EMM-G DIGI TV CHANGE 00 (06) 07-09-2009

 

EMM-G Encriptada Precam :

82706C000000000004652011920098FB1FDBEEE1BB3464AD

0B04D0119A363BA3AAC15996BDF8D2F9718CCF16B8AC10

8C989EEA5FCF9B401CCCD18C0EE9B86B20735343F6A859

CD3A1BB2F4C4C0E4F4188EC73B888E5DEC9E72022A884B

75C8DFE4A2FD04B63268C9EBAE18C000D107

 

EMM-G Encriptada Postcam :

21006DA0CA00006704652011920098FB1FDBEEE1BB3464AD

0B04D0119A363BA3AAC15996BDF8D2F9718CCF16B8AC108

C989EEA5FCF9B401CCCD18C0EE9B86B20735343F6A859CD

3A1BB2F4C4C0E4F4188EC73B888E5DEC9E72022A884B75C

8DFE4A2FD04B63268C9EBAE18C000D107027E

 

EMM-G Desencriptada :

779CB669AF8BC57B201113DB00011A337789BA8A9BB60D88

A4F1AA02B70DA641B7163F153A151216AE1BCD82209D1316

B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD832111

420110060800106F91B55DB76F1C38F8D3E2D531002C090000

 

Analyzer :

779CB669AF8BC57B 2011 13DB0001 1A337789 [BA] 8A9BB60D88A4F1AA02B70DA641B7163F153A151216AE1BCD82

209D1316B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD

83 2111 42 011006080010 6F91B55DB76F1C38F8D3E2D531002C09

0000

 

779CB669AF8BC57B        Signature

2011                                    Provider   (Digi TV (Rumania))

13DB0001                          Creacion   (Creation)  (01/12/2005 00:00:02)

1A337789                           Expiracion (Expiry)     (13/05/2010 17:00:02)

 

Cmd   BA (Execute ST Code)

Code : 8A9BB60D88A4F1AA02B70DA641B7163F153A151216AE1BCD

82209D1316B8DCB7DC9FB814B8D3B7D384B70D86A632CC9BDD

 

Code Disassembly ST19:

RAM $00:0093: 8A                PUSH CC                          

RAM $00:0094: 9B                SIM                                    

RAM $00:0095: B60D           LD A,($0D)                       

RAM $00:0097: 88                PUSH A              

RAM $00:0098: A4F1            AND A,#F1                        

RAM $00:009A: AA02           OR A,#02                          

RAM $00:009C: B70D           LD ($0D),A                       

RAM $00:009E: A641           LD A,#41                           

RAM $00:00A0: B716           LD ($16),A                        

RAM $00:00A2: 3F15            CLR ($15)                         

RAM $00:00A4: 3A15           DEC ($15)                         

RAM $00:00A6: 1216           BSET ($16),#01              

RAM $00:00A8: AE1B           LD X,#1B                          

RAM $00:00AA: CD8220      CALL $8220     

 

» » » Edit Rom110 (Add code:AB515FAEA081 ($00:8220))

 

ROM $00:8220: AB51           ADD A,#51        A + 51= 92            

ROM $00:8222: 5F                CLR X                 X = 0                     

ROM $00:8223: AEA0           LD X,#A0           X = A0   

ROM $00:8225: 81                RET                    

               

New A=92  X=A0  Y=00 !!!! 

               

RAM $0000AD: 9D                NOP                                   

RAM $0000AE: 1316            BRES ($16),#01              

 

           Key= 6F91B55DB76F1C38 F8D3E2D531002C09

               

RAM $0000B0: B8DC           XOR A,($DC)     2C ($DC) XOR 92 (A)  = BE ($DC)  

RAM $0000B2: B7DC           LD ($DC),A        Change 2C ($DC) to BE ($DC)

 

           Key= 6F91B55DB76F1C38 F8D3E2D53100(BE)09

               

RAM $0000B4: 9F                 LD A,X                A= A0    

RAM $0000B5: B814            XOR A,($14)      A0 (A) XOR F9 ($14) = 59 (A)          

RAM $0000B7: B8D3            XOR A,($D3)     59 (A) XOR 6F ($D3) = 36 ($D3)     

RAM $0000B9: B7D3            LD ($D3),A         Change 6F ($D3) to 36 ($D3)

               

           Key= 6F91B55DB7(36)1C38 F8D3E2D53100(BE)09

 

RAM $0000BB: 84                 POP A                               

RAM $0000BC: B70D           LD ($0D),A        

RAM $0000BE: 86                 POP CC                            

RAM $0000BF: A632            LD A,#32                          

RAM $0000C1: CC9BDD      JMP $9BDD                     

 

Cmd83                          Change Provider id --> 2111

Cmd42                          Key Update Found

Cmd42                          Data      :0110'06'080010   (06= Index 00)

Cmd42                          Key 06  :6F91B55DB7(36)1C38 F8D3E2D53100(BE)09

                                       0000

 

6F91B55DB7361C38 = 8 Bytes Desencrypt

F8D3E2D53100BE09 = 8 Bytes Encrypt

 

PostAU Provid: 2011  Type: 12 (AC6)

 

 

B                                     'Xor' Key DES AC6                = key DES Permuted

026ABE6E70CC4A3C 'Xor' 81BE2D2CA5BC1607 = 83D49342D5705C3B

 

KEY= (('6F91B55DB7361C38')) (('F8D3E2D53100BE09'))

 

Key DES Permuted      "DES (Encrypt)"   Primer octeto key     = xxxxxxxxxxxxxxxx

83D49342D5705C3B   "DES (Encrypt)"   6F91B55DB7361C38 = 3DEDB92B296B13C8

 

                                                 Segund octet key

3DEDB92B296B13C8 'Xor' F8D3E2D53100BE09 = C53E5BFE186BADC1

 

Second octet key Desencrypt --> C53E5BFE186BADC1

 

Cmd42      Added Key : N2 2111 00 6F91B55DB7361C38 C53E5BFE186BADC1