pokec a la sky59

sky59 · Příspěvek od **sky59** » 26 črc 2024 19:35

marian34 píše: Kamalát a nemáš ty hekovať oscam l2b?

Ale ano, proces bezi.... Mam to tak na 99% hotove, a ked si taky zvedavy, mozem ti sem uploadnut
aktualny stav funkcie irdeto_card_init, ta je posledna co treba dorobit

Budes moct zase sem hodit nieco "upravene" mysliac si, ze ma domylis

Chces?

marian34 · Příspěvek od **marian34** » 27 črc 2024 07:38

Jasné, som zvedavý. Ukáž, či máš aspom jednu funkciu z init l2b.

sky59 · Příspěvek od **sky59** » 27 črc 2024 17:16

marian34 píše: ↑27 črc 2024 07:38 Jasné, som zvedavý. Ukáž, či máš aspom jednu funkciu z init l2b.

SOM ZVEDAVY NA KOMENTAR!

ako som napisal nie je to este dokoncene, skeleton je hotovy na 100%, este tam mam drobne odchylky, su dovolenky
a robote som robil nejaky VHDL kod tak to trosku sklzlo ale ja sa nikam neponahlam, tu to mas:

neviem ci si niekedy nieco reverzoval, ale nazvy funkcii mam vseobecne co vobec nevadi a tak to musi byt aby to bolo prenosne medzi roznymi procesormi
dal by som sem aj ako vyzera vystup z Ghidra a z IDA ale na to treba mat iste minimalne IQ tak neviem ci aj to treba

a zatial je tam dost komentarov, tie si netreba vsimat, kedze to musim napasovat tak, aby to dalo identicky bin po preklade, vtedy je to hotove

bohuzial to "autor" (ty si to nepisal, to muselo uniknut z firmy ktora robila Skylink ready software) co to prepisoval do oscamu moc tomu asi nerozumel a porobil totalne
programatorske hluposti, ktore musim zopakovat, co komplikuje vec

naj priklad je, ked uz nevedel kam z konopi a siahol po popolarnom "goto" vid nizsie

ked opakuje dvakrat inicializaciu ak sa nepodari na 1x

si na rade, daj nieco na "zmetenie nepriatela"

padla sanka?

Kód: Vybrat vše

static int32_t irdeto_card_init(struct s_reader *reader, ATR *newatr)
{
	def_resp;
	get_atr;
	//int32_t camkey = 0;
	uint8_t buf[256] = { 0 };
/*	uint8_t sc_GetCamKey383C[] = {
		0x02, 0x09, 0x03, 0x00, 0x40,
		0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
		0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
		0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
		0x12, 0x34, 0x56, 0x78, 0x90, 0xAB, 0xCD, 0xEF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };  sky59 nahradene s Lb68 */
		
	// acspadd  nejaky priestor na vseobecne pouzitie                     // e80
	//uint8_t Le80[80];
	// cta_lr  z card init                                                // e30
	// cta_lr  z init provider                                            // e2e
	// dlzka ATR                                                          // e2c
	uint32_t bufDES[32];                                                  // e28 	
	uint8_t Lce8[6]             = { 0 };                                  // ce8  meni iba posledny byte
	uint8_t sc_GetASCIISerial[] = { 0x02, 0x00, 0x03, 0x00, 0x00 };       // da8
	uint8_t sc_GetHEXSerial[]   = { 0x02, 0x01, 0x00, 0x00, 0x00 };       // d98
	uint8_t sc_GetCountryCode[] = { 0x02, 0x02, 0x03, 0x00, 0x00 };       // d88
	uint8_t Lb68[70]            = { 0x02, 0x09, 0x03, 0x00, 0x40 };       // b68 .. b23	
	uint8_t sc_Acs57CamKey[70]  = { 0xD2, 0x12, 0x03, 0x00, 0x41 };       // b18 .. ad3	
	uint8_t sc_Acs57Country[]   = { 0xD2, 0x04, 0x00, 0x00, 0x01, 0x3E }; // cd8
	uint8_t sc_Acs57Ascii[]     = { 0xD2, 0x00, 0x03, 0x00, 0x01, 0x3F }; // cc8
	uint8_t sc_Acs57Hex[]       = { 0xD2, 0x02, 0x03, 0x00, 0x01, 0x3E }; // cb8
	uint8_t sc_Acs57_Cmd[]  = { ACS57GET, 0xFE, 0x00, 0x00, 0x00 };       // d78   pouzite aj v init provider
//	uint8_t Ld68[]              = { 0xd0, 0xfe, 0x00, 0x00, 0x00 };       // d68
//	uint8_t Ld58[]              = { 0x00, 0x03, 0x00, 0x00, 0x00 };       // d58
//	uint8_t Ld48[]              = { 0x02, 0x21, 0x00, 0x00, 0x00 };       // d48
//	uint8_t sc_GetSCDetails[]   = { 0x02, 0x1e, 0x00, 0x00, 0x00 };       // d38
//	uint8_t Ld28[]              = { 0x02, 0x1f, 0x00, 0x00, 0x00 };       // d28
//	uint8_t Ld18[]              = { 0x02, 0x08, 0x00, 0x00, 0x00 };       // d18	
//	uint8_t Ld08[]              = { 0x02, 0x1b, 0x04, 0x00, 0x00 };       // d08	
//	uint8_t Lcf8[]              = { 0x02, 0x15, 0x00, 0x00, 0x00 };       // cf8	
//	uint8_t Lce8[]              = {    0,    0,    0,    0,    0,    0 }; // ce8  meni iba posledny byte
//	uint8_t sc_Acs57Country[]   = { 0xD2, 0x04, 0x00, 0x00, 0x01, 0x3E }; // cd8
//	uint8_t sc_Acs57Ascii[]     = { 0xD2, 0x00, 0x03, 0x00, 0x01, 0x3F }; // cc8
//	uint8_t sc_Acs57Hex[]       = { 0xD2, 0x02, 0x03, 0x00, 0x01, 0x3E }; // cb8
//	uint8_t sc_Acs57CFile[]     = { 0xD0, 0x06, 0x00, 0x00, 0x01, 0x3D }; // ca8	
//	uint8_t Lc98[]              = { 0xD2, 0x42, 0x00, 0x00, 0x01, 0x1D }; // c98	
//	uint8_t Lc88[]              = { 0xD2, 0x3C, 0x00, 0x00, 0x01, 0x22 }; // c88	
//	uint8_t Lc78[]              = { 0xD2, 0x3e, 0x00, 0x00, 0x01, 0x23 }; // c78	
//	uint8_t Lc68[]              = { 0xD2, 0x10, 0x00, 0x00, 0x01, 0x34 }; // c68	
//	uint8_t Lc58[]              = { 0xD2, 0x36, 0x04, 0x00, 0x01, 0x23 }; // c58	
//	uint8_t Lc48[]              = { 0xD2, 0x2a, 0x00, 0x00, 0x01, 0x29 }; // c48	
//	uint8_t Lc38[]              = { 0x33, 0x20, 0x6f, 0x74, 0x65, 0x64, 0x72, 0x49 };                                               // c38	
//	uint8_t Lc28[]              = { 0x02, 0x20, 0, 0, 0x10, 0x03, 0x0b, 0x16, 0x01, 0x1d, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0       };  // c28..c14
//	uint8_t Lc08[]              = { 0xD2, 0x40, 0, 0, 0x11, 0x03, 0x0b, 0x16, 0x01, 0x1d, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0x0e };  // c08..bf3
   	uint8_t Lbe8[24];           // pozicany z provider                                                                              // be8..bd1
	//uint8_t  Lbc8[33];       z get_atr                                  // bc8 .. ba7   ATR odpoved ide sem   local_e2c je dlzka ATR 33bytov
	//uint8_t sc_Acs57Prov[48]  = { 0 };                                  // b98 .. b69  aj v init provider
//	uint8_t Lb68[70]            = { 0x02, 0x09, 0x03, 0x00, 0x40 };       // b68 .. b23
//	uint8_t sc_Acs57CamKey[70]  = { 0xD2, 0x12, 0x03, 0x00, 0x41 };       // b18 .. ad3
	uint8_t bufT[128];                                                    // ac8 .. a49
	// buf[256] z card init	                                              // a48 .. 949
	// buf[256] z init provider                                           // 948 .. 849   &bStack_949 + 1
	// cta_res[512] z card init                                           // 848 .. 649
	// cta_res[512] z init provider                                       // 648 .. 449
	char hexbuf[1024];                                                    // 448 ..  49  buffer na hexdump
	// sem sa pyta 8 bytov	
	// stack check                                                        //  40	

	// uint8_t sc_GetCardFile[]    = { 0x02, 0x0E, 0x02, 0x00, 0x00 };       // asi nepouzite rovnako ako aj sc_GetProvider
	                           
	
	int32_t acspadd = 0;
	int32_t acs57 = 0; 

	if(!memcmp(atr + 4, "IRDETO", 6))
	{
		acs57 = 0;
	}
	else
	{
		if((!memcmp(atr + 5, "IRDETO", 6)) || (((atr[6] == 0xC4) && (atr[9] == 0x8F) && (atr[10] == 0xF1)) && reader->force_irdeto))
		{
			acs57 = 1;
			acspadd = 8;
			rdr_log(reader, "Hist. Bytes: %s", atr + 5);
		}
		else
		{
			return ERROR;
		}
	}

	if(!cs_malloc(&reader->csystem_data, sizeof(struct irdeto_data)))
	{
		return ERROR;
	}
	struct irdeto_data *csystem_data = reader->csystem_data;
	csystem_data->acs57 = acs57;

	rdr_log(reader, "detect irdeto card");
	
	uint8_t sc_Acs57CFile[]     = { 0xD0, 0x06, 0x00, 0x00, 0x01, 0x3D }; // ca8
	uint8_t Ld68[]              = { 0xd0, 0xfe, 0x00, 0x00, 0x00 };       // d68
	uint8_t Ld58[]              = { 0x00, 0x03, 0x00, 0x00, 0x00 };       // d58
	
	if(csystem_data->acs57 == 1)                    //111111111111111
	{
		irdeto_do_cmd(reader, sc_Acs57CFile, 0x900d, cta_res, &cta_lr);
		int32_t acslength = cta_res[cta_lr - 1];
		Ld68[4] = acslength;
		reader_chk_cmd(Ld68, acslength + 2);
	}
	else
	{
		reader_chk_cmd(Ld58, 6);
	}

	uint8_t Lc98[]              = { 0xD2, 0x42, 0x00, 0x00, 0x01, 0x1D }; // c98
	uint8_t Lc08[]              = { 0xD2, 0x40, 0, 0, 0x11, 0x03, 0x0b, 0x16, 0x01, 0x1d, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0x0e };  // c08..bf3
	uint8_t Lc88[]              = { 0xD2, 0x3C, 0x00, 0x00, 0x01, 0x22 }; // c88
	uint8_t Ld48[]              = { 0x02, 0x21, 0x00, 0x00, 0x00 };       // d48
	uint8_t Lc28[]              = { 0x02, 0x20, 0, 0, 0x10, 0x03, 0x0b, 0x16, 0x01, 0x1d, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0       };  // c28..c14
	uint8_t sc_GetSCDetails[]   = { 0x02, 0x1e, 0x00, 0x00, 0x00 };       // d38	

	if(csystem_data->acs57 == 1)          //222222222222222
	{
		irdeto_do_cmd(reader, Lc98, 0x9019, cta_res, &cta_lr);
		int32_t acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
		
		irdeto_do_cmd(reader, Lc08, 0x9009, cta_res, &cta_lr);
		acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
	
		irdeto_do_cmd(reader, Lc88, 0x9015, cta_res, &cta_lr);
		acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
	}
	else
	{
		reader_chk_cmd(Ld48, 0x12);
		reader_chk_cmd(Lc28, 2);
		if ((cs_dblevel & 4) != 0) {                           //DAT_0071b618
		 cs_log_txt(0,"[irdeto-reader] cmd20: %s", cs_hexdump(1,Lc28,sizeof(Lc28),hexbuf,sizeof(hexbuf)) );
		}
		reader_chk_cmd(sc_GetSCDetails, 0xE);		
	} 
	
	
	
		rdr_log(reader, "Irdeto SC %0x version %0x revision %0x, patch level %0x", cta_res[0 + acspadd], cta_res[1 + acspadd], cta_res[2 + acspadd], cta_res[5 + acspadd]);

	uint8_t Lc78[]              = { 0xD2, 0x3e, 0x00, 0x00, 0x01, 0x23 }; // c78
	uint8_t Ld28[]              = { 0x02, 0x1f, 0x00, 0x00, 0x00 };       // d28	
	 
	                                                 //232323232323232323232
		
	if(csystem_data->acs57 == 1) 
	{
		irdeto_do_cmd(reader, Lc78, 0x900B, cta_res, &cta_lr);
		int32_t acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
		rdr_log(reader,"Owner ID : %02X%02X",cta_res[9],cta_res[10]);
	}
	else
	{
		reader_chk_cmd(Ld28, 4);
		rdr_log(reader,"Owner ID : %02X%02X",cta_res[0],cta_res[1]);
	}
	
	
	if(csystem_data->acs57 == 1)          //3333333333333333333
	{
		irdeto_do_cmd(reader, sc_Acs57Ascii, 0x901D, cta_res, &cta_lr);
		int32_t acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
	}
	else
	{
		reader_chk_cmd(sc_GetASCIISerial, 22);
	} 	
	
	

	
	memcpy(buf, cta_res + acspadd, 10); 
	buf[10] = 0;                        
	if(csystem_data->acs57 == 1)             //444444444444444444
	{
		irdeto_do_cmd(reader, sc_Acs57Hex, 0x903E, cta_res, &cta_lr);
		int32_t acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
	}
	else
	{
		reader_chk_cmd(sc_GetHEXSerial, 18);
	}
	
	
	
	
	reader->nprov = cta_res[10 + acspadd];
	memcpy(reader->hexserial, cta_res + 12 + acspadd, 4);

	rdr_log_sensitive(reader, "Providers: %d, ascii serial: {%s}, hex serial: {%02X%02X%02X}, hex base: {%02X}",
		reader->nprov, buf, reader->hexserial[0], reader->hexserial[1], reader->hexserial[2], reader->hexserial[3]);






//5555555555555555555555555555

	if(csystem_data->acs57 == 1)
	{
		irdeto_do_cmd(reader, sc_Acs57Country, 0x9019, cta_res, &cta_lr);
		int32_t acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
	}
	else
	{
		reader_chk_cmd(sc_GetCountryCode, 18);
	}




	csystem_data->acs = (cta_res[0 + acspadd] << 8) | cta_res[1 + acspadd];
	reader->caid = (cta_res[5 + acspadd] << 8) | cta_res[6 + acspadd];
	memcpy(csystem_data->country_code, cta_res + 13 + acspadd, 3);
	rdr_log(reader, "Caid     : %04X, acs: %x.%02x, country code: %c%c%c",
		reader->caid, cta_res[0 + acspadd], cta_res[1 + acspadd], cta_res[13 + acspadd], cta_res[14 + acspadd], cta_res[15 + acspadd]);

	uint8_t Lc68[]              = { 0xD2, 0x10, 0x00, 0x00, 0x01, 0x34 }; // c68
	uint8_t Lc58[]              = { 0xD2, 0x36, 0x04, 0x00, 0x01, 0x23 }; // c58
	uint8_t Lc48[]              = { 0xD2, 0x2a, 0x00, 0x00, 0x01, 0x29 }; // c48
	uint8_t Ld18[]              = { 0x02, 0x08, 0x00, 0x00, 0x00 };       // d18
	uint8_t Ld08[]              = { 0x02, 0x1b, 0x04, 0x00, 0x00 };       // d08
	uint8_t Lcf8[]              = { 0x02, 0x15, 0x00, 0x00, 0x00 };       // cf8

	//66666666666666666666666666

	if(csystem_data->acs57 == 1)
	{
		irdeto_do_cmd(reader, Lc68, 0x9049, cta_res, &cta_lr);
		int32_t acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
		
		irdeto_do_cmd(reader, Lc58, 0x900d, cta_res, &cta_lr);
		acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
		
		rdr_log(reader,"Rand4    : %s", cs_hexdump(0,cta_res+acspadd,sizeof(cta_res+acspadd),hexbuf,sizeof(hexbuf)) );

		irdeto_do_cmd(reader, Lc48, 0x9089, cta_res, &cta_lr);
		acslength = cta_res[cta_lr - 1];
		sc_Acs57_Cmd[4] = acslength;
		reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);		
	}
	else
	{
		reader_chk_cmd(Ld18, 0x42);
		reader_chk_cmd(Ld08, 6);
		rdr_log(reader,"Rand4: %02X%02X%02X%02X",cta_res[0],cta_res[1],cta_res[2],cta_res[3]);
		reader_chk_cmd(Lcf8, 0x82);
	}


//77777777777777777777777
    if ((cs_dblevel & 4) != 0) {
     cs_log_txt(0,"[irdeto-reader] Register 15: %s",cs_hexdump(0,cta_res,0x80,hexbuf,sizeof(hexbuf)) );
                               }


	Lce8[5] = 3;     //concat11

	memcpy(bufT,                     TAB4E94C0,              128);
	memcpy(csystem_data->X159,       cta_res + acspadd,      128);
	memcpy(csystem_data->X1D9,       cta_res + acspadd,      128);
	memcpy(buf710340,                csystem_data->X159,     128);
	memcpy(csystem_data->X059,       reader->reg_key,        128);

	FUN_00475e70(csystem_data->X059,0x80,Lce8,sizeof(Lce8),bufT);        //0x80 mozno sizeof()

	memcpy(csystem_data->X059 + 64,  csystem_data->X159 + 64, 64); 
	memcpy(csystem_data->X0D9,       csystem_data->X159,     128);
	memcpy(buf710240,                csystem_data->X059,     128);								
	memcpy(csystem_data->dummy1,     reader->rsa_mod,         64);	

								
	Lce8[5] = 7;								
	
 
	if ( reader->dynamiccamkey != '\0') {
		uint8_t bufT1[256] = {0};         //mal by si pozicat local 948  je OK
		uint8_t bufT2[48]  = {0};         //mal by si pozicat local b98
		//tu chyba init local_b98   48 bytov
		
		//memset(buf,          0,   256);   asi si pozical buffer 948	inicializuje ho
		//memset(sc_Acs57Prov, 0,   0xc);   tu si inicializuje prvy krat
		cs_log_txt(0,"DynCamKey");
		
		uint8_t opakuj =0;
		
//sem sa nieco pyta		bude sa opakovat 2x
repeat:
		
		FUN_00475e20(buf);
		memcpy(Lbe8, buf + 40,    24);	
		FUN_00475e70(buf ,0x40,Lce8,sizeof(Lce8),csystem_data->dummy1);    // sizeof() ??


			if(csystem_data->acs57 == 1){
				uint8_t cmdT1[]  = { 0xD2, 0x50, 0x01, 0x00, 0x01, 0x15 }; //v local 648 ma ale b18
				if(!(irdeto_do_cmd(reader,cmdT1,0x9009,cta_res,&cta_lr))){cs_log_txt(0,"IPRCiLayer supported");}
				int32_t acslength = cta_res[cta_lr - 1];
				//sc_Acs57_Cmd[5] = 1;                           //?????????
				sc_Acs57_Cmd[4] = acslength;
				reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);

				bufT1[0] = 0xD2;
				bufT1[1] = 0x50; 
				bufT1[2] = 0x01; 
				bufT1[3] = 0x00; 
				bufT1[4] = 0x41;
								
				memcpy(bufT1 + 5,  buf ,   64);	//3434343434343434343

				uint8_t xx=0;
				for(uint32_t i=0; i<69; i++){
					xx = xx ^ bufT1[i];
											}
		
				bufT1[69] = xx ^ 0x97;   


				if (!(irdeto_do_cmd(reader,bufT1,0x9049,cta_res ,&cta_lr))){
				 cs_log_txt(0,".......................................................");
				 cs_log_txt(0,"  ********** CamKeyData OK  *****************    ");
				 cs_log_txt(0,".......................................................");

				 acslength = cta_res[cta_lr - 1];
				 sc_Acs57_Cmd[4] = acslength;
				 reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
				}
				else
				{
				
				 cs_log_txt(0,".......................................................");
                 cs_log_txt(0,"  ********** CamKeyData CRC ERROR  *****************    ");
                 cs_log_txt(0,".......................................................");
				 
                 acslength = cta_res[cta_lr - 1];
				 sc_Acs57_Cmd[4] = acslength;
				 reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);
				 
				 sleep(1); 
				 
				 if (!(opakuj)){opakuj = 1;goto repeat;}else {return ERROR;}				 
				}
			}
			else{
			    uint8_t cmdT1[]  = { 0x02, 0x28, 0x01, 0x00, 0x00 }; //v local 648
			    if(!(irdeto_do_cmd(reader,cmdT1,0x12,cta_res,&cta_lr))){cs_log_txt(0,"IPRCiLayer supported");}

				bufT1[0] = 0x02;
				bufT1[1] = 0x28; 
				bufT1[2] = 0x01; 
				bufT1[3] = 0x00; 
				bufT1[4] = 0x40;
	
				memcpy(bufT1 + 5,  buf ,   64);	

				if (!(irdeto_do_cmd(reader,bufT1,0,cta_res ,&cta_lr)))
				{
				 cs_log_txt(0,".......................................................");
				 cs_log_txt(0,"  ********** CamKeyData OK  *****************    ");
                 cs_log_txt(0,".......................................................");
								
				}
				else
				{
				 cs_log_txt(0,".......................................................");
                 cs_log_txt(0,"  ********** CamKeyData CRC ERROR  *****************    ");
                 cs_log_txt(0,".......................................................");
				 
				 sleep(1);
				 
				 if (!(opakuj)){opakuj = 1;goto repeat;}else {return ERROR;}
				 
				}
			}




				cs_log_txt(0,"IPRCiLayerInit Success...");

				memcpy(buf,  cta_res + acspadd,         64);	

				FUN_00475e70(buf,0x40,Lce8,sizeof(Lce8),csystem_data->dummy1);       //sizeof ??
				
				uint8_t bufT3[256] = {0};                                     //mal by si pozicat local 648
				memcpy(bufT3 + 1,  buf   ,   63);                             
				memcpy(buf      ,  bufT3 ,   64);

//4545454545454545454
				if ((buf[8] == 2)&&(buf[23] == 1)){
				
				if(memcmp(buf + 24,TAB4E9390,0x10)){
				 cs_log_txt(0,"  ********** cmd28 signkey Error *****************    "); 
				 return ERROR;
				}
								
				memcpy(bufT2      ,  Lbe8     ,   24);   //Lbe8 asi pozicany z provider
				memcpy(bufT2 + 24 ,  buf + 40 ,   24);

				 if ((cs_dblevel & 4) != 0) {  //toto bolo nejako zblbnute v reverse je to tam 2x
					cs_log_txt(0,"[irdeto] Key48: %s",cs_hexdump(1,bufT2,0x18,hexbuf,sizeof(hexbuf)));
					if ((cs_dblevel & 4) != 0) {                                  
						cs_log_txt(0,"[irdeto] Key48: %s",cs_hexdump(1,bufT2+24,0x18,hexbuf,sizeof(hexbuf)));
					}}  

				uint8_t b4;
				uint32_t iv=0;
				uint8_t Lc38[]              = { 0x33, 0x20, 0x6f, 0x74, 0x65, 0x64, 0x72, 0x49 };
				
				for(uint32_t i=0; i<6; i++){
					iv = iv + 1;
					des_set_key("Irdeto 3",bufDES);
                    des(bufT2 + (2*i),bufDES,0);

					for(uint32_t u=0; u<8; u++){
						if ((iv % 3) == 0){
						  b4 = Lc38[u];
						}
						else{
						  b4 = bufT2[iv*8 + u];	
						}
						b4 = b4 ^ bufT2[2*i + u]; 
						Lc38[u] = Lc38[u] ^ b4;
						bufT2[2*i + u] = b4;
				}}


				for(uint32_t e=0; e<8; e++){
					bufT2[2+e] = bufT2[2+e] ^ bufT2[8 +e];
					bufT2[e]   = bufT2[4+e] ^ bufT2[10+e];
					bufT2[4+e] = bufT2[4+e] ^ bufT2[10+e] ^ bufT2[6+e];
				}

				*(uint64_t *)csystem_data->key1 = *(uint64_t *)bufT2;  //concat26 .....????
				
				if ((cs_dblevel & 4) != 0) {
                  cs_log_txt(0,"[irdeto] CamKey: %s",cs_hexdump(0,csystem_data->key1,8,hexbuf,sizeof(hexbuf)));				
				}
				
				}
				else
				{	
				cs_log_txt(0,"  ********** cmd28 decrypted Error *****************    ");	
				return ERROR;
				}
	}     //dynamic camkey
	else                     
	{			//uint8_t bufT4[64];                  
				cs_log_txt(0,"CamKeyCh_v1");
				FUN_00475dc0(buf);
				
				if ((cs_dblevel & 4) != 0) {
                cs_log_txt(0,"[irdeto-reader] PrepCamMess helperkey: %s",cs_hexdump(1,buf + 24,8,hexbuf,sizeof(hexbuf)));
				}
				
				*(uint64_t *)csystem_data->key1 = *(uint64_t *)(buf + 8); //concat53
				
				FUN_00475e70(buf,0x40,Lce8,sizeof(Lce8),csystem_data->dummy1);          //sizeof ??
				
				if(csystem_data->acs57 == 1){
				 memcpy(sc_Acs57CamKey + 5,  buf ,   64);
				 
				 uint8_t b4 = 0;
				 for (uint8_t i=0; i< 69 ; i++){
				   b4 = b4 ^ sc_Acs57CamKey[i];					 
				 }
				 
				 sc_Acs57CamKey[69] = ((b4 ^ sc_Acs57CamKey[0]) & 0xf0 ) ^ 0x24;
				 
				 if (irdeto_do_cmd(reader,sc_Acs57CamKey,0x9011,cta_res ,&cta_lr)){
				   cs_log_txt(0,"doCamKeyExchange failed!");
				   return ERROR;
				 }
				int32_t acslength = cta_res[cta_lr - 1];
				sc_Acs57_Cmd[4] = acslength;
				reader_chk_cmd(sc_Acs57_Cmd, acslength + 2);				
				
				
				}
				else{
				memcpy(sc_Acs57CamKey + 5,  buf ,   64);
				
				if (irdeto_do_cmd(reader,Lb68,0,cta_res ,&cta_lr)){
				   cs_log_txt(0,"doCamKeyExchange failed!");
				   return ERROR;
				 }
				}
		
	
	            uint8_t tbuf[8];
				ReverseSessionKeyCrypt(csystem_data->key1,tbuf);   //? 648
			    if ((cs_dblevel & 4) != 0) {  //toto bolo nejako zblbnute v reverse je to tam 2x
				cs_log_txt(0,"[irdeto-reader] helperkey: %s",cs_hexdump(1,tbuf,8,hexbuf,sizeof(hexbuf)));
				 if ((cs_dblevel & 4) != 0) {                                  
				 cs_log_txt(0,"[irdeto-reader] camkey   : %s",cs_hexdump(1,csystem_data->key1,8,hexbuf,sizeof(hexbuf)));
				}} 
	}

	return irdeto_card_init_provider(reader);
}

marian34 · Příspěvek od **marian34** » 27 črc 2024 20:53

Tak ide ti to celkom dobre. Myslím, že niekedy v päťdesiatomštvrtom by si to mohol mať hotové.

sky59 · Příspěvek od **sky59** » 27 črc 2024 22:01

Pocitam to tak na 10 sedeni, zalezi interval medzi nimi, ale asi to bude skor

a teraz su dovolenky, bude mesiac pauza, nehori

Příspěvek od **peter54** » 27 črc 2024 22:33

Našťastie máme pár bináriek, ktoré fungujú výborne, tak si kľudne počkám. Nemusíš sa ponáhľať. U mňa v pohode.

sky59 · Příspěvek od **sky59** » 28 črc 2024 09:08

marian34 píše: ↑27 črc 2024 20:53 Tak ide ti to celkom dobre. Myslím, že niekedy v päťdesiatomštvrtom by si to mohol mať hotové.

Nic?
Nebude nejaky "zfejkovany" kod?

Daj nieco nech sa trosku pobavime a mozno aj nieco naucime

raven · Příspěvek od **raven** » 28 črc 2024 11:43

Odbornik feri na danu tematiku to mal uz zmaknute 2017 roku.

sky59 · Příspěvek od **sky59** » 28 črc 2024 12:27

Mozno ano, ak mu to niekto dal
Na SK ak by bol niekto dalsi co by to dokazal zreverzovat tak by som o nom musel vediet

Příspěvek od **EnoSat** » 28 črc 2024 12:30

Niekto pouziva IQ k tvorbe vlastnych algoritmov a niekto pouziva IQ k "reverzii"

sky59 · Příspěvek od **sky59** » 28 črc 2024 13:11

EnoSat píše: ↑28 črc 2024 12:30 Niekto pouziva IQ k tvorbe vlastnych algoritmov a niekto pouziva IQ k "reverzii"

Problem je ten, ze kto to napisal bol normalne zaplateny a teda netvoril vlastne ale firemne algoritmy
A ti, co to maju prepisane do oscamu to dostali hotove, ale vela ich nebude ked ani moderatori to nemaju

A kedze sa zrazu vyrojilo kopec odbornikov na tzv. l2b ako to ze sa narod "utieka" ku akemusi samurajovi o pomoc?

A ver, na reverz treba vyssie IQ ako iba prepisat dodane informacie vyrobcom smart karty do kodu, to robia bezne cvicene opice

Příspěvek od **EnoSat** » 28 črc 2024 14:07

A ktora firma si zaplatila aby dostala tie informacie od vyrobcu kariet, ked uz mas take informacie ?

sky59 · Příspěvek od **sky59** » 28 črc 2024 14:22

Firma ktora robila sw pre skylink ready (a mozno aj ini provideri pouzivaju rovnaky system)
A oni neplatili, oni to dostali pretoze "kupuju" ich karty

A co nevyhecujete radsej mariana34 nech sem nieco zavesi?

Příspěvek od **EnoSat** » 28 črc 2024 15:20

To musis ty, mne (a asi aj vecsine ostatnych) je celkom fuk ake zdrojaky sa pouziju. Hlavne ze to "zatial" bezi.
Takze podla teba ZIRKON a podobne firmy "kupuju" ich karty.

Příspěvek od **peter54** » 28 črc 2024 18:04

Problém reverse engineeringu je v tom, že prinajlepšom získame to, čo už máme a viac než 2 roky bez problémov používame.

sky59 · Příspěvek od **sky59** » 28 črc 2024 20:20

Davnejsie som cital ze ziadali samurka aby im vygeneroval oscam asi to bolo pre plustelku alebo nieco podobne, poslal ich do........ ze nebude podporovat konkurenciu
Inak verziu ktore lomim tak vsetky podmienky na caid, betacrypt a pod. si vyhadzane, jediny filter je mala 4 riadkova tabulka na CS caidy, predpokladam ze by stacilo iba tuto upravit

raven · Příspěvek od **raven** » 29 črc 2024 10:24

Tak ale plustelka pod danym oscamom uz tiez davno bezala a bezi este nastupom p.Samura

sky59 · Příspěvek od **sky59** » 29 črc 2024 15:32

tak plustelka uz v kode je: (ostatne povodne polozky su zrusene)

{0x0653, 0x0608, "SVK", 946598400L},
{0x0653, 0x0005, "SVK", 946598400L},
{0x0624, 0x0006, "CZE", 946598400L},
{0x0624, 0x0006, "SVK", 946598400L},
{0x0668, 0x0006, "SVK", 946598400L},

takze to asi nebudu iba CZSK provideri co pouzivaju toto irdeto, zrejme aj v zahranici bezia dalsi na rovnakom systeme, to mi dava zmysel v tom, ze kto by robil tento oscam iba pre czsk...?

marian34 · Příspěvek od **marian34** » 30 črc 2024 08:47

sky59 píše: ↑28 črc 2024 20:20 Inak verziu ktore lomim tak vsetky podmienky na caid, betacrypt a pod. si vyhadzane, jediny filter je mala 4 riadkova tabulka na CS caidy, predpokladam ze by stacilo iba tuto upravit

Ty si iný heker, vravíš "mala 4 riadkova tabulka na CS caidy". Len či to nebude chid_date, ktorá teoreticky "malú tabulka na CS caidy" nepotrebuje.

sky59 · Příspěvek od **sky59** » 30 črc 2024 12:37

Ked ju nepotrebuje naco je tam?
Ziadny fejkovany kod nebude? To mas tak velky strach?

pokec a la sky59

Re: OScam iCam

Re: OScam iCam

Re: OScam iCam

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Re: pokec a la sky59

Kdo je online