source: branches/smartreader/reader-nagra.c@ 1271

Last change on this file since 1271 was 1271, checked in by rorothetroll, 13 years ago

resync with trunk
File size: 21.3 KB
Line 
1#include "globals.h"
2#include "reader-common.h"
3#include "cscrypt/idea.h"
4#include <termios.h>
5#include <unistd.h>
6
7IDEA_KEY_SCHEDULE ksSession;
8extern uchar cta_res[];
9extern ushort cta_lr;
10int is_pure_nagra=0;
11int is_tiger=0;
12int has_dt08=0;
13int swapCW=0;
14unsigned char rom[15];
15unsigned char plainDT08RSA[64];
16unsigned char IdeaCamKey[16];
17unsigned char irdId[] = {0xff,0xff,0xff,0xff};
18unsigned char sessi[16];
19unsigned char signature[8];
20unsigned char cam_state[3];
21
22// Card Status checks
23#define HAS_CW ((cam_state[2]&6)==6)
24#define RENEW_SESSIONKEY ((cam_state[0]&128)==128 || (cam_state[0]&64)==64 || (cam_state[0]&32)==32)
25#define SENDDATETIME ((cam_state[0]&16)==16)
26// Datatypes
27#define DT01 0x01
28#define IRDINFO 0x00
29#define TIERS 0x05
30#define DT06 0x06
31#define CAMDATA 0x08
32
33#define MAX_REC 20
34#define SYSTEM_NAGRA 0x1800
35#define SYSTEM_MASK 0xFF00
36
37unsigned char XorSum(const unsigned char *mem, int len)
38{
39 unsigned char cs;
40 cs=0x00;
41 while(len>0)
42 {
43 cs ^= *mem++;
44 len--;
45 }
46 return cs;
47}
48
49static time_t tier_date(ulong date, char *buf, int l)
50{
51 time_t ut=870393600L+date*(24*3600);
52 if (buf)
53 {
54 struct tm *t;
55 t=gmtime(&ut);
56 snprintf(buf, l, "%04d/%02d/%02d", t->tm_year+1900, t->tm_mon+1, t->tm_mday);
57 }
58 return(ut);
59}
60
61int do_cmd(unsigned char cmd, int ilen, unsigned char res, int rlen, unsigned char *data)
62{
63 /*
64 here we build the command related to the protocol T1 for ROM142 or T14 for ROM181
65 the only different that i know is the command length byte msg[4], this msg[4]+=1 by a ROM181 smartcard (_nighti_)
66 one example for the cmd$C0
67 T14 protocol: 01 A0 CA 00 00 03 C0 00 06 91
68 T1 protocol: 21 00 08 A0 CA 00 00 02 C0 00 06 87
69 */
70 int msglen=ilen+6;
71 unsigned char msg[msglen];
72 static char nagra_head[] = {0xA0, 0xCA, 0x00, 0x00};
73
74 memset(msg, 0, msglen);
75 memcpy(msg,nagra_head,4);
76 msg[4] = ilen;
77 msg[5] = cmd;
78 int dlen=ilen-2;
79 msg[6] = dlen;
80 if(data && dlen>0) memcpy(msg+7,data,dlen);
81 msg[dlen+7] = rlen;
82 if (dlen<0)
83 {
84 cs_debug("[nagra-reader] invalid data length encountered");
85 return 0;
86 }
87 if (is_pure_nagra==1)
88 {
89 msg[4]+=1;
90 }
91 if(!reader_cmd2icc(msg,msglen))
92 {
93 cs_sleepms(10);
94 if(cta_res[0]!=res)
95 {
96 cs_debug("[nagra-reader] result not expected (%02x != %02x)",cta_res[0],res);
97 return 0;
98 }
99 if((cta_lr-2)!=rlen)
100 {
101 cs_debug("[nagra-reader] result length expected (%d != %d)",(cta_lr-2),rlen);
102 return 0;
103 }
104 return cta_lr;
105 }
106 return 0;
107}
108
109int SetIFS(unsigned char size)
110{
111 unsigned char buf[5];
112 int ret;
113 // NAD, PCB, LEN
114 buf[0] = 0x21;
115 buf[1] = 0xC1; // IFS Request cmd
116 buf[2] = 0x01; // cmd length
117 buf[3] = size; // Information Field size
118 buf[4] = XorSum(buf,4); //lrc byte
119
120 cs_debug("[nagra-reader] IFS cmd: %s", cs_hexdump (1, buf, 5));
121 ret = reader_cmd2api(buf, 5);
122 if (ret < 0)
123 {
124 cs_debug("[nagra-reader] setting IFS to %02x failed", size);
125 return 0;
126 }
127 cs_debug("[nagra-reader] IFS is now %02x", size);
128 return 1;
129}
130
131void ReverseMem(unsigned char *vIn, int len)
132{
133 unsigned char temp;
134 int i;
135 for(i=0; i < (len/2); i++)
136 {
137 temp = vIn[i];
138 vIn[i] = vIn[len-i-1];
139 vIn[len-i-1] = temp;
140 }
141}
142
143void Signature(unsigned char *sig, const unsigned char *vkey,const unsigned char *msg, int len)
144{
145 IDEA_KEY_SCHEDULE ks;
146 unsigned char v[8];
147 unsigned char b200[16];
148 unsigned char b0f0[8];
149 memcpy(b200,vkey,sizeof(b200));
150 int i;
151 int j;
152 for(i=0; i<len; i+=8)
153 {
154 idea_set_encrypt_key(b200,&ks);
155 memset(v,0,sizeof(v));
156 idea_cbc_encrypt(msg+i,b0f0,8,&ks,v,IDEA_DECRYPT);
157 for(j=7; j>=0; j--) b0f0[j]^=msg[i+j];
158 memcpy(b200+0,b0f0,8);
159 memcpy(b200+8,b0f0,8);
160 }
161 memcpy(sig,b0f0,8);
162 return;
163}
164
165int CamStateRequest(void)
166{
167 if(do_cmd(0xC0,0x02,0xB0,0x06,NULL))
168 {
169 memcpy(cam_state,cta_res+3,3);
170 cs_debug("[nagra-reader] Camstate: %s",cs_hexdump (1, cam_state, 3));
171 }
172 else
173 {
174 cs_debug("[nagra-reader] CamStateRequest failed");
175 return 0;
176 }
177 return (1);
178}
179
180void DateTimeCMD(void)
181{
182 do_cmd(0xC8,0x02,0xB8,0x06,NULL);
183}
184
185int NegotiateSessionKey_Tiger(void)
186{
187
188 unsigned char vFixed[] = {0,1,2,3,0x11};
189 unsigned char parte_fija[120];
190 unsigned char parte_variable[88];
191 unsigned char d1_rsa_modulo[88];
192 unsigned char d2_data[88];
193 unsigned char sign1[8];
194 unsigned char sk[16];
195 unsigned char tmp[104];
196 unsigned char idea_sig[16];
197 unsigned char random[88];
198
199 if(!do_cmd(0xd1,0x02,0x51,0xd2,NULL))
200 {
201 cs_debug("[nagra-reader] CMD$D1 failed");
202 return 0;
203 }
204
205 BN_CTX *ctx = BN_CTX_new();
206 BIGNUM *bnN = BN_CTX_get(ctx);
207 BIGNUM *bnE = BN_CTX_get(ctx);
208 BIGNUM *bnCT = BN_CTX_get(ctx);
209 BIGNUM *bnPT = BN_CTX_get(ctx);
210 BN_bin2bn(reader[ridx].rsa_mod, 120, bnN);
211 BN_bin2bn(vFixed+4, 1, bnE);
212 BN_bin2bn(&cta_res[90], 120, bnCT);
213 BN_mod_exp(bnPT, bnCT, bnE, bnN, ctx);
214 memset(parte_fija, 0, 120);
215 BN_bn2bin(bnPT, parte_fija + (120-BN_num_bytes(bnPT)));
216 BN_CTX_end(ctx);
217 BN_CTX_free (ctx);
218
219 cs_debug("[nagra-reader] ---------- SIG CHECK ---------------------");
220 memset(tmp,0, 104);
221 memcpy(tmp+4, parte_fija+11, 100);
222 memset(idea_sig, 0x37, 16);
223 Signature(sign1, idea_sig, tmp, 104);
224 cs_debug("[nagra-reader] sign1: %s", cs_hexdump (0, sign1, 8));
225 cs_debug("[nagra-reader] sign2: %s", cs_hexdump (0, parte_fija+111, 8));
226 if (!memcmp (parte_fija+111, sign1, 8)==0)
227 {
228 cs_debug("[nagra-reader] signature check nok");
229 cs_debug("[nagra-reader] ------------------------------------------");
230 return 0;
231 }
232 cs_debug("[nagra-reader] signature check ok");
233 cs_debug("[nagra-reader] ------------------------------------------");
234
235 memcpy(reader[ridx].hexserial+2, parte_fija+15, 4);
236 memcpy(irdId, parte_fija+19, 4);
237 memcpy(d1_rsa_modulo,parte_fija+23,88);
238
239 ReverseMem(cta_res+2, 88);
240 BN_CTX *ctx1 = BN_CTX_new();
241 BIGNUM *bnN1 = BN_CTX_get(ctx1);
242 BIGNUM *bnE1 = BN_CTX_get(ctx1);
243 BIGNUM *bnCT1 = BN_CTX_get(ctx1);
244 BIGNUM *bnPT1 = BN_CTX_get(ctx1);
245 BN_bin2bn(d1_rsa_modulo, 88, bnN1);
246 BN_bin2bn(vFixed+4, 1, bnE1);
247 BN_bin2bn(cta_res+2, 88, bnCT1);
248 BN_mod_exp(bnPT1, bnCT1, bnE1, bnN1, ctx1);
249 memset(parte_variable, 0, 88);
250 BN_bn2bin(bnPT1, parte_variable + (88-BN_num_bytes(bnPT1)));
251 BN_CTX_end(ctx1);
252 BN_CTX_free (ctx1);
253
254 reader[ridx].prid[0][0]=0x00;
255 reader[ridx].prid[0][1]=0x00;
256 reader[ridx].prid[0][2]=parte_variable[73];
257 reader[ridx].prid[0][3]=parte_variable[74];
258 reader[ridx].caid[0] =(SYSTEM_NAGRA|parte_variable[76]);
259 memcpy(sk,&parte_variable[79],8);
260 memcpy(sk+8,&parte_variable[79],8);
261 cs_ri_log("[nagra-reader] CAID: %04X, IRD ID: %s",reader[ridx].caid[0], cs_hexdump (1,irdId,4));
262 cs_ri_log("[nagra-reader] ProviderID: %s",cs_hexdump (1,reader[ridx].prid[0],4));
263
264 memset(random, 0, 88);
265 memcpy(random, sk,16);
266 ReverseMem(random, 88);
267
268
269 BN_CTX *ctx3 = BN_CTX_new();
270 BIGNUM *bnN3 = BN_CTX_get(ctx3);
271 BIGNUM *bnE3 = BN_CTX_get(ctx3);
272 BIGNUM *bnCT3 = BN_CTX_get(ctx3);
273 BIGNUM *bnPT3 = BN_CTX_get(ctx3);
274 BN_bin2bn(d1_rsa_modulo, 88, bnN3);
275 BN_bin2bn(vFixed+4, 1, bnE3);
276 BN_bin2bn(random, 88, bnCT3);
277 BN_mod_exp(bnPT3, bnCT3, bnE3, bnN3, ctx3);
278 memset(d2_data, 0, 88);
279 BN_bn2bin(bnPT3, d2_data + (88-BN_num_bytes(bnPT3)));
280 BN_CTX_end(ctx3);
281 BN_CTX_free (ctx3);
282 ReverseMem(d2_data, 88);
283
284 if(!do_cmd(0xd2,0x5a,0x52,0x03, d2_data))
285 {
286 cs_debug("[nagra-reader] CMD$D2 failed");
287 return 0;
288 }
289 if (cta_res[2] == 0x00)
290 {
291 memcpy(sessi,sk,16);
292 IDEA_KEY_SCHEDULE ks;
293 idea_set_encrypt_key(sessi,&ks);
294 idea_set_decrypt_key(&ks,&ksSession);
295 cs_ri_log("[nagra-reader] session key: %s", cs_hexdump(1, sessi, 16));
296 return 1;
297 }
298 cs_ri_log("Negotiate sessionkey was not successfull! Please check tivusat rsa key");
299 return 0;
300
301}
302
303int NegotiateSessionKey(void)
304{
305 unsigned char cmd2b[] = {0x21, 0x40, 0x48, 0xA0, 0xCA, 0x00, 0x00, 0x43, 0x2B, 0x40, 0x1C, 0x54, 0xd1, 0x26, 0xe7, 0xe2, 0x40, 0x20, 0xd1, 0x66, 0xf4, 0x18, 0x97, 0x9d, 0x5f, 0x16, 0x8f, 0x7f, 0x7a, 0x55, 0x15, 0x82, 0x31, 0x14, 0x06, 0x57, 0x1a, 0x3f, 0xf0, 0x75, 0x62, 0x41, 0xc2, 0x84, 0xda, 0x4c, 0x2e, 0x84, 0xe9, 0x29, 0x13, 0x81, 0xee, 0xd6, 0xa9, 0xf5, 0xe9, 0xdb, 0xaf, 0x22, 0x51, 0x3d, 0x44, 0xb3, 0x20, 0x83, 0xde, 0xcb, 0x5f, 0x35, 0x2b, 0xb0, 0xce, 0x70, 0x02, 0x00};
306 unsigned char negot[64];
307 unsigned char tmp[64];
308 unsigned char idea1[16];
309 unsigned char idea2[16];
310 unsigned char sign1[8];
311 unsigned char sign2[8];
312
313 if (is_tiger)
314 {
315 if (!NegotiateSessionKey_Tiger())
316 {
317 cs_debug("[nagra-reader] NegotiateSessionKey_Tiger failed");
318 return 0;
319 }
320 return 1;
321 }
322 if (!has_dt08) // if we have no valid dt08 calc then we use rsa from config and hexserial for calc of sessionkey
323 {
324 memcpy(plainDT08RSA, reader[ridx].rsa_mod, 64);
325 memcpy(signature,reader[ridx].nagra_boxkey, 8);
326 }
327 if(!do_cmd(0x2a,0x02,0xaa,0x42,NULL))
328 {
329 cs_debug("[nagra-reader] CMD$2A failed");
330 return 0;
331 }
332
333 // RSA decrypt of cmd$2a data, result is stored in "negot"
334 ReverseMem(cta_res+2, 64);
335 //cs_debug("[nagra-reader] plainDT08RSA: %s", cs_hexdump (1, plainDT08RSA, 32));
336 //cs_debug("[nagra-reader] plainDT08RSA: %s", cs_hexdump (1, &plainDT08RSA[32], 32));
337 unsigned char vFixed[] = {0,1,2,3};
338 BN_CTX *ctx = BN_CTX_new();
339 BIGNUM *bnN = BN_CTX_get(ctx);
340 BIGNUM *bnE = BN_CTX_get(ctx);
341 BIGNUM *bnCT = BN_CTX_get(ctx);
342 BIGNUM *bnPT = BN_CTX_get(ctx);
343 BN_bin2bn(plainDT08RSA, 64, bnN);
344 BN_bin2bn(vFixed+3, 1, bnE);
345 BN_bin2bn(cta_res+2, 64, bnCT);
346 BN_mod_exp(bnPT, bnCT, bnE, bnN, ctx);
347 memset(negot, 0, 64);
348 BN_bn2bin(bnPT, negot + (64-BN_num_bytes(bnPT)));
349 //cs_debug("[nagra-reader] DT08 decrypted $2a data: %s", cs_hexdump (1, negot, 32));
350 //cs_debug("[nagra-reader] DT08 decrypted $2a data: %s", cs_hexdump (1, &negot[32], 32));
351
352 memcpy(tmp, negot, 64);
353 ReverseMem(tmp, 64);
354
355 // build sessionkey
356 // first halve is IDEA Hashed in chuncs of 8 bytes using the Signature1 from dt08 calc, CamID-Inv.CamID(16 bytes key) the results are the First 8 bytes of the Session key
357 memcpy(idea1, signature, 8);
358 memcpy(idea1+8, reader[ridx].hexserial+2, 4);
359 idea1[12] = ~reader[ridx].hexserial[2]; idea1[13] = ~reader[ridx].hexserial[3]; idea1[14] = ~reader[ridx].hexserial[4]; idea1[15] = ~reader[ridx].hexserial[5];
360
361 Signature(sign1, idea1, tmp, 32);
362 memcpy(idea2,sign1,8); memcpy(idea2+8,sign1,8);
363 Signature(sign2, idea2, tmp, 32);
364 memcpy(sessi,sign1,8); memcpy(sessi+8,sign2,8);
365
366 // prepare cmd$2b data
367 BN_bin2bn(negot, 64, bnCT);
368 BN_mod_exp(bnPT, bnCT, bnE, bnN, ctx);
369 memset(cmd2b+10, 0, 64);
370 BN_bn2bin(bnPT, cmd2b+10 + (64-BN_num_bytes(bnPT)));
371 BN_CTX_end(ctx);
372 BN_CTX_free (ctx);
373 ReverseMem(cmd2b+10, 64);
374
375 IDEA_KEY_SCHEDULE ks;
376 idea_set_encrypt_key(sessi,&ks);
377 idea_set_decrypt_key(&ks,&ksSession);
378
379 if(!do_cmd(0x2b,0x42,0xab,0x02, cmd2b+10))
380 {
381 cs_debug("[nagra-reader] CMD$2B failed");
382 return 0;
383 }
384
385 cs_debug("[nagra-reader] session key: %s", cs_hexdump(1, sessi, 16));
386
387 if (!CamStateRequest())
388 {
389 cs_debug("[nagra-reader] CamStateRequest failed");
390 return 0;
391 }
392 if SENDDATETIME
393 {
394 DateTimeCMD();
395 }
396 if RENEW_SESSIONKEY
397 {
398 cs_ri_log("Negotiate sessionkey was not successfull! Please check rsa key and boxkey");
399 return 0;
400 }
401
402 return 1;
403}
404
405void decryptDT08(void)
406{
407
408 unsigned char vFixed[] = {0,1,2,3};
409 unsigned char v[72];
410 unsigned char buf[72];
411 unsigned char sign2[8];
412 unsigned char static_dt08[73];
413 unsigned char camid[4];
414 int i, n;
415 BN_CTX *ctx;
416 BIGNUM *bn_mod, *bn_exp, *bn_data, *bn_res;
417
418 memcpy(static_dt08, &cta_res[12], 73);
419 // decrypt RSA Part of dt08
420 bn_mod = BN_new ();
421 bn_exp = BN_new ();
422 bn_data = BN_new ();
423 bn_res = BN_new ();
424 ctx= BN_CTX_new();
425 if (ctx == NULL) cs_debug("[nagra-reader] RSA Error in dt08 decrypt");
426 ReverseMem(static_dt08+1, 64);
427 BN_bin2bn (reader[ridx].rsa_mod, 64, bn_mod); // rsa modulus
428 BN_bin2bn (vFixed+3, 1, bn_exp); // exponent
429 BN_bin2bn (static_dt08+1, 64, bn_data);
430 BN_mod_exp (bn_res, bn_data, bn_exp, bn_mod, ctx);
431 memset (static_dt08+1, 0, 64);
432 n = BN_bn2bin (bn_res, static_dt08+1);
433 BN_CTX_free (ctx);
434 ReverseMem(static_dt08+1, n);
435
436 // RSA data can never be bigger than the modulo
437 static_dt08[64] |= static_dt08[0] & 0x80;
438
439 // IdeaCamKey
440 memcpy (&IdeaCamKey[0], reader[ridx].nagra_boxkey, 8);
441 memcpy (&IdeaCamKey[8], irdId, 4);
442 for (i = 0; i < 4; i++)
443 IdeaCamKey[12 + i] = ~irdId[i];
444
445 // now IDEA decrypt
446 IDEA_KEY_SCHEDULE ks;
447 idea_set_encrypt_key(IdeaCamKey,&ks);
448 idea_set_decrypt_key(&ks,&ksSession);
449 memcpy (&buf[0], static_dt08+1, 64);
450 memcpy (&buf[64], static_dt08+65, 8);
451 memset(v,0,sizeof(v));
452 memset(static_dt08,0,sizeof(static_dt08));
453 idea_cbc_encrypt(buf,static_dt08,72,&ksSession,v,IDEA_DECRYPT);
454
455 if (swapCW==1)
456 {
457 memset(camid,0xff,4);
458 }
459 else
460 {
461 memcpy(camid, reader[ridx].hexserial+2,4);
462 }
463 cs_debug("[nagra-reader] using camid %s for dt08 calc",cs_hexdump (1,camid,4));
464
465 // Calculate signature
466 memcpy (signature, static_dt08, 8);
467 memset (static_dt08 + 0, 0, 4);
468 memcpy (static_dt08 + 4, camid, 4);
469 Signature(sign2,IdeaCamKey,static_dt08,72);
470
471 if (memcmp (signature, sign2, 8)==0)
472 {
473 has_dt08=1;
474 memcpy (plainDT08RSA, static_dt08+8, 64);
475 cs_debug("[nagra-reader] DT08 signature check ok");
476 }
477 else
478 {
479 has_dt08=0;
480 cs_debug("[nagra-reader] DT08 signature check nok");
481 }
482}
483
484void addProvider()
485{
486 int i;
487 int toadd=1;
488 for (i=0; i<reader[ridx].nprov; i++)
489 {
490 if ((cta_res[7]==reader[ridx].prid[i][2]) && (cta_res[8]==reader[ridx].prid[i][3]))
491 {
492 toadd = 0;
493 }
494 }
495 if (toadd)
496 {
497 reader[ridx].prid[reader[ridx].nprov][0]=0;
498 reader[ridx].prid[reader[ridx].nprov][1]=0;
499 reader[ridx].prid[reader[ridx].nprov][2]=cta_res[7];
500 reader[ridx].prid[reader[ridx].nprov][3]=cta_res[8];
501 memcpy(reader[ridx].sa[reader[ridx].nprov], reader[ridx].sa[0], 4);
502 reader[ridx].nprov+=1;
503 }
504}
505
506int ParseDataType(unsigned char dt)
507{
508 char ds[16], de[16];
509 ushort chid;
510 switch(dt)
511 {
512 case IRDINFO:
513 {
514 reader[ridx].prid[0][0]=0;
515 reader[ridx].prid[0][1]=0;
516 reader[ridx].prid[0][2]=cta_res[7];
517 reader[ridx].prid[0][3]=cta_res[8];
518 memcpy(reader[ridx].sa[0], reader[ridx].sa[0], 4);
519 if ( ((cta_res[7] == 0x34) && (cta_res[8] == 0x11)) || ((cta_res[7] == 0x04) && (cta_res[8] == 0x01))) //provider 3411, 0401 needs cw swap
520 {
521 cs_debug("[nagra-reader] detect provider with swap cw!");
522 swapCW=1;
523 }
524
525 reader[ridx].prid[1][0]=0x00;
526 reader[ridx].prid[1][1]=0x00;
527 reader[ridx].prid[1][2]=0x00;
528 reader[ridx].prid[1][3]=0x00;
529 memcpy(reader[ridx].sa[1], reader[ridx].sa[0], 4);
530 reader[ridx].nprov+=1;
531
532 reader[ridx].caid[0] =(SYSTEM_NAGRA|cta_res[11]);
533 //reader[ridx].caid[0] =0x1801;
534 memcpy(irdId,cta_res+14,4);
535 cs_debug("[nagra-reader] CAID: %04X, IRD ID: %s",reader[ridx].caid[0], cs_hexdump (1,irdId,4));
536 cs_debug("[nagra-reader] ProviderID: %s",cs_hexdump (1,reader[ridx].prid[0],4));
537 return 1;
538 }
539 case TIERS:
540 if ((cta_lr>33) && (chid=b2i(2, cta_res+11)))
541 {
542 int id=(cta_res[7]*256)|cta_res[8];
543 tier_date(b2i(2, cta_res+20)-0x7f7, ds, 15);
544 tier_date(b2i(2, cta_res+13)-0x7f7, de, 15);
545 cs_ri_log("|%04X|%04X |%s |%s |", id,chid, ds, de);
546 addProvider();
547 }
548 case 0x08:
549 case 0x88: if (cta_res[11] == 0x49) decryptDT08();
550 default:
551 return 1;
552 }
553 return 0;
554}
555
556int GetDataType(unsigned char dt, int len, int shots)
557{
558 int i;
559 for(i=0; i<shots; i++)
560 {
561 if(!do_cmd(0x22,0x03,0xA2,len,&dt))
562 {
563 cs_debug("[nagra-reader] failed to get datatype %02X",dt);
564 return 0;
565 }
566 if((cta_res[2]==0) && (dt != 0x08 || dt != 0x88)) return 1;
567 if(!ParseDataType(dt&0x0F)) return 0;
568 if ((dt != 0x08 || dt != 0x88) && (cta_res[11] == 0x49)) return 1; //got dt08 data
569 dt|=0x80; // get next item
570 }
571 return 1;
572}
573
574int nagra2_card_init(uchar *atr)
575{
576 memset(rom, 0, 15);
577 reader[ridx].nprov = 1;
578 memset(reader[ridx].hexserial, 0, 8);
579 reader[ridx].caid[0]=SYSTEM_NAGRA;
580
581 if (memcmp(atr+11, "DNASP", 5)==0)
582 {
583 if(SetIFS(0xFE) != 1) return 0;
584 cs_ri_log("[nagra-reader] detect native nagra card T1 protocol");
585 memcpy(rom,atr+11,15);
586 }
587 else if (memcmp(atr+11, "TIGER", 5)==0 || (memcmp(atr+11, "NCMED", 5)==0))
588 {
589 if(SetIFS(0xFE) != 1) return 0;
590 cs_ri_log("[nagra-reader] detect nagra tiger card");
591 memcpy(rom,atr+11,15);
592 is_tiger=1;
593 }
594 else if ((!memcmp(atr+4, "IRDETO", 6)) && ((atr[14]==0x03) && (atr[15]==0x84) && (atr[16]==0x55)))
595 {
596 cs_ri_log("[nagra-reader] detect Irdeto tunneled nagra card");
597 if(!reader[ridx].has_rsa) return 0;
598 cs_ri_log("[nagra-reader] using nagra mode");
599 is_pure_nagra=1;
600 if(!do_cmd(0x10,0x02,0x90,0x11,0))
601 {
602 cs_debug("[nagra-reader] get rom version failed");
603 return 0;
604 }
605 memcpy(rom,cta_res+2,15);
606 }
607 else return 0;
608
609 if (!is_tiger)
610 {
611 CamStateRequest();
612 if(!do_cmd(0x12,0x02,0x92,0x06,0))
613 {
614 cs_debug("[nagra-reader] get Serial failed");
615 return 0;
616 }
617 memcpy(reader[ridx].hexserial+2, cta_res+2, 4);
618 cs_debug("[nagra-reader] SER: %s", cs_hexdump (1, reader[ridx].hexserial+2, 4));
619 //memset(reader[ridx].sa[0], 0xff, 4);
620 memcpy(reader[ridx].sa[0], cta_res+2, 2);
621
622 if(!GetDataType(DT01,0x0E,MAX_REC)) return 0;
623 cs_debug("[nagra-reader] DT01 DONE");
624 CamStateRequest();
625 if(!GetDataType(IRDINFO,0x39,MAX_REC)) return 0;
626 cs_debug("[nagra-reader] IRDINFO DONE");
627 CamStateRequest();
628 if(!GetDataType(CAMDATA,0x55,10)) return 0;
629 cs_debug("[nagra-reader] CAMDATA Done");
630 if(!GetDataType(0x04,0x44,MAX_REC)) return 0;
631 cs_debug("[nagra-reader] DT04 DONE");
632 CamStateRequest();
633
634 if (!memcmp(rom+5, "181", 3)==0) //dt05 is not supported by rom181
635 {
636 cs_ri_log("-----------------------------------------");
637 cs_ri_log("|id |tier |valid from |valid to |");
638 cs_ri_log("+----+--------+------------+------------+");
639 if(!GetDataType(TIERS,0x57,MAX_REC)) return 0;
640 cs_ri_log("-----------------------------------------");
641 CamStateRequest();
642 }
643
644 if(!GetDataType(DT06,0x16,MAX_REC)) return 0;
645 cs_debug("[nagra-reader] DT06 DONE");
646 CamStateRequest();
647 }
648 if (!NegotiateSessionKey())
649 {
650 cs_debug("[nagra-reader] NegotiateSessionKey failed");
651 return 0;
652 }
653
654 return 1;
655}
656
657int nagra2_card_info(void)
658{
659 int i;
660 cs_ri_log("ROM: %c %c %c %c %c %c %c %c", rom[0], rom[1], rom[2],rom[3], rom[4], rom[5], rom[6], rom[7]);
661 cs_ri_log("REV: %c %c %c %c %c %c", rom[9], rom[10], rom[11], rom[12], rom[13], rom[14]);
662 cs_ri_log("SER: %s", cs_hexdump (1, reader[ridx].hexserial+2, 4));
663 cs_ri_log("CAID: %04X",reader[ridx].caid[0]);
664 cs_ri_log("Prv.ID: %s(sysid)",cs_hexdump (1,reader[ridx].prid[0],4));
665 for (i=1; i<reader[ridx].nprov; i++)
666 {
667 cs_ri_log("Prv.ID: %s",cs_hexdump (1,reader[ridx].prid[i],4));
668 }
669 cs_log("ready for requests");
670 return 1;
671}
672
673void nagra2_post_process(void)
674{
675 if (!is_tiger)
676 {
677 CamStateRequest();
678 cs_sleepms(10);
679 if RENEW_SESSIONKEY NegotiateSessionKey();
680 if SENDDATETIME DateTimeCMD();
681 }
682}
683
684int nagra2_do_ecm(ECM_REQUEST *er)
685{
686 if (!is_tiger)
687 {
688 int retry=0;
689 if(!do_cmd(er->ecm[3],er->ecm[4]+2,0x87,0x02, er->ecm+3+2))
690 {
691 cs_debug("[nagra-reader] nagra2_do_ecm failed, retry");
692 if(!do_cmd(er->ecm[3],er->ecm[4]+2,0x87,0x02, er->ecm+3+2))
693 {
694 cs_debug("[nagra-reader] nagra2_do_ecm failed");
695 return (0);
696 }
697
698 }
699 cs_sleepms(15);
700 while(!CamStateRequest() && retry < 5)
701 {
702 cs_debug("[nagra-reader] CamStateRequest failed, try: %d", retry);
703 retry++;
704 cs_sleepms(15);
705 }
706 cs_sleepms(10);
707 if (HAS_CW && do_cmd(0x1C,0x02,0x9C,0x36,NULL))
708 {
709 unsigned char v[8];
710 memset(v,0,sizeof(v));
711 idea_cbc_encrypt(&cta_res[30],er->cw,8,&ksSession,v,IDEA_DECRYPT);
712 memset(v,0,sizeof(v));
713 idea_cbc_encrypt(&cta_res[4],er->cw+8,8,&ksSession,v,IDEA_DECRYPT);
714 if (swapCW==1)
715 {
716 cs_debug("[nagra-reader] swapCW");
717 unsigned char tt[8];
718 memcpy(&tt[0],&er->cw[0],8);
719 memcpy(&er->cw[0],&er->cw[8],8);
720 memcpy(&er->cw[8],&tt[0],8);
721 }
722 return (1);
723 }
724 }
725 else
726 {
727 //check ECM prov id
728 if (memcmp(&reader[ridx].prid[0][2], er->ecm+5, 2))
729 return (0);
730
731 // ecm_data: 80 30 89 D3 87 54 11 10 DA A6 0F 4B 92 05 34 00 ...
732 //serial_data: A0 CA 00 00 8C D3 8A 00 00 00 00 00 10 DA A6 0F .
733 unsigned char ecm_trim[150];
734 memset(ecm_trim, 0, 150);
735 memcpy(&ecm_trim[5], er->ecm+3+2+2, er->ecm[4]+2);
736 if(do_cmd(er->ecm[3],er->ecm[4]+5,0x53,0x16, ecm_trim))
737 {
738 if(cta_res[2] == 0x01)
739 {
740
741 unsigned char v[8];
742 memset(v,0,sizeof(v));
743 idea_cbc_encrypt(&cta_res[14],er->cw,8,&ksSession,v,IDEA_DECRYPT);
744 memset(v,0,sizeof(v));
745 idea_cbc_encrypt(&cta_res[6],er->cw+8,8,&ksSession,v,IDEA_DECRYPT);
746 return (1);
747 }
748 cs_debug("[nagra-reader] can't decode ecm");
749 return (0);
750 }
751 }
752 return(0);
753}
754
755int nagra2_do_emm(EMM_PACKET *ep)
756{
757 if (!is_tiger)
758 {
759 if(!do_cmd(ep->emm[8],ep->emm[9]+2,0x84,0x02,ep->emm+8+2))
760 {
761 cs_debug("[nagra-reader] nagra2_do_emm failed");
762 return (0);
763 }
764 cs_sleepms(300);
765 nagra2_post_process();
766 }
767 else
768 {
769 //check EMM prov id
770 if (memcmp(&reader[ridx].prid[0][2], ep->emm+10, 2))
771 return (0);
772
773 // emm_data: 82 70 8E 00 00 00 00 00 D3 87 8D 11 C0 F4 B1 27 2C 3D 25 94 ...
774 //serial_data: A0 CA 00 00 8C D3 8A 01 00 00 00 00 C0 F4 B1 27 2C 3D 25 94 ...
775 unsigned char emm_trim[150];
776 memset(emm_trim, 0, 150);
777 memcpy(&emm_trim[5], ep->emm+3+5+2+2, ep->emm[9]+2);
778 if(!do_cmd(ep->emm[8],ep->emm[9]+5,0x53,0x16, emm_trim))
779 {
780 cs_debug("[nagra-reader] nagra2_do_emm failed");
781 return (0);
782 }
783 cs_sleepms(300);
784 }
785 return 1;
786}
Note: See TracBrowser for help on using the repository browser.