source: trunk/reader-irdeto.c@ 1775

Last change on this file since 1775 was 1775, checked in by merek, 10 years ago

Code cleanup in irdeto_get_emm_type()

File size: 14.2 KB
Line 
1#include "globals.h"
2#include "reader-common.h"
3
4extern uchar cta_res[];
5extern ushort cta_lr;
6
7static const uchar CryptTable[256] =
8{
9 0xDA, 0x26, 0xE8, 0x72, 0x11, 0x52, 0x3E, 0x46,
10 0x32, 0xFF, 0x8C, 0x1E, 0xA7, 0xBE, 0x2C, 0x29,
11 0x5F, 0x86, 0x7E, 0x75, 0x0A, 0x08, 0xA5, 0x21,
12 0x61, 0xFB, 0x7A, 0x58, 0x60, 0xF7, 0x81, 0x4F,
13 0xE4, 0xFC, 0xDF, 0xB1, 0xBB, 0x6A, 0x02, 0xB3,
14 0x0B, 0x6E, 0x5D, 0x5C, 0xD5, 0xCF, 0xCA, 0x2A,
15 0x14, 0xB7, 0x90, 0xF3, 0xD9, 0x37, 0x3A, 0x59,
16 0x44, 0x69, 0xC9, 0x78, 0x30, 0x16, 0x39, 0x9A,
17 0x0D, 0x05, 0x1F, 0x8B, 0x5E, 0xEE, 0x1B, 0xC4,
18 0x76, 0x43, 0xBD, 0xEB, 0x42, 0xEF, 0xF9, 0xD0,
19 0x4D, 0xE3, 0xF4, 0x57, 0x56, 0xA3, 0x0F, 0xA6,
20 0x50, 0xFD, 0xDE, 0xD2, 0x80, 0x4C, 0xD3, 0xCB,
21 0xF8, 0x49, 0x8F, 0x22, 0x71, 0x84, 0x33, 0xE0,
22 0x47, 0xC2, 0x93, 0xBC, 0x7C, 0x3B, 0x9C, 0x7D,
23 0xEC, 0xC3, 0xF1, 0x89, 0xCE, 0x98, 0xA2, 0xE1,
24 0xC1, 0xF2, 0x27, 0x12, 0x01, 0xEA, 0xE5, 0x9B,
25 0x25, 0x87, 0x96, 0x7B, 0x34, 0x45, 0xAD, 0xD1,
26 0xB5, 0xDB, 0x83, 0x55, 0xB0, 0x9E, 0x19, 0xD7,
27 0x17, 0xC6, 0x35, 0xD8, 0xF0, 0xAE, 0xD4, 0x2B,
28 0x1D, 0xA0, 0x99, 0x8A, 0x15, 0x00, 0xAF, 0x2D,
29 0x09, 0xA8, 0xF5, 0x6C, 0xA1, 0x63, 0x67, 0x51,
30 0x3C, 0xB2, 0xC0, 0xED, 0x94, 0x03, 0x6F, 0xBA,
31 0x3F, 0x4E, 0x62, 0x92, 0x85, 0xDD, 0xAB, 0xFE,
32 0x10, 0x2E, 0x68, 0x65, 0xE7, 0x04, 0xF6, 0x0C,
33 0x20, 0x1C, 0xA9, 0x53, 0x40, 0x77, 0x2F, 0xA4,
34 0xFA, 0x6D, 0x73, 0x28, 0xE2, 0xCD, 0x79, 0xC8,
35 0x97, 0x66, 0x8E, 0x82, 0x74, 0x06, 0xC7, 0x88,
36 0x1A, 0x4A, 0x6B, 0xCC, 0x41, 0xE9, 0x9D, 0xB8,
37 0x23, 0x9F, 0x3D, 0xBF, 0x8D, 0x95, 0xC5, 0x13,
38 0xB9, 0x24, 0x5A, 0xDC, 0x64, 0x18, 0x38, 0x91,
39 0x7F, 0x5B, 0x70, 0x54, 0x07, 0xB6, 0x4B, 0x0E,
40 0x36, 0xAC, 0x31, 0xE6, 0xD6, 0x48, 0xAA, 0xB4
41};
42
43static uchar
44 sc_CamKey[] = { 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88 },
45 sc_GetCountryCode[] = { 0x02, 0x02, 0x03, 0x00, 0x00 },
46 sc_GetASCIISerial[] = { 0x02, 0x00, 0x03, 0x00, 0x00 },
47 sc_GetHEXSerial[] = { 0x02, 0x01, 0x00, 0x00, 0x00 },
48 sc_GetProvider[] = { 0x02, 0x03, 0x03, 0x00, 0x00 },
49 sc_GetCardFile[] = { 0x02, 0x0E, 0x02, 0x00, 0x00 },
50 sc_GetCountryCode2[]= { 0x02, 0x0B, 0x00, 0x00, 0x00 },
51 sc_GetChanelIds[] = { 0x02, 0x04, 0x00, 0x00, 0x01, 0x00 },
52 sc_GetCamKey384CZ[] = { 0x02, 0x09, 0x03, 0x00, 0x40,
53 0x18, 0xD7, 0x55, 0x14, 0xC0, 0x83, 0xF1, 0x38,
54 0x39, 0x6F, 0xF2, 0xEC, 0x4F, 0xE3, 0xF1, 0x85,
55 0x01, 0x46, 0x06, 0xCE, 0x7D, 0x08, 0x2C, 0x74,
56 0x46, 0x8F, 0x72, 0xC4, 0xEA, 0xD7, 0x9C, 0xE0,
57 0xE1, 0xFF, 0x58, 0xE7, 0x70, 0x0C, 0x92, 0x45,
58 0x26, 0x18, 0x4F, 0xA0, 0xE2, 0xF5, 0x9E, 0x46,
59 0x6F, 0xAE, 0x95, 0x35, 0xB0, 0x49, 0xB2, 0x0E,
60 0xA4, 0x1F, 0x8E, 0x47, 0xD0, 0x24, 0x11, 0xD0 },
61 sc_GetCamKey384DZ[] = { 0x02, 0x09, 0x03, 0x00, 0x40,
62 0x27, 0xF2, 0xD6, 0xCD, 0xE6, 0x88, 0x62, 0x46,
63 0x81, 0xB0, 0xF5, 0x3E, 0x6F, 0x13, 0x4D, 0xCC,
64 0xFE, 0xD0, 0x67, 0xB1, 0x93, 0xDD, 0xF4, 0xDE,
65 0xEF, 0xF5, 0x3B, 0x04, 0x1D, 0xE5, 0xC3, 0xB2,
66 0x54, 0x38, 0x57, 0x7E, 0xC8, 0x39, 0x07, 0x2E,
67 0xD2, 0xF4, 0x05, 0xAA, 0x15, 0xB5, 0x55, 0x24,
68 0x90, 0xBB, 0x9B, 0x00, 0x96, 0xF0, 0xCB, 0xF1,
69 0x8A, 0x08, 0x7F, 0x0B, 0xB8, 0x79, 0xC3, 0x5D },
70 sc_GetCamKey384FZ[] = { 0x02, 0x09, 0x03, 0x00, 0x40,
71 0x62, 0xFE, 0xD8, 0x4F, 0x44, 0x86, 0x2C, 0x21,
72 0x50, 0x9A, 0xBE, 0x27, 0x15, 0x9E, 0xC4, 0x48,
73 0xF3, 0x73, 0x5C, 0xBD, 0x08, 0x64, 0x6D, 0x13,
74 0x64, 0x90, 0x14, 0xDB, 0xFF, 0xC3, 0xFE, 0x03,
75 0x97, 0xFA, 0x75, 0x08, 0x12, 0xF9, 0x8F, 0x84,
76 0x83, 0x17, 0xAA, 0x6F, 0xEF, 0x2C, 0x10, 0x1B,
77 0xBF, 0x31, 0x41, 0xC3, 0x54, 0x2F, 0x65, 0x50,
78 0x95, 0xA9, 0x64, 0x22, 0x5E, 0xA4, 0xAF, 0xA9 },
79 sc_GetCamKey383C[] = { 0x02, 0x09, 0x03, 0x00, 0x40,
80 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
81 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
82 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
83 0x12, 0x34, 0x56, 0x78, 0x90, 0xAB, 0xCD, 0xEF,
84 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
85 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
86 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
87 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
88
89static void XRotateLeft8Byte(uchar *buf)
90{
91 int k;
92 uchar t1=buf[7];
93 uchar t2=0;
94 for(k=0; k<=7; k++)
95 {
96 t2=t1;
97 t1=buf[k];
98 buf[k]=(buf[k]<<1)|(t2>>7);
99 }
100}
101
102static void ReverseSessionKeyCrypt(const uchar *camkey, uchar *key)
103{
104 uchar localkey[8], tmp1, tmp2;
105 int idx1,idx2;
106
107 memcpy(localkey, camkey, 8) ;
108 for(idx1=0; idx1<8; idx1++)
109 {
110 for(idx2=0; idx2<8; idx2++)
111 {
112 tmp1 = CryptTable[key[7] ^ localkey[idx2] ^ idx1] ;
113 tmp2 = key[0] ;
114 key[0] = key[1] ;
115 key[1] = key[2] ;
116 key[2] = key[3] ;
117 key[3] = key[4] ;
118 key[4] = key[5] ;
119 key[5] = key[6] ^ tmp1 ;
120 key[6] = key[7] ;
121 key[7] = tmp1 ^ tmp2 ;
122 }
123 XRotateLeft8Byte(localkey);
124 }
125}
126
127static time_t chid_date(ulong date, char *buf, int l)
128{
129 // Irdeto date starts 01.08.1997 which is
130 // 870393600 seconds in unix calendar time
131 time_t ut=870393600L+date*(24*3600);
132 if (buf)
133 {
134 struct tm *t;
135 t=gmtime(&ut);
136 snprintf(buf, l, "%04d/%02d/%02d", t->tm_year+1900, t->tm_mon+1, t->tm_mday);
137 }
138 return(ut);
139}
140
141static int irdeto_do_cmd(uchar *buf, ushort good)
142{
143 int rc;
144 if( (rc=reader_cmd2icc(buf, buf[4]+5)) )
145 return(rc); // result may be 0 (success) or negative
146 if (cta_lr<2)
147 return(0x7F7F); // this should never happen
148 return(good!=b2i(2, cta_res+cta_lr-2));
149}
150
151#define reader_chk_cmd(cmd, l) \
152{ \
153 if (reader_cmd2icc(cmd, sizeof(cmd))) return ERROR; \
154 if (l && (cta_lr!=l)) return ERROR; }
155
156static int irdeto_card_init2(void)
157{
158 int i, p;
159 uchar buf[256]={0};
160
161 /*
162 * Provider
163 */
164 memset(reader[ridx].prid, 0xff, sizeof(reader[ridx].prid));
165 for (buf[0]=i=p=0; i<reader[ridx].nprov; i++)
166 {
167 sc_GetProvider[3]=i;
168 reader_chk_cmd(sc_GetProvider, 0);
169// if ((cta_lr==26) && (cta_res[0]!=0xf))
170 if ((cta_lr==26) && ((!(i&1)) || (cta_res[0]!=0xf)))
171 {
172 reader[ridx].prid[i][4]=p++;
173 memcpy(&reader[ridx].prid[i][0], cta_res, 4);
174 sprintf((char *) buf+strlen((char *)buf), ",%06lx", b2i(3, &reader[ridx].prid[i][1]));
175 }
176 else
177 reader[ridx].prid[i][0]=0xf;
178 }
179 if (p)
180 cs_ri_log("providers: %d (%s)", p, buf+1);
181
182 /*
183 * ContryCode2
184 */
185 reader_chk_cmd(sc_GetCountryCode2, 0);
186 if ((cta_lr>9) && !(cta_res[cta_lr-2]|cta_res[cta_lr-1]))
187 {
188 cs_debug("[irdeto-reader] max chids: %d, %d, %d, %d", cta_res[6], cta_res[7], cta_res[8], cta_res[9]);
189
190 /*
191 * Provider 2
192 */
193 for (i=p=0; i<reader[ridx].nprov; i++)
194 {
195 int j, k, chid, first=1;
196 char t[32];
197 if (reader[ridx].prid[i][4]!=0xff)
198 {
199 p++;
200 sc_GetChanelIds[3]=i;
201 for (j=0; j<10; j++)
202 {
203 sc_GetChanelIds[5]=j;
204 reader_chk_cmd(sc_GetChanelIds, 0);
205 if (cta_lr<61) break;
206 for(k=0; k<cta_lr; k+=6)
207 {
208 chid=b2i(2, cta_res+k);
209 if (chid && chid!=0xFFFF)
210 {
211 time_t date;
212 chid_date(date=b2i(2, cta_res+k+2), t, 16);
213 chid_date(date+cta_res[k+4], t+16, 16);
214 if (first)
215 {
216 cs_ri_log("provider: %d, id: %06X", p, b2i(3, &reader[ridx].prid[i][1]));
217 first=0;
218 }
219 cs_ri_log("chid: %04X, date: %s - %s", chid, t, t+16);
220 }
221 }
222 }
223 }
224 }
225 }
226
227// maps the provider id for Betacrypt from FFFFFF to 000000,
228// fixes problems with cascading CCcam and OSCam
229
230 if ((reader[ridx].caid[0] >= 0x1700) && (reader[ridx].caid[0] <= 0x1799))
231 {
232 memset(reader[ridx].prid, 0xff, sizeof(reader[ridx].prid));
233 for (i=0; i<reader[ridx].nprov; i++)
234 {
235 reader[ridx].prid[i][0]=0;
236 reader[ridx].prid[i][1]=0;
237 reader[ridx].prid[i][2]=0;
238 reader[ridx].prid[i][3]=i;
239 reader[ridx].sa[i][0]=0x00;
240 reader[ridx].sa[i][1]=0xFF;
241 reader[ridx].sa[i][2]=0xFF;
242 reader[ridx].sa[i][3]=0xFF;
243 }
244 }
245 cs_log("[irdeto-reader] ready for requests");
246 return OK;
247}
248
249int irdeto_card_init(ATR newatr)
250{
251 get_atr;
252 int i, camkey=0;
253 uchar buf[256]={0};
254
255 if (memcmp(atr+4, "IRDETO", 6))
256 return ERROR;
257 cs_ri_log("detect Irdeto card");
258
259 if(reader[ridx].has_rsa) // we use rsa from config as camkey
260 {
261 cs_debug("[irdeto-reader] using camkey data from config");
262 memcpy(&sc_GetCamKey383C[5], reader[ridx].rsa_mod, 0x40);
263 memcpy(sc_CamKey, reader[ridx].nagra_boxkey, 8);
264 cs_debug("[irdeto-reader] camkey: %s", cs_hexdump (0, sc_CamKey, 8));
265 cs_debug("[irdeto-reader] camkey-data: %s", cs_hexdump (0, &sc_GetCamKey383C[5], 32));
266 cs_debug("[irdeto-reader] camkey-data: %s", cs_hexdump (0, &sc_GetCamKey383C[37], 32));
267 }
268
269 /*
270 * ContryCode
271 */
272 reader_chk_cmd(sc_GetCountryCode, 18);
273 reader[ridx].acs=(cta_res[0]<<8)|cta_res[1];
274 reader[ridx].caid[0]=(cta_res[5]<<8)|cta_res[6];
275 cs_ri_log("caid: %04X, acs: %x.%02x%s",
276 reader[ridx].caid[0], cta_res[0], cta_res[1], buf);
277
278 /*
279 * Ascii/Hex-Serial
280 */
281 reader_chk_cmd(sc_GetASCIISerial, 22);
282 memcpy(buf, cta_res, 10);
283 buf[10]=0;
284 reader_chk_cmd(sc_GetHEXSerial, 18);
285 memcpy(reader[ridx].hexserial, cta_res+12, 8);
286 reader[ridx].nprov=cta_res[10];
287 cs_ri_log("ascii serial: %s, hex serial: %02X%02X%02X, hex base: %02X",
288 buf, cta_res[12], cta_res[13], cta_res[14], cta_res[15]);
289
290 /*
291 * CardFile
292 */
293 for (sc_GetCardFile[2]=2;sc_GetCardFile[2]<4;sc_GetCardFile[2]++)
294 reader_chk_cmd(sc_GetCardFile, 0);
295
296 /*
297 * CamKey
298 */
299 if ((atr[14]==0x03) && (atr[15]==0x84) && (atr[16]==0x55))
300 {
301 switch (reader[ridx].caid[0])
302 {
303 case 0x1702: camkey=1; break;
304 case 0x1722: camkey=2; break;
305 case 0x1762: camkey=3; break;
306 default : camkey=4; break;
307 }
308 }
309
310 if ((reader[ridx].caid[0] >= 0x1700) && (reader[ridx].caid[0] <= 0x1799)) // Betacrypt
311 {
312 memset(reader[ridx].prid, 0xff, sizeof(reader[ridx].prid));
313 for (i=0; i<reader[ridx].nprov; i++)
314 {
315 //values are needed for AU to work for Nagravision/Aladin/Betacrypt
316 reader[ridx].prid[i][0]=0;
317 reader[ridx].prid[i][1]=0;
318 reader[ridx].prid[i][2]=0;
319 reader[ridx].prid[i][3]=i;
320 //reader[ridx].prid[i][4]=0; //not sure what to do with this one
321
322 //since shared address is not filled, we fill it here
323 reader[ridx].sa[i][0]=0x00;
324 reader[ridx].sa[i][1]=0xFF;
325 reader[ridx].sa[i][2]=0xFF;
326 reader[ridx].sa[i][3]=0xFF;
327 }
328 }
329
330 cs_debug("[irdeto-reader] set camkey for type=%d", camkey);
331
332 switch (camkey)
333 {
334 case 1:
335 reader_chk_cmd(sc_GetCamKey384CZ, 10);
336 break;
337 case 2:
338 reader_chk_cmd(sc_GetCamKey384DZ, 10);
339 break;
340 case 3:
341 reader_chk_cmd(sc_GetCamKey384FZ, 10);
342 break;
343 default:
344 reader_chk_cmd(sc_GetCamKey383C, 0);
345 break;
346 }
347 if (reader[ridx].cardmhz != 600)
348 cs_log("WARNING: For Irdeto cards you will have to set 'cardmhz = 600' in oscam.server");
349 return irdeto_card_init2();
350}
351
352int irdeto_do_ecm(ECM_REQUEST *er)
353{
354 static const uchar sc_EcmCmd[] = { 0x05, 0x00, 0x00, 0x02, 0x00 };
355 uchar cta_cmd[272];
356
357 memcpy(cta_cmd, sc_EcmCmd, sizeof(sc_EcmCmd));
358 cta_cmd[4]=(er->ecm[2])-3;
359 memcpy(cta_cmd+sizeof(sc_EcmCmd), &er->ecm[6], cta_cmd[4]);
360 if (irdeto_do_cmd(cta_cmd, 0x9D00)) return ERROR;
361 if (cta_lr<24) return ERROR;
362 ReverseSessionKeyCrypt(sc_CamKey, cta_res+6);
363 ReverseSessionKeyCrypt(sc_CamKey, cta_res+14);
364 memcpy(er->cw, cta_res+6, 16);
365 return OK;
366}
367
368int irdeto_get_emm_type(EMM_PACKET *ep, struct s_reader * rdr) //returns TRUE if shared emm matches SA, unique emm matches serial, or global or unknown
369{
370 int i, l = (ep->emm[3]&0x07), ok=0;
371 int mode = (ep->emm[3]>>3);
372 if (mode&0x10) {
373 // Hex addressed
374 ep->type = UNIQUE;
375 memset(ep->hexserial,0,8);
376 memcpy(ep->hexserial, ep->emm + 4, l);
377 return (mode == rdr->hexserial[3] && (!l || !memcmp(ep->emm+4, rdr->hexserial, l)));
378 }
379 else {
380 // Provider addressed
381 for(i = 0; i < rdr->nprov; i++) {
382 ok = (mode == rdr->prid[i][0] && (!l || !memcmp(ep->emm+4, &rdr->prid[i][1], l)));
383 if (ok) break;
384 }
385
386 ep->type = SHARED;
387 memset(ep->hexserial,0,8);
388 //prid in hexserial instead of SA
389 memcpy(ep->hexserial, ep->emm+4, l);
390 return ok;
391 }
392}
393
394int irdeto_do_emm(EMM_PACKET *ep)
395{
396 static const uchar sc_EmmCmd[] = { 0x01,0x00,0x00,0x00,0x00 };
397 uchar cta_cmd[272];
398
399 int i, l=(ep->emm[3]&0x07), ok=0;
400 int mode=(ep->emm[3]>>3);
401
402 uchar *emm=ep->emm;
403 if (mode&0x10) // Hex addressed
404 {
405 ok=(mode==reader[ridx].hexserial[3] &&
406 (!l || !memcmp(&emm[4], reader[ridx].hexserial, l)));
407 }
408 else // Provider addressed
409 {
410 for(i=0; i<reader[ridx].nprov; i++)
411 {
412 ok=(mode==reader[ridx].prid[i][0] &&
413 (!l || !memcmp(&emm[4], &reader[ridx].prid[i][1], l)));
414 if (ok) break;
415 }
416 }
417
418 if (ok)
419 {
420 l++;
421 if (l<=ADDRLEN)
422 {
423 const int dataLen=SCT_LEN(emm)-5-l; // sizeof of emm bytes (nanos)
424 uchar *ptr=cta_cmd;
425 memcpy(ptr, sc_EmmCmd, sizeof(sc_EmmCmd)); // copy card command
426 ptr[4]=dataLen+ADDRLEN; // set card command emm size
427 ptr+=sizeof(sc_EmmCmd); emm+=3;
428 memset(ptr, 0, ADDRLEN); // clear addr range
429 memcpy(ptr, emm, l); // copy addr bytes
430 ptr+=ADDRLEN; emm+=l;
431 memcpy(ptr, &emm[2], dataLen); // copy emm bytes
432 return(irdeto_do_cmd(cta_cmd, 0) ? 0 : 1);
433 }
434 else
435 cs_debug("[irdeto-reader] addrlen %d > %d", l, ADDRLEN);
436 }
437 return ERROR;
438}
439
440int irdeto_card_info(void)
441{
442 //original irdeto_card_info is not pure info, it is actually needed for init
443 return OK;
444}
445
Note: See TracBrowser for help on using the repository browser.