[es] - TPS alive and soon kicking

ljpenovi
mods s obrazom

Član broj: 1219
Poruke: 2852

ICQ: 107030430

Profil

^{16.11.2004. u 19:57}

Nova TPS struktura ECM paketa
80 70 66 00 :Standardni pocetak
d2 01 01 ;ovaj nano je aktivirao XOR tabele
40 03 00 7c 0b ;standardna selekcija providera

df 35 ;nova verzija nano-a, df (nano) 35 (duzina kodiranog paketa) - mozda
kodiranog, mozda cisti garbage podaci

- kodirani paket pocetak
1d 51 9c 3d 3d 42 62 6e f9 4a 1c 41 87 0c 69 30
b8 db 96 1f 0b 95 64 16 e2 ea 80 05 2e aa e8 0a
a6 65 ef 29 12 2b a1 3f 56 e2 3c 5c 69 13 b4 61
8a 89 3a 4c 95
- kodirani paket kraj

e2 03 31 70 02 ;standardne nano komande
e2 03 31 70 07 ;standardne nano komande
ea 10 23 e1 6b ee b4 1c be 47 cb 49 8c fc a9 e4 ec ae ;CW word
f0 08 07 8b 35 8a c5 78 3e 2e ;Checksum

Do sada sam lognuo dva paketa: df 30 i df 35, pitanje je ima li unutar
paketa nesto bitno ili se radi samo o garbage paketu kojeg treba samo
preskociti. Buduci nemam originalni receiver da lognem kako izgleda komanda
koja ide kartici moja analiza ce ostati na ovome.

Po meni sanse su da se ponovo gleda TPS su vrlo visoke

Recept (malo tezi nacin):
Originalni receiver
Jtag
IDApro (ili nesto slicno)
Analiza (algo i/ili tabela)
Hack

bok,
Zac

Zahvaljujem @Zac
pozdrav Bebi

^{16.11.2004. u 19:57}

strsh

Član broj: 2289
Poruke: 137

Profil

Re: TPS alive and soon kicking

^{16.11.2004. u 20:51}

> 40 03 00 7c 0b ;standardna selekcija providera

Nije bas standardna , posto je pre bila 90 03 ,a to i aktivira ove promene.

>f0 08 07 8b 35 8a c5 78 3e 2e ;Checksum

signatura , a ne checksum...

Ali sve to nema veze , jedino se CW sad malo drugacije racuna , pa onda salje na kartu , a i to ce se skoro videti.....

/strsh

^{16.11.2004. u 20:51}

naas
France

Član broj: 1990
Poruke: 115

Profil

Re: TPS alive and soon kicking

^{17.11.2004. u 07:50}

tps i dalje radi na movc

^{17.11.2004. u 07:50}

strsh

Član broj: 2289
Poruke: 137

Profil

Re: TPS alive and soon kicking

^{17.11.2004. u 10:18}

ali samo na tps box-ovima.....

/strsh

^{17.11.2004. u 10:18}

dejandj

Član broj: 92
Poruke: 3620

Profil

Re: TPS alive and soon kicking

^{17.11.2004. u 11:16}

Daj taj "df30".

Pozdrav!

http://www.elitesecurity.org/forum/101

^{17.11.2004. u 11:16}

naas
France

Član broj: 1990
Poruke: 115

Profil

Re: TPS alive and soon kicking

^{17.11.2004. u 13:21}

tacno

^{17.11.2004. u 13:21}

globon
Saint Powest

Član broj: 17817
Poruke: 470

Profil

Re: TPS alive and soon kicking

^{17.11.2004. u 15:08}

Kao sto sam i rekao nije sve gotovo dok nije gotovo,,haknut je dump nove tps kartice pa ubrzo mozemo ocekivati i fajlove za tps.

Pozdrav

globon

^{17.11.2004. u 15:08}

naas
France

Član broj: 1990
Poruke: 115

Profil

Re: TPS alive and soon kicking

^{17.11.2004. u 17:36}

nema jos nove karte, tps radi jos sa starom kartcom u officialne recivere, znaci u 007c00.

Mozete izbrisati kluc Ob, i neki kanali ce se vratiti.

^{17.11.2004. u 17:36}

kvaka

Član broj: 27452
Poruke: 40

Sajt: www.zagreb.hr

Profil

Re: TPS alive and soon kicking

^{17.11.2004. u 19:12}

copy paste sa hr.rec.satelitska
_________________________________________
CroZac wrote:
> Bebi hvala na copy/past-u, ali da sam zelio obratiti nekom drugom
> auditoriju napravio bih to i sam. Osim toga ti si ipak u ozbiljnim
> godinama pa nije red da glumis postara, ima tu i mladjih...
>
> Bok,
>
> Zac

Primio na znanje!
--
Zdravi i veseli bili !!! Bebi
----------------------------------------
----------------------------------------

no coment!!!

______________________________

^{17.11.2004. u 19:12}

gorski

Poruke: 4288

Re: TPS alive and soon kicking

^{18.11.2004. u 01:57}

Bollocks! Ovo je za malu djecicu! Net je za razmjenu infa, a narocito ovakvog... Svasta!!

Evo dodatka sa drugih foruma, kako je i gore pomenuto:

New id: 022600 viaccess

MY REC DATA.
01B039FFFFC90000091B0500E0321301201403007C00140301 50001403020000140302260009110500E03313012014030078 001403008300B81673D7 - CRC OK
01 -> table_id
0039 -> length CAT 54 bytes
08 -> version number
01 -> current_next_indicator
00 -> section number
00 -> last section number

091B0500E0321301201403007C001403015000140302000014 03022600
091B -> CA_descriptor length 27 bytes
0500 -> France Telecom ("Viaccess")
E032 -> and 1FFF = 0032 EMM-Pid
1301 -> Unknown Viaccess descriptor length 1 bytes
20
1403 -> Viaccess Provider descriptor length 3 bytes
007C0 -> Provider TPS / Multivision
1403 -> Viaccess Provider descriptor length 3 bytes
01500 -> Provider Unknown Viaccess Provider
1403 -> Viaccess Provider descriptor length 3 bytes
02000 -> Provider Unknown Viaccess Provider
1403 -> Viaccess Provider descriptor length 3 bytes
02260 -> Provider Unknown Viaccess Provider

09110500E03313012014030078001403008300
0911 -> CA_descriptor length 17 bytes
0500 -> France Telecom ("Viaccess")
E033 -> and 1FFF = 0033 EMM-Pid
1301 -> Unknown Viaccess descriptor length 1 bytes
20
1403 -> Viaccess Provider descriptor length 3 bytes
00780 -> Provider CSN France
1403 -> Viaccess Provider descriptor length 3 bytes
00830 -> Provider Unknown Viaccess Provider

New attack:

ECM now:xx xx 40 03 00 7C 08 xx xx xx xx xx
normal ECM:xx xx 90 03 00 7C 08 xx xx xx xx

I jos jedan:

Dump of a "new" TPSCrypt Frame :

Code:

00 80 70 66 00 : Header DVB, Viaccess...
D2 01 01 : Pseudo TPSCrypt
40 03 00 7C 0B : Nano 40 instead of nano 90 for provider and key
DF 33 DA AF 8E 01 D1 D1 A6 26 6E C1 A3 26 38 1B 14 62 62 99 D9 39 AC 8F 94 79 FF 25 5A 32 0B 91 FC 75 6D 4D 6F 0E D2 C6 CA 0B 8F E5 B4 2B A6 70 EC 7F 39 56 84 : Meanless ?! nano (still the same data)
E3 03 02 D7 7E : Nano Event
E4 05 02 D7 7E 1E 00 : Nano Event
EA 10 90 78 AB 75 3A FD 27 DF BA 5A EF 5B 22 A8 80 9A : The 2 CWs
F0 08 2D 3B 97 9F BE A8 9D 7F : The signature

- The data/nanos are no more surencrypted with an XOR algo (even if nano D2 is still present)
- The nano 40 has replaced the former nano 90 for provider and key.

And some other changes concerning the CWs and the signature that i have still not elucidated.

It is confirmed that the changes come only from the official demo: the algo and data in the card have not changed.

The ECM frame is "altered" by an unknow way (for the moment) before sendind the ECM instruction to the CAM and card.

This info comes from a reliable source in the dvb world , hope it helps some peeps understand whats happened.

^{18.11.2004. u 01:57}