course lol

[kid_warrior]

Been looking around and came across this forum and found a few things about this post. Does anyone think it could be a way of getting info from the new vermin cards....Looks interesting

Kid

www.islaremota.com/showthread.php/25165-Manual-extraccion-boxkey-y-rsa-rom180? - Translator