1 | #include "globals.h"
|
---|
2 | #include "reader-common.h"
|
---|
3 | #include "cscrypt/idea.h"
|
---|
4 | #include <termios.h>
|
---|
5 | #include <unistd.h>
|
---|
6 |
|
---|
7 | IDEA_KEY_SCHEDULE ksSession;
|
---|
8 | extern uchar cta_res[];
|
---|
9 | extern ushort cta_lr;
|
---|
10 | int is_pure_nagra=0;
|
---|
11 | int is_tiger=0;
|
---|
12 | int has_dt08=0;
|
---|
13 | unsigned char rom[15];
|
---|
14 | unsigned char plainDT08RSA[64];
|
---|
15 | unsigned char IdeaCamKey[16];
|
---|
16 | unsigned char irdId[] = {0xff,0xff,0xff,0xff};
|
---|
17 | unsigned char camid[] = {0xff,0xff,0xff,0xff};
|
---|
18 | unsigned char sessi[16];
|
---|
19 | unsigned char signature[8];
|
---|
20 | unsigned char cam_state[3];
|
---|
21 | unsigned char static_dt08[73];
|
---|
22 | unsigned char prv0401[] = {0x00, 0x00, 0x04, 0x01};
|
---|
23 | unsigned char prv3411[] = {0x00, 0x00, 0x34, 0x11};
|
---|
24 |
|
---|
25 | // Card Status checks
|
---|
26 | #define HAS_CW ((cam_state[2]&6)==6)
|
---|
27 | #define RENEW_SESSIONKEY ((cam_state[0]&128)==128 || (cam_state[0]&64)==64 || (cam_state[0]&32)==32)
|
---|
28 | #define SENDDATETIME ((cam_state[0]&16)==16)
|
---|
29 | // Datatypes
|
---|
30 | #define DT01 0x01
|
---|
31 | #define IRDINFO 0x00
|
---|
32 | #define TIERS 0x05
|
---|
33 | #define DT06 0x06
|
---|
34 | #define CAMDATA 0x08
|
---|
35 |
|
---|
36 | #define MAX_REC 20
|
---|
37 | #define SYSTEM_NAGRA 0x1800
|
---|
38 | #define SYSTEM_MASK 0xFF00
|
---|
39 |
|
---|
40 | unsigned char XorSum(const unsigned char *mem, int len)
|
---|
41 | {
|
---|
42 | unsigned char cs;
|
---|
43 | cs=0x00;
|
---|
44 | while(len>0)
|
---|
45 | {
|
---|
46 | cs ^= *mem++;
|
---|
47 | len--;
|
---|
48 | }
|
---|
49 | return cs;
|
---|
50 | }
|
---|
51 |
|
---|
52 | static time_t tier_date(ulong date, char *buf, int l)
|
---|
53 | {
|
---|
54 | time_t ut=870393600L+date*(24*3600);
|
---|
55 | if (buf)
|
---|
56 | {
|
---|
57 | struct tm *t;
|
---|
58 | t=gmtime(&ut);
|
---|
59 | snprintf(buf, l, "%04d/%02d/%02d", t->tm_year+1900, t->tm_mon+1, t->tm_mday);
|
---|
60 | }
|
---|
61 | return(ut);
|
---|
62 | }
|
---|
63 |
|
---|
64 | int do_cmd(unsigned char cmd, int ilen, unsigned char res, int rlen, unsigned char *data)
|
---|
65 | {
|
---|
66 | /*
|
---|
67 | here we build the command related to the protocol T1 for ROM142 or T14 for ROM181
|
---|
68 | the only different that i know is the command length byte msg[4], this msg[4]+=1 by a ROM181 smartcard (_nighti_)
|
---|
69 | one example for the cmd$C0
|
---|
70 | T14 protocol: 01 A0 CA 00 00 03 C0 00 06 91
|
---|
71 | T1 protocol: 21 00 08 A0 CA 00 00 02 C0 00 06 87
|
---|
72 | */
|
---|
73 | int msglen=ilen+6;
|
---|
74 | unsigned char msg[msglen];
|
---|
75 | static char nagra_head[] = {0xA0, 0xCA, 0x00, 0x00};
|
---|
76 |
|
---|
77 | memset(msg, 0, msglen);
|
---|
78 | memcpy(msg,nagra_head,4);
|
---|
79 | msg[4] = ilen;
|
---|
80 | msg[5] = cmd;
|
---|
81 | int dlen=ilen-2;
|
---|
82 | msg[6] = dlen;
|
---|
83 | if(data && dlen>0) memcpy(msg+7,data,dlen);
|
---|
84 | msg[dlen+7] = rlen;
|
---|
85 | if (dlen<0)
|
---|
86 | {
|
---|
87 | cs_debug("[nagra-reader] invalid data length encountered");
|
---|
88 | return 0;
|
---|
89 | }
|
---|
90 | if (is_pure_nagra==1)
|
---|
91 | {
|
---|
92 | msg[4]+=1;
|
---|
93 | }
|
---|
94 | if(!reader_cmd2icc(msg,msglen))
|
---|
95 | {
|
---|
96 | //cs_sleepms(15);
|
---|
97 | if(cta_res[0]!=res)
|
---|
98 | {
|
---|
99 | cs_debug("[nagra-reader] result not expected (%02x != %02x)",cta_res[0],res);
|
---|
100 | return 0;
|
---|
101 | }
|
---|
102 | if((cta_lr-2)!=rlen)
|
---|
103 | {
|
---|
104 | cs_debug("[nagra-reader] result length expected (%d != %d)",(cta_lr-2),rlen);
|
---|
105 | return 0;
|
---|
106 | }
|
---|
107 | return cta_lr;
|
---|
108 | }
|
---|
109 | return 0;
|
---|
110 | }
|
---|
111 |
|
---|
112 | int SetIFS(unsigned char size)
|
---|
113 | {
|
---|
114 | unsigned char buf[5];
|
---|
115 | int ret;
|
---|
116 | // NAD, PCB, LEN
|
---|
117 | buf[0] = 0x21;
|
---|
118 | buf[1] = 0xC1; // IFS Request cmd
|
---|
119 | buf[2] = 0x01; // cmd length
|
---|
120 | buf[3] = size; // Information Field size
|
---|
121 | buf[4] = XorSum(buf,4); //lrc byte
|
---|
122 |
|
---|
123 | cs_debug("[nagra-reader] IFS cmd: %s", cs_hexdump (1, buf, 5));
|
---|
124 | ret = reader_cmd2api(buf, 5);
|
---|
125 | if (ret < 0)
|
---|
126 | {
|
---|
127 | cs_debug("[nagra-reader] setting IFS to %02x failed", size);
|
---|
128 | return 0;
|
---|
129 | }
|
---|
130 | cs_debug("[nagra-reader] IFS is now %02x", size);
|
---|
131 | return 1;
|
---|
132 | }
|
---|
133 |
|
---|
134 | void ReverseMem(unsigned char *vIn, int len)
|
---|
135 | {
|
---|
136 | unsigned char temp;
|
---|
137 | int i;
|
---|
138 | for(i=0; i < (len/2); i++)
|
---|
139 | {
|
---|
140 | temp = vIn[i];
|
---|
141 | vIn[i] = vIn[len-i-1];
|
---|
142 | vIn[len-i-1] = temp;
|
---|
143 | }
|
---|
144 | }
|
---|
145 |
|
---|
146 | void Signature(unsigned char *sig, const unsigned char *vkey,const unsigned char *msg, int len)
|
---|
147 | {
|
---|
148 | IDEA_KEY_SCHEDULE ks;
|
---|
149 | unsigned char v[8];
|
---|
150 | unsigned char b200[16];
|
---|
151 | unsigned char b0f0[8];
|
---|
152 | memcpy(b200,vkey,sizeof(b200));
|
---|
153 | int i;
|
---|
154 | int j;
|
---|
155 | for(i=0; i<len; i+=8)
|
---|
156 | {
|
---|
157 | idea_set_encrypt_key(b200,&ks);
|
---|
158 | memset(v,0,sizeof(v));
|
---|
159 | idea_cbc_encrypt(msg+i,b0f0,8,&ks,v,IDEA_DECRYPT);
|
---|
160 | for(j=7; j>=0; j--) b0f0[j]^=msg[i+j];
|
---|
161 | memcpy(b200+0,b0f0,8);
|
---|
162 | memcpy(b200+8,b0f0,8);
|
---|
163 | }
|
---|
164 | memcpy(sig,b0f0,8);
|
---|
165 | return;
|
---|
166 | }
|
---|
167 |
|
---|
168 | int CamStateRequest(void)
|
---|
169 | {
|
---|
170 | if(do_cmd(0xC0,0x02,0xB0,0x06,NULL))
|
---|
171 | {
|
---|
172 | memcpy(cam_state,cta_res+3,3);
|
---|
173 | cs_debug("[nagra-reader] Camstate: %s",cs_hexdump (1, cam_state, 3));
|
---|
174 | }
|
---|
175 | else
|
---|
176 | {
|
---|
177 | cs_debug("[nagra-reader] CamStateRequest failed");
|
---|
178 | return 0;
|
---|
179 | }
|
---|
180 | return (1);
|
---|
181 | }
|
---|
182 |
|
---|
183 | void DateTimeCMD(void)
|
---|
184 | {
|
---|
185 | do_cmd(0xC8,0x02,0xB8,0x06,NULL);
|
---|
186 | }
|
---|
187 |
|
---|
188 | void getCamID(void)
|
---|
189 | {
|
---|
190 | /*
|
---|
191 | Hack:
|
---|
192 | Get camid. For provider 0401/3411 camid is 0xff,0xff,0xff,0xff.
|
---|
193 | for other provider we will take them from hexserial
|
---|
194 | */
|
---|
195 | if ((memcmp(prv3411,&reader[ridx].prid[0],4)==0) || (memcmp(prv0401,&reader[ridx].prid[0],4)==0))
|
---|
196 | {
|
---|
197 | memset(camid,0xff,4);
|
---|
198 | }
|
---|
199 | else
|
---|
200 | {
|
---|
201 | memcpy(camid,reader[ridx].hexserial+2,4);
|
---|
202 | }
|
---|
203 | }
|
---|
204 |
|
---|
205 | int NegotiateSessionKey_Tiger(void)
|
---|
206 | {
|
---|
207 |
|
---|
208 | unsigned char vFixed[] = {0,1,2,3,0x11};
|
---|
209 | unsigned char parte_fija[120];
|
---|
210 | unsigned char parte_variable[88];
|
---|
211 | unsigned char d1_rsa_modulo[88];
|
---|
212 | unsigned char d2_data[88];
|
---|
213 | unsigned char sign1[8];
|
---|
214 | unsigned char sessi1[8];
|
---|
215 | unsigned char sessi2[8];
|
---|
216 | unsigned char tmp[104];
|
---|
217 | unsigned char tmp1[8];
|
---|
218 | unsigned char random[88] = {0x51,0xd0,0xcc,0x4a,0x51,0xbc,0x4f,0xa4,0x7d,0x44,0xa9,0xa8,0x97,0x13,0x01,0x63,
|
---|
219 | 0x8f,0xaf,0x86,0x60,0x7c,0xe3,0xee,0x29,0xca,0x13,0x09,0x44,0x83,0x48,0x17,0x8b,
|
---|
220 | 0x88,0xa6,0x64,0x20,0x22,0x2b,0x04,0x50,0xd8,0x15,0x9c,0x50,0x09,0x7c,0x6a,0x5d,
|
---|
221 | 0xa0,0xb3,0xb0,0x11,0xa2,0x15,0x00,0x58,0xae,0x4b,0xe7,0xb0,0x06,0xa0,0x1d,0xe0,
|
---|
222 | 0x53,0x58,0x6a,0xf0,0x60,0x51,0x71,0xdb,0xe7,0x7c,0xf7,0x1b,0x37,0x9d,0x20,0xf8,
|
---|
223 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
|
---|
224 |
|
---|
225 | if(!do_cmd(0xd1,0x02,0x51,0xd2,NULL))
|
---|
226 | {
|
---|
227 | cs_debug("[nagra-reader] CMD$D1 failed");
|
---|
228 | return 0;
|
---|
229 | }
|
---|
230 |
|
---|
231 | cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[90], 32));
|
---|
232 | cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[122], 32));
|
---|
233 | cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[154], 32));
|
---|
234 | cs_debug("[nagra-reader] crypted parte_fija: %s", cs_hexdump (1, &cta_res[186], 24));
|
---|
235 |
|
---|
236 | BN_CTX *ctx = BN_CTX_new();
|
---|
237 | BIGNUM *bnN = BN_CTX_get(ctx);
|
---|
238 | BIGNUM *bnE = BN_CTX_get(ctx);
|
---|
239 | BIGNUM *bnCT = BN_CTX_get(ctx);
|
---|
240 | BIGNUM *bnPT = BN_CTX_get(ctx);
|
---|
241 | BN_bin2bn(reader[ridx].rsa_mod, 120, bnN);
|
---|
242 | BN_bin2bn(vFixed+4, 1, bnE);
|
---|
243 | BN_bin2bn(&cta_res[90], 120, bnCT);
|
---|
244 | BN_mod_exp(bnPT, bnCT, bnE, bnN, ctx);
|
---|
245 | memset(parte_fija, 0, 120);
|
---|
246 | BN_bn2bin(bnPT, parte_fija + (120-BN_num_bytes(bnPT)));
|
---|
247 | BN_CTX_end(ctx);
|
---|
248 | BN_CTX_free (ctx);
|
---|
249 |
|
---|
250 | // cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, parte_fija, 32));
|
---|
251 | // cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, &parte_fija[32], 32));
|
---|
252 | // cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, &parte_fija[64], 32));
|
---|
253 | // cs_debug("[nagra-reader] decrypted parte_fija: %s", cs_hexdump (1, &parte_fija[96], 24));
|
---|
254 |
|
---|
255 | cs_debug("[nagra-reader] ---------- SIG CHECK ---------------------");
|
---|
256 | memset(tmp,0, 104);
|
---|
257 | memcpy(tmp+4, parte_fija+11, 100);
|
---|
258 | Signature(sign1, reader[ridx].nagra_boxkey, tmp, 104);
|
---|
259 | // cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, tmp, 32));
|
---|
260 | // cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, &tmp[32], 32));
|
---|
261 | // cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, &tmp[64], 32));
|
---|
262 | // cs_debug("[nagra-reader] foo: %s", cs_hexdump (0, &tmp[96], 8));
|
---|
263 | cs_debug("[nagra-reader] sign1: %s", cs_hexdump (0, sign1, 8));
|
---|
264 | cs_debug("[nagra-reader] sign2: %s", cs_hexdump (0, parte_fija+111, 8));
|
---|
265 | if (!memcmp (parte_fija+111, sign1, 8)==0)
|
---|
266 | {
|
---|
267 | cs_debug("[nagra-reader] signature check nok");
|
---|
268 | cs_debug("[nagra-reader] ------------------------------------------");
|
---|
269 | return 0;
|
---|
270 | }
|
---|
271 | cs_debug("[nagra-reader] signature check ok");
|
---|
272 | cs_debug("[nagra-reader] ------------------------------------------");
|
---|
273 |
|
---|
274 | memcpy(reader[ridx].hexserial, parte_fija+15, 4);
|
---|
275 | memcpy(irdId, parte_fija+19, 4);
|
---|
276 | memcpy(d1_rsa_modulo,parte_fija+23,88);
|
---|
277 |
|
---|
278 | // cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, d1_rsa_modulo, 22));
|
---|
279 | // cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, &d1_rsa_modulo[22], 22));
|
---|
280 | // cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, &d1_rsa_modulo[44], 22));
|
---|
281 | // cs_debug("[nagra-reader] d1_rsa_modulo: %s", cs_hexdump (1, &d1_rsa_modulo[66], 22));
|
---|
282 | ReverseMem(cta_res+2, 88);
|
---|
283 | BN_CTX *ctx1 = BN_CTX_new();
|
---|
284 | BIGNUM *bnN1 = BN_CTX_get(ctx1);
|
---|
285 | BIGNUM *bnE1 = BN_CTX_get(ctx1);
|
---|
286 | BIGNUM *bnCT1 = BN_CTX_get(ctx1);
|
---|
287 | BIGNUM *bnPT1 = BN_CTX_get(ctx1);
|
---|
288 | BN_bin2bn(d1_rsa_modulo, 88, bnN1);
|
---|
289 | BN_bin2bn(vFixed+4, 1, bnE1);
|
---|
290 | BN_bin2bn(cta_res+2, 88, bnCT1);
|
---|
291 | BN_mod_exp(bnPT1, bnCT1, bnE1, bnN1, ctx1);
|
---|
292 | memset(parte_variable, 0, 88);
|
---|
293 | BN_bn2bin(bnPT1, parte_variable + (88-BN_num_bytes(bnPT1)));
|
---|
294 | BN_CTX_end(ctx1);
|
---|
295 | BN_CTX_free (ctx1);
|
---|
296 | // cs_debug("[nagra-reader] parte_variable: %s", cs_hexdump (1, parte_variable, 22));
|
---|
297 | // cs_debug("[nagra-reader] parte_variable: %s", cs_hexdump (1, &parte_variable[22], 22));
|
---|
298 | // cs_debug("[nagra-reader] parte_variableo: %s", cs_hexdump (1, &parte_variable[44], 22));
|
---|
299 | // cs_debug("[nagra-reader] parte_variable: %s", cs_hexdump (1, &parte_variable[66], 22));
|
---|
300 |
|
---|
301 | reader[ridx].prid[0][0]=0x00;
|
---|
302 | reader[ridx].prid[0][1]=0x00;
|
---|
303 | reader[ridx].prid[0][2]=parte_variable[73];
|
---|
304 | reader[ridx].prid[0][3]=parte_variable[74];
|
---|
305 | reader[ridx].caid[0] =(SYSTEM_NAGRA|parte_variable[76]);
|
---|
306 | memcpy(sessi1,&parte_variable[79],8);
|
---|
307 | cs_ri_log("[nagra-reader] CAID: %04X, IRD ID: %s",reader[ridx].caid[0], cs_hexdump (1,irdId,4));
|
---|
308 | cs_ri_log("[nagra-reader] ProviderID: %s",cs_hexdump (1,reader[ridx].prid[0],4));
|
---|
309 |
|
---|
310 | /*
|
---|
311 | BN_CTX *ctx2 = BN_CTX_new();
|
---|
312 | BIGNUM *rand0x50 = BN_CTX_get(ctx2);
|
---|
313 | BIGNUM *r_big = BN_CTX_get(ctx2);
|
---|
314 | BN_rand(rand0x50, 0x50, 0, 0);
|
---|
315 | //BN_mod(rand0x50, rand0x50, r_big, ctx2);
|
---|
316 | memset(rand, 0, 88);
|
---|
317 | BN_bn2bin(rand0x50, rand + (0x50-BN_num_bytes(r_big)));
|
---|
318 | rand[0] |= rand[0] & 0x80;
|
---|
319 | BN_CTX_end(ctx2);
|
---|
320 | BN_CTX_free (ctx2);
|
---|
321 |
|
---|
322 | memset(rand, 0, 88);
|
---|
323 | memcpy(rand, test_d1_resp, 80);
|
---|
324 |
|
---|
325 | cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, rand, 22));
|
---|
326 | cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, &rand[22], 22));
|
---|
327 | cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, &rand[44], 22));
|
---|
328 | cs_debug("[nagra-reader] grandom: %s", cs_hexdump (1, &rand[66], 22));
|
---|
329 | */
|
---|
330 | memcpy(sessi2,&random[72], 8);
|
---|
331 |
|
---|
332 | memset(tmp1,0,8);
|
---|
333 | memcpy(tmp1, random+72,8);
|
---|
334 | // cs_debug("[nagra-reader] byteflop last 8 bytes of random data: %s", cs_hexdump (1, tmp1, 8));
|
---|
335 | ReverseMem(tmp1, 8); //byteflop last 8 bytes of random data
|
---|
336 |
|
---|
337 | memcpy(random+72, tmp1,8); // insert back the byteflop data
|
---|
338 | // cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, random, 22));
|
---|
339 | // cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, &random[22], 22));
|
---|
340 | // cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, &random[44], 22));
|
---|
341 | // cs_debug("[nagra-reader] insert back the byteflop data: %s", cs_hexdump (1, &random[66], 22));
|
---|
342 |
|
---|
343 | memset(tmp1,0,8);
|
---|
344 | memcpy(tmp1, sessi1,8);
|
---|
345 | ReverseMem(tmp1, 8); // byteflop sessi1 one from rsa variabled part
|
---|
346 | memcpy(random+80,tmp1,8); // and attach him to random data
|
---|
347 |
|
---|
348 |
|
---|
349 | BN_CTX *ctx3 = BN_CTX_new();
|
---|
350 | BIGNUM *bnN3 = BN_CTX_get(ctx3);
|
---|
351 | BIGNUM *bnE3 = BN_CTX_get(ctx3);
|
---|
352 | BIGNUM *bnCT3 = BN_CTX_get(ctx3);
|
---|
353 | BIGNUM *bnPT3 = BN_CTX_get(ctx3);
|
---|
354 | BN_bin2bn(d1_rsa_modulo, 88, bnN3);
|
---|
355 | BN_bin2bn(vFixed+4, 1, bnE3);
|
---|
356 | BN_bin2bn(random, 88, bnCT3);
|
---|
357 | BN_mod_exp(bnPT3, bnCT3, bnE3, bnN3, ctx3);
|
---|
358 | memset(d2_data, 0, 88);
|
---|
359 | BN_bn2bin(bnPT3, d2_data + (88-BN_num_bytes(bnPT3)));
|
---|
360 | BN_CTX_end(ctx3);
|
---|
361 | BN_CTX_free (ctx3);
|
---|
362 | // cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, d2_data, 22));
|
---|
363 | // cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, &d2_data[22], 22));
|
---|
364 | // cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, &d2_data[44], 22));
|
---|
365 | // cs_debug("[nagra-reader] d2_data: %s", cs_hexdump (1, &d2_data[66], 22));
|
---|
366 | ReverseMem(d2_data, 88);
|
---|
367 |
|
---|
368 | if(!do_cmd(0xd2,0x5a,0x52,0x03, d2_data))
|
---|
369 | {
|
---|
370 | cs_debug("[nagra-reader] CMD$D2 failed");
|
---|
371 | return 0;
|
---|
372 | }
|
---|
373 | if (cta_res[2] == 0x00)
|
---|
374 | {
|
---|
375 | memcpy(sessi,sessi1,8); memcpy(sessi+8,sessi2,8);
|
---|
376 | IDEA_KEY_SCHEDULE ks;
|
---|
377 | idea_set_encrypt_key(sessi,&ks);
|
---|
378 | idea_set_decrypt_key(&ks,&ksSession);
|
---|
379 | cs_ri_log("[nagra-reader] session key: %s", cs_hexdump(1, sessi, 16));
|
---|
380 | return 1;
|
---|
381 | }
|
---|
382 | cs_ri_log("Negotiate sessionkey was not successfull! Please check tivusat rsa key");
|
---|
383 | return 0;
|
---|
384 |
|
---|
385 | }
|
---|
386 |
|
---|
387 | int NegotiateSessionKey(void)
|
---|
388 | {
|
---|
389 | unsigned char cmd2b[] = {0x21, 0x40, 0x48, 0xA0, 0xCA, 0x00, 0x00, 0x43, 0x2B, 0x40, 0x1C, 0x54, 0xd1, 0x26, 0xe7, 0xe2, 0x40, 0x20, 0xd1, 0x66, 0xf4, 0x18, 0x97, 0x9d, 0x5f, 0x16, 0x8f, 0x7f, 0x7a, 0x55, 0x15, 0x82, 0x31, 0x14, 0x06, 0x57, 0x1a, 0x3f, 0xf0, 0x75, 0x62, 0x41, 0xc2, 0x84, 0xda, 0x4c, 0x2e, 0x84, 0xe9, 0x29, 0x13, 0x81, 0xee, 0xd6, 0xa9, 0xf5, 0xe9, 0xdb, 0xaf, 0x22, 0x51, 0x3d, 0x44, 0xb3, 0x20, 0x83, 0xde, 0xcb, 0x5f, 0x35, 0x2b, 0xb0, 0xce, 0x70, 0x02, 0x00};
|
---|
390 | unsigned char negot[64];
|
---|
391 | unsigned char tmp[64];
|
---|
392 | unsigned char idea1[16];
|
---|
393 | unsigned char idea2[16];
|
---|
394 | unsigned char sign1[8];
|
---|
395 | unsigned char sign2[8];
|
---|
396 |
|
---|
397 | if (is_tiger)
|
---|
398 | {
|
---|
399 | if (!NegotiateSessionKey_Tiger())
|
---|
400 | {
|
---|
401 | cs_debug("[nagra-reader] NegotiateSessionKey_Tiger failed");
|
---|
402 | return 0;
|
---|
403 | }
|
---|
404 | return 1;
|
---|
405 | }
|
---|
406 | if (!has_dt08) // if we have no valid dt08 calc then we use rsa from config and hexserial for calc of sessionkey
|
---|
407 | {
|
---|
408 | memcpy(plainDT08RSA, reader[ridx].rsa_mod, 64);
|
---|
409 | memcpy(signature,reader[ridx].nagra_boxkey, 8);
|
---|
410 | }
|
---|
411 | if(!do_cmd(0x2a,0x02,0xaa,0x42,NULL))
|
---|
412 | {
|
---|
413 | cs_debug("[nagra-reader] CMD$2A failed");
|
---|
414 | return 0;
|
---|
415 | }
|
---|
416 |
|
---|
417 | // RSA decrypt of cmd$2a data, result is stored in "negot"
|
---|
418 | ReverseMem(cta_res+2, 64);
|
---|
419 | //cs_debug("[nagra-reader] plainDT08RSA: %s", cs_hexdump (1, plainDT08RSA, 32));
|
---|
420 | //cs_debug("[nagra-reader] plainDT08RSA: %s", cs_hexdump (1, &plainDT08RSA[32], 32));
|
---|
421 | unsigned char vFixed[] = {0,1,2,3};
|
---|
422 | BN_CTX *ctx = BN_CTX_new();
|
---|
423 | BIGNUM *bnN = BN_CTX_get(ctx);
|
---|
424 | BIGNUM *bnE = BN_CTX_get(ctx);
|
---|
425 | BIGNUM *bnCT = BN_CTX_get(ctx);
|
---|
426 | BIGNUM *bnPT = BN_CTX_get(ctx);
|
---|
427 | BN_bin2bn(plainDT08RSA, 64, bnN);
|
---|
428 | BN_bin2bn(vFixed+3, 1, bnE);
|
---|
429 | BN_bin2bn(cta_res+2, 64, bnCT);
|
---|
430 | BN_mod_exp(bnPT, bnCT, bnE, bnN, ctx);
|
---|
431 | memset(negot, 0, 64);
|
---|
432 | BN_bn2bin(bnPT, negot + (64-BN_num_bytes(bnPT)));
|
---|
433 | //cs_debug("[nagra-reader] DT08 decrypted $2a data: %s", cs_hexdump (1, negot, 32));
|
---|
434 | //cs_debug("[nagra-reader] DT08 decrypted $2a data: %s", cs_hexdump (1, &negot[32], 32));
|
---|
435 |
|
---|
436 | memcpy(tmp, negot, 64);
|
---|
437 | ReverseMem(tmp, 64);
|
---|
438 |
|
---|
439 | // build sessionkey
|
---|
440 | // first halve is IDEA Hashed in chuncs of 8 bytes using the Signature1 from dt08 calc, CamID-Inv.CamID(16 bytes key) the results are the First 8 bytes of the Session key
|
---|
441 | memcpy(idea1, signature, 8);
|
---|
442 | memcpy(idea1+8, reader[ridx].hexserial+2, 4);
|
---|
443 | idea1[12] = ~reader[ridx].hexserial[2]; idea1[13] = ~reader[ridx].hexserial[3]; idea1[14] = ~reader[ridx].hexserial[4]; idea1[15] = ~reader[ridx].hexserial[5];
|
---|
444 |
|
---|
445 | Signature(sign1, idea1, tmp, 32);
|
---|
446 | memcpy(idea2,sign1,8); memcpy(idea2+8,sign1,8);
|
---|
447 | Signature(sign2, idea2, tmp, 32);
|
---|
448 | memcpy(sessi,sign1,8); memcpy(sessi+8,sign2,8);
|
---|
449 |
|
---|
450 | // prepare cmd$2b data
|
---|
451 | BN_bin2bn(negot, 64, bnCT);
|
---|
452 | BN_mod_exp(bnPT, bnCT, bnE, bnN, ctx);
|
---|
453 | memset(cmd2b+10, 0, 64);
|
---|
454 | BN_bn2bin(bnPT, cmd2b+10 + (64-BN_num_bytes(bnPT)));
|
---|
455 | BN_CTX_end(ctx);
|
---|
456 | BN_CTX_free (ctx);
|
---|
457 | ReverseMem(cmd2b+10, 64);
|
---|
458 |
|
---|
459 | IDEA_KEY_SCHEDULE ks;
|
---|
460 | idea_set_encrypt_key(sessi,&ks);
|
---|
461 | idea_set_decrypt_key(&ks,&ksSession);
|
---|
462 |
|
---|
463 | if(!do_cmd(0x2b,0x42,0xab,0x02, cmd2b+10))
|
---|
464 | {
|
---|
465 | cs_debug("[nagra-reader] CMD$2B failed");
|
---|
466 | return 0;
|
---|
467 | }
|
---|
468 |
|
---|
469 | cs_debug("[nagra-reader] session key: %s", cs_hexdump(1, sessi, 16));
|
---|
470 |
|
---|
471 | if (!CamStateRequest())
|
---|
472 | {
|
---|
473 | cs_debug("[nagra-reader] CamStateRequest failed");
|
---|
474 | return 0;
|
---|
475 | }
|
---|
476 | if SENDDATETIME
|
---|
477 | {
|
---|
478 | DateTimeCMD();
|
---|
479 | }
|
---|
480 | if RENEW_SESSIONKEY
|
---|
481 | {
|
---|
482 | cs_ri_log("Negotiate sessionkey was not successfull! Please check rsa key and boxkey");
|
---|
483 | return 0;
|
---|
484 | }
|
---|
485 |
|
---|
486 | return 1;
|
---|
487 | }
|
---|
488 |
|
---|
489 | void decryptDT08(void)
|
---|
490 | {
|
---|
491 |
|
---|
492 | unsigned char vFixed[] = {0,1,2,3};
|
---|
493 | unsigned char v[72];
|
---|
494 | unsigned char buf[72];
|
---|
495 | unsigned char sign2[8];
|
---|
496 | int i, n;
|
---|
497 | BN_CTX *ctx;
|
---|
498 | BIGNUM *bn_mod, *bn_exp, *bn_data, *bn_res;
|
---|
499 |
|
---|
500 | memcpy(static_dt08, &cta_res[12], 73);
|
---|
501 | // decrypt RSA Part of dt08
|
---|
502 | bn_mod = BN_new ();
|
---|
503 | bn_exp = BN_new ();
|
---|
504 | bn_data = BN_new ();
|
---|
505 | bn_res = BN_new ();
|
---|
506 | ctx= BN_CTX_new();
|
---|
507 | if (ctx == NULL) cs_debug("[nagra-reader] RSA Error in dt08 decrypt");
|
---|
508 | //cs_debug("[nagra-reader] DT08 RSA modulus: %s", cs_hexdump (1, reader[ridx].rsa_mod, 32));
|
---|
509 | //cs_debug("[nagra-reader] DT08 RSA modulus: %s", cs_hexdump (1, &reader[ridx].rsa_mod[32], 32));
|
---|
510 | ReverseMem(static_dt08+1, 64);
|
---|
511 | BN_bin2bn (reader[ridx].rsa_mod, 64, bn_mod); // rsa modulus
|
---|
512 | BN_bin2bn (vFixed+3, 1, bn_exp); // exponent
|
---|
513 | BN_bin2bn (static_dt08+1, 64, bn_data);
|
---|
514 | //cs_debug("[nagra-reader] DT08 crypted rsa: %s", cs_hexdump (1, static_dt08+1, 32));
|
---|
515 | //cs_debug("[nagra-reader] DT08 crypted rsa: %s", cs_hexdump (1, static_dt08+33, 32));
|
---|
516 | BN_mod_exp (bn_res, bn_data, bn_exp, bn_mod, ctx);
|
---|
517 | memset (static_dt08+1, 0, 64);
|
---|
518 | n = BN_bn2bin (bn_res, static_dt08+1);
|
---|
519 | ReverseMem(static_dt08+1, n);
|
---|
520 | //cs_debug("[nagra-reader] DT08 decrypted rsa: %s", cs_hexdump (1, static_dt08+1, 32));
|
---|
521 | //cs_debug("[nagra-reader] DT08 decrypted rsa: %s", cs_hexdump (1, static_dt08+33, 32));
|
---|
522 |
|
---|
523 | // RSA data can never be bigger than the modulo
|
---|
524 | static_dt08[64] |= static_dt08[0] & 0x80;
|
---|
525 |
|
---|
526 | // IdeaCamKey
|
---|
527 | memcpy (&IdeaCamKey[0], reader[ridx].nagra_boxkey, 8);
|
---|
528 | memcpy (&IdeaCamKey[8], irdId, 4);
|
---|
529 | for (i = 0; i < 4; i++)
|
---|
530 | IdeaCamKey[12 + i] = ~irdId[i];
|
---|
531 | //cs_debug("[nagra-reader] DT08 Plainkey: %s", cs_hexdump (1, IdeaCamKey, 16));
|
---|
532 |
|
---|
533 | // now IDEA decrypt
|
---|
534 | IDEA_KEY_SCHEDULE ks;
|
---|
535 | idea_set_encrypt_key(IdeaCamKey,&ks);
|
---|
536 | idea_set_decrypt_key(&ks,&ksSession);
|
---|
537 | //cs_debug("[nagra-reader] dt08 idea part: %s", cs_hexdump (1, static_dt08+65, 8));
|
---|
538 | memcpy (&buf[0], static_dt08+1, 64);
|
---|
539 | memcpy (&buf[64], static_dt08+65, 8);
|
---|
540 | //cs_debug("[nagra-reader] dt08 64byte rsa decrypted + 8last byte: %s", cs_hexdump (1, buf, 64));
|
---|
541 | //cs_debug("[nagra-reader] dt08 64byte rsa decrypted + 8last byte: %s", cs_hexdump (1, &buf[64], 8));
|
---|
542 | memset(v,0,sizeof(v));
|
---|
543 | memset(static_dt08,0,sizeof(static_dt08));
|
---|
544 | idea_cbc_encrypt(buf,static_dt08,72,&ksSession,v,IDEA_DECRYPT);
|
---|
545 | //cs_debug("[nagra-reader] dt08 72byte idea decrypted: %s", cs_hexdump (1, &static_dt08[0], 36));
|
---|
546 | //cs_debug("[nagra-reader] dt08 72byte idea decrypted: %s", cs_hexdump (1, &static_dt08[35], 37));
|
---|
547 |
|
---|
548 | getCamID();
|
---|
549 | cs_debug("[nagra-reader] using camid %sfor dt08 calc",cs_hexdump (1,camid,4));
|
---|
550 |
|
---|
551 | // Calculate signature
|
---|
552 | memcpy (signature, static_dt08, 8);
|
---|
553 | memset (static_dt08 + 0, 0, 4);
|
---|
554 | memcpy (static_dt08 + 4, camid, 4);
|
---|
555 | Signature(sign2,IdeaCamKey,static_dt08,72);
|
---|
556 |
|
---|
557 | BN_CTX_free (ctx);
|
---|
558 | //cs_debug("[nagra-reader] dt08 sign1: %s", cs_hexdump (0, signature, 8));
|
---|
559 | //cs_debug("[nagra-reader] dt08 sign2: %s", cs_hexdump (0, sign2, 8));
|
---|
560 |
|
---|
561 | if (memcmp (signature, sign2, 8)==0)
|
---|
562 | {
|
---|
563 | has_dt08=1;
|
---|
564 | memcpy (plainDT08RSA, static_dt08+8, 64);
|
---|
565 | cs_debug("[nagra-reader] DT08 signature check ok");
|
---|
566 | }
|
---|
567 | else
|
---|
568 | {
|
---|
569 | has_dt08=0;
|
---|
570 | cs_debug("[nagra-reader] DT08 signature check nok");
|
---|
571 | }
|
---|
572 | }
|
---|
573 |
|
---|
574 | void addProvider(int id)
|
---|
575 | {
|
---|
576 | int i;
|
---|
577 | int toadd=1;
|
---|
578 | for (i=0; i<reader[ridx].nprov; i++)
|
---|
579 | {
|
---|
580 | if ((cta_res[7]==reader[ridx].prid[i][2]) && (cta_res[8]==reader[ridx].prid[i][3]))
|
---|
581 | {
|
---|
582 | toadd = 0;
|
---|
583 | }
|
---|
584 | }
|
---|
585 | if (toadd)
|
---|
586 | {
|
---|
587 | reader[ridx].prid[reader[ridx].nprov][0]=0;
|
---|
588 | reader[ridx].prid[reader[ridx].nprov][1]=0;
|
---|
589 | reader[ridx].prid[reader[ridx].nprov][2]=cta_res[7];
|
---|
590 | reader[ridx].prid[reader[ridx].nprov][3]=cta_res[8];
|
---|
591 | memcpy(reader[ridx].sa[reader[ridx].nprov], reader[ridx].sa[0], 4);
|
---|
592 | reader[ridx].nprov+=1;
|
---|
593 | }
|
---|
594 | }
|
---|
595 |
|
---|
596 | int ParseDataType(unsigned char dt)
|
---|
597 | {
|
---|
598 | char ds[16], de[16];
|
---|
599 | ushort chid;
|
---|
600 | switch(dt)
|
---|
601 | {
|
---|
602 | case IRDINFO:
|
---|
603 | {
|
---|
604 | reader[ridx].prid[0][0]=0;
|
---|
605 | reader[ridx].prid[0][1]=0;
|
---|
606 | reader[ridx].prid[0][2]=cta_res[7];
|
---|
607 | reader[ridx].prid[0][3]=cta_res[8];
|
---|
608 | memcpy(reader[ridx].sa[0], reader[ridx].sa[0], 4);
|
---|
609 | /*
|
---|
610 | reader[ridx].prid[1][0]=0x00;
|
---|
611 | reader[ridx].prid[1][1]=0x00;
|
---|
612 | reader[ridx].prid[1][2]=0x00;
|
---|
613 | reader[ridx].prid[1][3]=0x00;
|
---|
614 | memcpy(reader[ridx].sa[1], reader[ridx].sa[0], 4);
|
---|
615 | reader[ridx].nprov+=1;
|
---|
616 | */
|
---|
617 | reader[ridx].caid[0] =(SYSTEM_NAGRA|cta_res[11]);
|
---|
618 | //reader[ridx].caid[0] =0x1801;
|
---|
619 | memcpy(irdId,cta_res+14,4);
|
---|
620 | cs_debug("[nagra-reader] CAID: %04X, IRD ID: %s",reader[ridx].caid[0], cs_hexdump (1,irdId,4));
|
---|
621 | cs_debug("[nagra-reader] ProviderID: %s",cs_hexdump (1,reader[ridx].prid[0],4));
|
---|
622 | return 1;
|
---|
623 | }
|
---|
624 | case TIERS:
|
---|
625 | if ((cta_lr>33) && (chid=b2i(2, cta_res+11)))
|
---|
626 | {
|
---|
627 | int id=(cta_res[7]*256)|cta_res[8];
|
---|
628 | tier_date(b2i(2, cta_res+20)-0x7f7, ds, 15);
|
---|
629 | tier_date(b2i(2, cta_res+13)-0x7f7, de, 15);
|
---|
630 | cs_ri_log("|%04X|%04X |%s |%s |", id,chid, ds, de);
|
---|
631 | addProvider(id);
|
---|
632 | }
|
---|
633 | case 0x08:
|
---|
634 | case 0x88: if (cta_res[11] == 0x49) decryptDT08();
|
---|
635 | default:
|
---|
636 | return 1;
|
---|
637 | }
|
---|
638 | return 0;
|
---|
639 | }
|
---|
640 |
|
---|
641 | int GetDataType(unsigned char dt, int len, int shots)
|
---|
642 | {
|
---|
643 | int i;
|
---|
644 | for(i=0; i<shots; i++)
|
---|
645 | {
|
---|
646 | if(!do_cmd(0x22,0x03,0xA2,len,&dt))
|
---|
647 | {
|
---|
648 | cs_debug("[nagra-reader] failed to get datatype %02X",dt);
|
---|
649 | return 0;
|
---|
650 | }
|
---|
651 | if((cta_res[2]==0) && (dt != 0x08 || dt != 0x88)) return 1;
|
---|
652 | if(!ParseDataType(dt&0x0F)) return 0;
|
---|
653 | if ((dt != 0x08 || dt != 0x88) && (cta_res[11] == 0x49)) return 1; //got dt08 data
|
---|
654 | dt|=0x80; // get next item
|
---|
655 | }
|
---|
656 | return 1;
|
---|
657 | }
|
---|
658 |
|
---|
659 | int nagra2_card_init(uchar *atr, int atrlen)
|
---|
660 | {
|
---|
661 | memset(rom, 0, 15);
|
---|
662 | reader[ridx].nprov = 1;
|
---|
663 | memset (reader[ridx].sa, 0xff, sizeof (reader[ridx].sa));
|
---|
664 | memset(reader[ridx].hexserial, 0, 8);
|
---|
665 | reader[ridx].caid[0]=SYSTEM_NAGRA;
|
---|
666 |
|
---|
667 | if (memcmp(atr+11, "DNASP", 5)==0)
|
---|
668 | {
|
---|
669 | if(SetIFS(0xFE) != 1) return 0;
|
---|
670 | cs_debug("[nagra-reader] detect native nagra card T1 protocol");
|
---|
671 | memcpy(rom,atr+11,15);
|
---|
672 | }
|
---|
673 | else if (memcmp(atr+11, "TIGER", 5)==0 || (memcmp(atr+11, "NCMED", 5)==0))
|
---|
674 | {
|
---|
675 | if(SetIFS(0xFE) != 1) return 0;
|
---|
676 | cs_debug("[nagra-reader] detect nagra tiger card");
|
---|
677 | memcpy(rom,atr+11,15);
|
---|
678 | is_tiger=1;
|
---|
679 | }
|
---|
680 | else if (!memcmp(atr+4, "IRDETO", 6))
|
---|
681 | {
|
---|
682 | cs_debug("[nagra-reader] detect Irdeto tunneled nagra card");
|
---|
683 | if(!reader[ridx].nagra_native) return 0;
|
---|
684 | cs_debug("[nagra-reader] using nagra mode");
|
---|
685 | is_pure_nagra=1;
|
---|
686 | if(!do_cmd(0x10,0x02,0x90,0x11,0))
|
---|
687 | {
|
---|
688 | cs_debug("[nagra-reader] get rom version failed");
|
---|
689 | return 0;
|
---|
690 | }
|
---|
691 | memcpy(rom,cta_res+2,15);
|
---|
692 | }
|
---|
693 | else return 0;
|
---|
694 |
|
---|
695 | if (!is_tiger)
|
---|
696 | {
|
---|
697 | CamStateRequest();
|
---|
698 | if(!do_cmd(0x12,0x02,0x92,0x06,0))
|
---|
699 | {
|
---|
700 | cs_debug("[nagra-reader] get Serial failed");
|
---|
701 | return 0;
|
---|
702 | }
|
---|
703 | memcpy(reader[ridx].hexserial+2, cta_res+2, 4);
|
---|
704 | cs_debug("[nagra-reader] SER: %s", cs_hexdump (1, reader[ridx].hexserial, 4));
|
---|
705 | memcpy(reader[ridx].sa[0], cta_res+2, 4);
|
---|
706 |
|
---|
707 | if(!GetDataType(DT01,0x0E,MAX_REC)) return 0;
|
---|
708 | cs_debug("[nagra-reader] DT01 DONE");
|
---|
709 | CamStateRequest();
|
---|
710 | if(!GetDataType(IRDINFO,0x39,MAX_REC)) return 0;
|
---|
711 | cs_debug("[nagra-reader] IRDINFO DONE");
|
---|
712 | CamStateRequest();
|
---|
713 | if(!GetDataType(CAMDATA,0x55,10)) return 0;
|
---|
714 | cs_debug("[nagra-reader] CAMDATA Done");
|
---|
715 | if(!GetDataType(0x04,0x44,MAX_REC)) return 0;
|
---|
716 | cs_debug("[nagra-reader] DT04 DONE");
|
---|
717 | CamStateRequest();
|
---|
718 |
|
---|
719 | if (!memcmp(rom+5, "181", 3)==0) //dt05 is not supported by rom181
|
---|
720 | {
|
---|
721 | cs_ri_log("-----------------------------------------");
|
---|
722 | cs_ri_log("|id |tier |valid from |valid to |");
|
---|
723 | cs_ri_log("+----+--------+------------+------------+");
|
---|
724 | if(!GetDataType(TIERS,0x57,MAX_REC)) return 0;
|
---|
725 | cs_ri_log("-----------------------------------------");
|
---|
726 | CamStateRequest();
|
---|
727 | }
|
---|
728 |
|
---|
729 | if(!GetDataType(DT06,0x16,MAX_REC)) return 0;
|
---|
730 | cs_debug("[nagra-reader] DT06 DONE");
|
---|
731 | CamStateRequest();
|
---|
732 | }
|
---|
733 | if (!NegotiateSessionKey())
|
---|
734 | {
|
---|
735 | cs_debug("[nagra-reader] NegotiateSessionKey failed");
|
---|
736 | return 0;
|
---|
737 | }
|
---|
738 |
|
---|
739 | return 1;
|
---|
740 | }
|
---|
741 |
|
---|
742 | int nagra2_card_info(void)
|
---|
743 | {
|
---|
744 | int i;
|
---|
745 | cs_ri_log("ROM: %c %c %c %c %c %c %c %c", rom[0], rom[1], rom[2],rom[3], rom[4], rom[5], rom[6], rom[7]);
|
---|
746 | cs_ri_log("REV: %c %c %c %c %c %c", rom[9], rom[10], rom[11], rom[12], rom[13], rom[14]);
|
---|
747 | cs_ri_log("SER: %s", cs_hexdump (1, reader[ridx].hexserial+2, 4));
|
---|
748 | cs_ri_log("CAID: %04X",reader[ridx].caid[0]);
|
---|
749 | cs_ri_log("Prv.ID: %s(sysid)",cs_hexdump (1,reader[ridx].prid[0],4));
|
---|
750 | for (i=1; i<reader[ridx].nprov; i++)
|
---|
751 | {
|
---|
752 | cs_ri_log("Prv.ID: %s",cs_hexdump (1,reader[ridx].prid[i],4));
|
---|
753 | }
|
---|
754 | cs_log("ready for requests");
|
---|
755 | return 1;
|
---|
756 | }
|
---|
757 |
|
---|
758 | void nagra2_post_process(void)
|
---|
759 | {
|
---|
760 | if (!is_tiger)
|
---|
761 | {
|
---|
762 | CamStateRequest();
|
---|
763 | cs_sleepms(10);
|
---|
764 | if RENEW_SESSIONKEY NegotiateSessionKey();
|
---|
765 | if SENDDATETIME DateTimeCMD();
|
---|
766 | }
|
---|
767 | }
|
---|
768 |
|
---|
769 | int nagra2_do_ecm(ECM_REQUEST *er)
|
---|
770 | {
|
---|
771 | if (!is_tiger)
|
---|
772 | {
|
---|
773 | int retry=0;
|
---|
774 | if(!do_cmd(er->ecm[3],er->ecm[4]+2,0x87,0x02, er->ecm+3+2))
|
---|
775 | {
|
---|
776 | cs_debug("[nagra-reader] nagra2_do_ecm failed, retry");
|
---|
777 | if(!do_cmd(er->ecm[3],er->ecm[4]+2,0x87,0x02, er->ecm+3+2))
|
---|
778 | {
|
---|
779 | cs_debug("[nagra-reader] nagra2_do_ecm failed");
|
---|
780 | return (0);
|
---|
781 | }
|
---|
782 |
|
---|
783 | }
|
---|
784 | cs_sleepms(10);
|
---|
785 | while(!CamStateRequest() && retry < 5)
|
---|
786 | {
|
---|
787 | cs_debug("[nagra-reader] CamStateRequest failed, try: %d", retry);
|
---|
788 | retry++;
|
---|
789 | cs_sleepms(15);
|
---|
790 | }
|
---|
791 | cs_sleepms(10);
|
---|
792 | if (HAS_CW && do_cmd(0x1C,0x02,0x9C,0x36,NULL))
|
---|
793 | {
|
---|
794 | unsigned char v[8];
|
---|
795 | memset(v,0,sizeof(v));
|
---|
796 | idea_cbc_encrypt(&cta_res[30],er->cw,8,&ksSession,v,IDEA_DECRYPT);
|
---|
797 | memset(v,0,sizeof(v));
|
---|
798 | idea_cbc_encrypt(&cta_res[4],er->cw+8,8,&ksSession,v,IDEA_DECRYPT);
|
---|
799 | if ((memcmp(prv3411,&reader[ridx].prid[0],4)==0) || (memcmp(prv0401,&reader[ridx].prid[0],4)==0))
|
---|
800 | {
|
---|
801 | unsigned char tt[8];
|
---|
802 | memcpy(&tt[0],&er->cw[0],8);
|
---|
803 | memcpy(&er->cw[0],&er->cw[8],8);
|
---|
804 | memcpy(&er->cw[8],&tt[0],8);
|
---|
805 | }
|
---|
806 | return (1);
|
---|
807 | }
|
---|
808 | }
|
---|
809 | else
|
---|
810 | {
|
---|
811 | // ecm_data: 80 30 89 D3 87 54 11 10 DA A6 0F 4B 92 05 34 00 ...
|
---|
812 | //serial_data: A0 CA 00 00 8C D3 8A 00 00 00 00 00 10 DA A6 0F .
|
---|
813 | unsigned char ecm_trim[150];
|
---|
814 | memset(ecm_trim, 0, 150);
|
---|
815 | memcpy(&ecm_trim[5], er->ecm+3+2+2, er->ecm[4]+2);
|
---|
816 | if(do_cmd(er->ecm[3],er->ecm[4]+5,0x53,0x16, ecm_trim))
|
---|
817 | {
|
---|
818 | if(cta_res[2] == 0x01)
|
---|
819 | {
|
---|
820 |
|
---|
821 | unsigned char v[8];
|
---|
822 | memset(v,0,sizeof(v));
|
---|
823 | idea_cbc_encrypt(&cta_res[14],er->cw,8,&ksSession,v,IDEA_DECRYPT);
|
---|
824 | memset(v,0,sizeof(v));
|
---|
825 | idea_cbc_encrypt(&cta_res[6],er->cw+8,8,&ksSession,v,IDEA_DECRYPT);
|
---|
826 | return (1);
|
---|
827 | }
|
---|
828 | cs_debug("[nagra-reader] can't decode ecm");
|
---|
829 | return (0);
|
---|
830 | }
|
---|
831 | }
|
---|
832 | return(0);
|
---|
833 | }
|
---|
834 |
|
---|
835 | int nagra2_do_emm(EMM_PACKET *ep)
|
---|
836 | {
|
---|
837 | if(!do_cmd(ep->emm[8],ep->emm[9]+2,0x84,0x02,ep->emm+8+2))
|
---|
838 | {
|
---|
839 | cs_debug("[nagra-reader] nagra2_do_emm failed");
|
---|
840 | return (0);
|
---|
841 | }
|
---|
842 | cs_sleepms(300);
|
---|
843 | nagra2_post_process();
|
---|
844 | return 1;
|
---|
845 | }
|
---|